{ "Event": { "published": true, "date": "2021-05-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-06", "timestamp": 1620345782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8d984019-62bc-4b80-89d4-73e0c48b2712", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c114eb-ae87-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620318344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318344, "uuid": "0e90c4e8-e067-4487-9ac9-60ab656fdcac", "comment": "Malware payload (IcedID)", "value": "b1b2f07c3591c95c15323a819077fb06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318344, "uuid": "59e8a141-6ec6-4a96-8f0a-74007b19fad7", "comment": "Malware payload (IcedID)", "value": "0031ebaf8613ea25a949b6da84414169ff96172207d29741eadc3907e869fc17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318344, "uuid": "0b366077-9549-4a13-a1b1-8bcdf209c8ec", "comment": "Malware payload (IcedID)", "value": "033abd9bef9cbfb0a0697cd3a0d33e3489c82926", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318344, "uuid": "3b85ef52-802c-4654-b9fd-7c34118da0b6", "comment": "Malware payload (IcedID)", "value": "db6d77121df5508ae947748af8a5a2838dddbe718a2b3f9e774f504daf8ef00e6ed2ea22192ba0d180a421ec313893a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318344, "uuid": "d688a4d3-60fb-45a5-a1d3-d8f96d8ff46e", "value": "43139D1AB9CA81FAFC04DDFCF428450E9E288711051DA0EBE4785FC3DDA6506799F1AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318344, "uuid": "c5a7da0e-926c-4275-9e9a-c322acc7ceb9", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318344, "uuid": "050cc883-8891-4b06-9781-c635abef6fa6", "value": "768:GGS/PPJ69K2c5r8OsDBZpAYqRHAZorOs1gxuqkB1chYsNbp6SGu4nQvxVH2oOBL:yPRESOn+YC1ZB1chYsNl6SWn+LcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620318344, "uuid": "53745138-73e1-4d9f-b22f-214a615ad4f6", "value": 42121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620318344, "uuid": "cf91ff4c-e20a-46b9-ad15-5a2b63d42afd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318344, "uuid": "e93f9475-caf2-41f9-8f4a-b144644006cb", "value": "b1b2f07c3591c95c15323a819077fb06.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54479be4-ae6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620307444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307444, "uuid": "8c9f1aff-1322-4e87-90a1-77f05477ed3c", "comment": "Malware payload (AgentTesla)", "value": "bf4a39dd86f87dd7764b7e65046d5509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307444, "uuid": "dfa9cb05-f742-48d9-bd28-3eda14dfb885", "comment": "Malware payload (AgentTesla)", "value": "00b861d10177b6a5d130b4489f1cca65c00ff8b123236f2f4123fcbf70302fa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307444, "uuid": "59fc7f23-91dc-408c-8d9c-501017dc5c77", "comment": "Malware payload (AgentTesla)", "value": "5681cf0f2f6945d0acff753d70fe2425dbc9294d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307444, "uuid": "1670afc6-11f8-44cf-bb01-87ebe8d0f50a", "comment": "Malware payload (AgentTesla)", "value": "45889b510e288faf29448171e58f1d98de47945159d99b32ff5721bb92b33b6eed1cbe3c2626cc2beb3936c3d4822586", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307444, "uuid": "33d35748-53ba-43dd-95a6-636bccd2bf05", "value": "0906BFB876047DE6266F576BDE96ACDC03B617229ACBA4CD80A477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307444, "uuid": "e913ed8e-0c11-4e69-bf9b-4cfe44255492", "value": "24576:bdKHbpQxaLrg2af9YnoH8gFL6k+3heKJt52lItpRfjoA9sErXuBMPCy5IHq3Ef/q:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620307444, "uuid": "e2d36d85-74f9-41ab-9217-4c450aa803a8", "value": 3726929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620307444, "uuid": "652b8ef5-4ac6-4040-a79b-c3eecf5f3367", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307444, "uuid": "afbee90e-1cd4-48fd-9718-225b231091ec", "value": "BOA_20219398900.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d31471-ae8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620319961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319961, "uuid": "29171a17-7380-440e-8647-2dca173e6972", "comment": "Malware payload (RaccoonStealer)", "value": "03c5e639039fc1d30c92df7527e6e464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319961, "uuid": "bf1bd932-4d4b-4635-8fa2-df7f1b994554", "comment": "Malware payload (RaccoonStealer)", "value": "012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319961, "uuid": "57da9a29-173c-44f2-8793-c416bf122c90", "comment": "Malware payload (RaccoonStealer)", "value": "42af028d0e3255c97626b06ae262a34b46419772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319961, "uuid": "464aa62d-3b90-4e49-8258-9f0376aee799", "comment": "Malware payload (RaccoonStealer)", "value": "031af1d4ca07a2edc730a525cd53a8ca1f7ca86db3b223cc189ab702978e1e555189f205b62e9afe3622ea1a32d1d862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319961, "uuid": "5c0b079e-ebcf-4bad-b076-eb3af00aeb74", "value": "8FD4F112F180C475DC7714768C25DBB18E6A7C6256251ABF7ACC3ABAEF282D17732309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319961, "uuid": "1968bc39-7996-4ede-8b12-27370e597db7", "value": "f7ec5170de034aa3644c4457a2b957d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319961, "uuid": "f84c843c-a0fa-4343-b543-d66514b6597b", "value": "12288:kwFVzgdn12PiuBWq5y6zLJ7M29SGMzmr:kAVgn+igWwVgXGMzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620319961, "uuid": "ee56a034-4e70-44f1-b628-71a278806676", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620319961, "uuid": "f947ff8d-90d6-4485-b012-0ba061bb3ed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319961, "uuid": "c9bab050-e64c-4840-a94d-937e3a9c9f57", "value": "03c5e639039fc1d30c92df7527e6e464.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d9958f-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342109, "uuid": "7139f118-3e66-4a85-a4f3-b092a1cafb79", "comment": "Malware payload", "value": "7997120e4780d3490ed1ca8a6f554d47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342109, "uuid": "44582ae9-2f8f-4624-a0b9-df38d9a13da6", "comment": "Malware payload", "value": "01311f673959f5bb30477bda360a0ba3a5674946bba7c719ac154d18a5ba06cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342109, "uuid": "214546d6-40e3-45c0-9f03-02970774d6e0", "comment": "Malware payload", "value": "b5edd09c741f49ea5302b9d261b4de9c01740a67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342109, "uuid": "ba636b79-6b02-4385-8ac9-5fc03d4b9b90", "comment": "Malware payload", "value": "f5d765b5ab585babfdf748b707db1aa9fccbcf62bda39656d5cd16200165026df37698916c69775c29418fcf801db6c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342109, "uuid": "e4f0cf8a-c024-4e37-8bff-713ddcb1ac21", "value": "F2F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342109, "uuid": "67cb4885-f57d-4de7-8fce-6da4e13ef2e5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342109, "uuid": "1ff4e6fc-9571-4459-bf92-e473a4753f6f", "value": "3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342109, "uuid": "8cf690ae-02ee-43da-afe1-18c6f64f0bba", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342109, "uuid": "2a62a5ab-eca4-4a7c-b59b-049cda72e766", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342109, "uuid": "9202f82b-c914-48e9-85c6-d34558e58a94", "value": "7997120e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd82f8b-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331403, "uuid": "f94f9428-1695-481b-9cc5-7d90a3ee2914", "comment": "Malware payload (Dridex)", "value": "01b74db2170dd73020da80fba83012b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331403, "uuid": "685d39cd-3e98-4fd4-909f-b6cd85a8d58a", "comment": "Malware payload (Dridex)", "value": "013c44c8c254bbd729c84485bbeac66a7140dd3fb976f3f7fd66271cf84ebc8a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331403, "uuid": "a654e62f-5399-4bd0-a879-421e9dcc2279", "comment": "Malware payload (Dridex)", "value": "1d2a72828a228ebda9e7c68146c80ed73be1410e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331403, "uuid": "60f1c46a-f45c-4a7a-b29a-a9d893ce8870", "comment": "Malware payload (Dridex)", "value": "50c1c2a8936f3076269b1bcd73d4bc2d6f475690ed5d72bd77a6119f14e5696210d8f5f5bc608fd0638d33c3375df824", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331403, "uuid": "026011b9-4836-4adc-a9d8-ea7681ed9bb8", "value": "63F3C004D167E6D6C51A583222EA2B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331403, "uuid": "4fc83042-ac68-495a-8ff4-a1a4383bfb39", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331403, "uuid": "0f42b201-83d6-4fa4-b039-cf5c077645ef", "value": "3072:AgG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idxc:uERMVPG6+Y63HoG1QawL40Prx6Kzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331403, "uuid": "2c4655cf-b4af-4a9e-ab94-52654938a3e4", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331403, "uuid": "e70dc7f3-9230-4795-9ae5-f72888bcb32e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331403, "uuid": "2b27b7f3-f1bb-4497-b4cc-3c56cf86fa97", "value": "01b74db2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7d4eea-ae2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620279002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279002, "uuid": "b214e6d3-5a19-4140-be96-0546f29c33c7", "comment": "Malware payload (NanoCore)", "value": "2fba2aea6cde2c0ed216396f9a4b9a90", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279002, "uuid": "a2c38531-c90b-4489-bd7a-79a96ce43e74", "comment": "Malware payload (NanoCore)", "value": "017701bd35ed869f05270d7751c0c436008abc9ed68257d3045064d55c8e1fd0", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279002, "uuid": "445137d6-69ca-4a6d-8836-d5c12df040ab", "comment": "Malware payload (NanoCore)", "value": "e468d6a9eb558728917bb30ca0eb16e896196014", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279002, "uuid": "fe750e58-1cf9-4f78-9bf6-39b05d781213", "comment": "Malware payload (NanoCore)", "value": "8691b141080dfd32913e5b7d96765bd227848abd45ab0dcd7e37d7e7a3f6dd6d28f988c5300af8428dbd9dc9841b600b", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279002, "uuid": "2e83a9fc-361e-4ff8-a901-ba056cb07435", "value": "F25533F5EC888B7BCD5B253794ABD4342AFEDD4C65DCE1034A1E772646363B2018B688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279002, "uuid": "03cd3bd3-05f3-4afb-bef5-45c4299865a1", "value": "24576:EK3Ntrf35Dbw4c/3BlCqN0N0dTqJp95U7cd159XquznZvW7xdUPYfGl:EK3XhD0sqiNgTqJPCcd9XFn9W0PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279002, "uuid": "37c1123b-6442-487f-8e90-a24e7eb0f9e4", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279002, "uuid": "0dde0003-cb77-461e-8cc7-8e84d2746923", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279002, "uuid": "9e4caa61-7db7-4258-acc1-373e377c5de8", "value": "PO Revised #87726.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fca8cbb-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298901, "uuid": "64524295-dba5-45d2-b279-f4ecc08461a6", "comment": "Malware payload (Dridex)", "value": "5346ff314d188b32445ad0186e247f41", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298901, "uuid": "808246c5-51ba-4fda-a1d2-f27a9ccbe5d4", "comment": "Malware payload (Dridex)", "value": "019f0b4b8abbfa5d3928d0831ed99f766fad59112113524ced570de9ef3d28fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298901, "uuid": "ee07e8cb-4d69-472f-bd7b-419e4423be80", "comment": "Malware payload (Dridex)", "value": "b11af64c6d14331e4b537749f1f551579aa792c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298901, "uuid": "85a0a739-7d59-44d7-b34f-78f39e5c2f46", "comment": "Malware payload (Dridex)", "value": "c2f054667d3757694bd8154aaf54077041c44df36509c88d128cef89ae35dbb4d5983781f0ee273a92975c80d7e2f974", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298901, "uuid": "c50e9a1c-bf31-4ba6-99db-4a25038743af", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298901, "uuid": "d2acf23d-7a02-478b-8d00-81100b1e432a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298901, "uuid": "ddb3aef7-8981-4094-b801-fd305d3ea689", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298901, "uuid": "8b234688-1d27-4f55-be78-9c3274ed5589", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298901, "uuid": "ddc24631-6701-4bce-aab5-f16c11e3fd4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298901, "uuid": "45916f72-6797-4da5-b195-74be76997696", "value": "5346ff31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad67e57-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295268, "uuid": "046dd4c3-eb8e-436c-aaf3-5a74e68739be", "comment": "Malware payload (Dridex)", "value": "871e910e94fe4ea758920b93a017d97a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295268, "uuid": "ffc7b7bf-1775-4b69-a8cf-f11e6fd3d46e", "comment": "Malware payload (Dridex)", "value": "01e18412264ccc8084afc38d846106e59fb93393b0f7ca903a70e82ebb09fe22", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295268, "uuid": "1070acd3-ad3c-4819-a5c8-3138e346aaf1", "comment": "Malware payload (Dridex)", "value": "bd13862d08688cd433ac6e76acabf4c346a097d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295268, "uuid": "c46fee45-62ae-4bbe-8029-2adb5249a18c", "comment": "Malware payload (Dridex)", "value": "a69770db16c59dd7a982d695dbcc451312084972067a02039cd8eb907076776b8d72b3f7e316d4bd7510e674e8bb3a83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295268, "uuid": "338c51c8-f612-4d73-9e8b-d04387488c8e", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295268, "uuid": "c6ef0538-089f-4cd3-aa5e-1a7bd45ebbec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295268, "uuid": "02e8415d-e010-4391-bd5c-6cb022b1c23e", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295268, "uuid": "ea85d610-44b5-4e73-9633-35b29132001f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295268, "uuid": "76d44efe-f3bf-4059-9754-e9b3690c6987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295268, "uuid": "7e5b38f1-81da-4135-8aab-e64054078f74", "value": "871e910e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f870d3-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338604, "uuid": "7be0631e-62e8-48fc-a9a3-a2acf21ab851", "comment": "Malware payload", "value": "b62d0f00d6634d31ba3dbe29e5c53e32", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338604, "uuid": "66366ef4-606e-4777-95eb-db3cab7bb3b7", "comment": "Malware payload", "value": "02180b13e6444d3e1342ef2b2f965b52d30fb711e90dc4b490bf0a718c3a40e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338604, "uuid": "49aa49bd-a09d-4094-b930-82b866f254b3", "comment": "Malware payload", "value": "8de498dead05bbd8e04b5d11da30427aaad764d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338604, "uuid": "a5a650b9-1df8-44d1-8d1b-1ed2112c871c", "comment": "Malware payload", "value": "904e2f5b7f056e7019872534b2f341f4fcf543d29397c8cb446482ada5bcccfc4eb039a062afaf02b3428f1b3a66ac3c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338604, "uuid": "170fc015-d9a2-4d70-b452-f86d3d09fd18", "value": "82F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338604, "uuid": "c380c820-b066-4461-aaed-62af228ca988", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338604, "uuid": "7a0d9d9a-5e61-455c-97e6-834e6242186e", "value": "3072:nB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:B4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338604, "uuid": "ffcce384-2f75-4e6e-b2e6-e6ff5aa095c6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338604, "uuid": "e88771c3-ad21-4760-aa26-87fbdc2659c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338604, "uuid": "af448944-4c65-4c5b-b21a-bcc7a0ec6f41", "value": "b62d0f00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb0d34e-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339374, "uuid": "b99d0c61-b6d0-45d3-b71e-2278c72ab04c", "comment": "Malware payload", "value": "906212ab29875fcf0d09bfa6d34e33b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339374, "uuid": "c3e91952-d014-4212-aaf8-d72041fe377f", "comment": "Malware payload", "value": "02710d074a3c33293febbab019e1e4dc64f503e5df2e260ed21114c09300426e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339374, "uuid": "0bbdbf84-e083-43ac-953f-6b4c6b492c5c", "comment": "Malware payload", "value": "61253b902df9ab087424ad5602e23a51f74f4fec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339374, "uuid": "4c482149-9131-4470-8bb3-52926c2ad9c2", "comment": "Malware payload", "value": "ee5bbc52e208e287c30770a08076e3decba45abc322fd89543117e0fb6d94814dbe665f3872c37177ab0ba5b1ab15d25", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339374, "uuid": "84cec8f8-4e32-4e88-bf84-152f9a059254", "value": "4CF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339374, "uuid": "8033f346-0b07-4a2a-81bf-adebb3e8fc95", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339374, "uuid": "445d80f1-5447-46c0-a869-6ea0861dba28", "value": "3072:whG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idKI:ZERMVPG6+Y63HoG1QawL40Prx6KoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339374, "uuid": "84df267d-aad4-4b81-9e70-193cc34f9308", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339374, "uuid": "7f60cc71-f1d9-4896-92d2-9803839bcd82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339374, "uuid": "c65a0da4-e4a4-46f3-9ae0-61376dcace4b", "value": "906212ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27243f9f-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620309946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309946, "uuid": "bd2152c5-6a08-4468-85f7-2a48c3fbb825", "comment": "Malware payload (njrat)", "value": "fc65aa78c3d7ef430e8e3c2b01b91dd1", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309946, "uuid": "4fe97a07-67c2-4ba2-b9a2-51934539da92", "comment": "Malware payload (njrat)", "value": "030cd4cdbd815e8319eb343efb96d996c81e0e563aa0dfcbd2bb4a120fbaeb63", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309946, "uuid": "b9f20815-0cf5-4c61-809c-24878fe79c8b", "comment": "Malware payload (njrat)", "value": "72fe853d8ef8d9130f599757934024e0b17f9d39", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309946, "uuid": "4b25c14d-3f6b-41ec-934f-c9a2c683ca3a", "comment": "Malware payload (njrat)", "value": "3996963fe17f15b4ed7c028a14bd65ba180746576dcc14b802911df5cf50dc54cabde1eb441e88175655e28dfd5a6a91", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309946, "uuid": "fe91c6a1-b375-46a1-8000-51349dd86dd1", "value": "0744F7CD3216B4DFC95784B1BD52DC7CD733A87A930BA207647326ADD66D0AB9B100E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309946, "uuid": "8ae1e37e-9c09-4e18-aa12-e03172134f88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309946, "uuid": "796a101c-fae8-4a11-9ab8-255add4e7c3c", "value": "3072:PuZqRpCnyublZ2RXxfg6/xr+VBFaI1YIYiheeeeeeeeefYDeOiClppeppOpplppZ:GZOpcjBZ2RXxfVZrMBgkSOG9iO2RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309946, "uuid": "5299af7d-5ad0-49fe-8426-9c2f33891477", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309946, "uuid": "e6d3958d-ac03-4a1f-a5b3-c9511324b123", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309946, "uuid": "29ef116e-3c33-4eec-9de2-7454089a9c3d", "value": "45(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fcb7d1-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259365, "uuid": "d6ad6885-fdb8-4c37-8540-990ecf9ccc4a", "comment": "Malware payload (Dridex)", "value": "536ff30cb905bb10fff6daf9343809e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259365, "uuid": "dbe476e3-c358-4953-ae57-24eda15ce0ca", "comment": "Malware payload (Dridex)", "value": "037e1c42ffc535bfd46503e781bdf546a828deb24c46c2775f604bed50402058", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259365, "uuid": "4d5904fe-228f-4a63-91c0-741106e72acc", "comment": "Malware payload (Dridex)", "value": "fb16d3928e9a51cb0db41a4b88baa187fa983b97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259365, "uuid": "c8542722-2808-4e20-8a84-6a88f7b27a8b", "comment": "Malware payload (Dridex)", "value": "cac8438ea2ff8341c161cbf7a7fb5a13c20082373c69a010926ea909770515ae220785d7950cabf50a8f332ee281656b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259365, "uuid": "b0c46ca9-ee2b-47af-9a8c-e0dd325a57cf", "value": "B6F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259365, "uuid": "d979c537-cb1d-4d63-99de-a9607e6da1dd", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259365, "uuid": "14b04f39-132e-4b1a-8bce-0b42de8954b5", "value": "3072:vB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:i4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259365, "uuid": "35413569-4a03-47e4-9c79-dc71f51b33b4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259365, "uuid": "fa9e6080-5d9f-4a30-8ac4-aa6e62772052", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259365, "uuid": "62a2232e-3a1b-41df-8069-4f55a1fe5508", "value": "536ff30c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6c2f35-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288342, "uuid": "798d8bb4-f138-4a17-bd9b-efab6d75a6a5", "comment": "Malware payload (Dridex)", "value": "f39c467240b3b46b0adb1e7534af133b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288342, "uuid": "0d1a78f4-eef7-489d-bee2-87bf3810cae6", "comment": "Malware payload (Dridex)", "value": "03f8da108c39dfc92ad0626301402e76d9ba6e147b56bfe58ef3ceb4bbc5305b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288342, "uuid": "a246867c-313d-46ac-9971-6451886530ec", "comment": "Malware payload (Dridex)", "value": "a10b300ab4c9203e2d050f2a3ae525ce05c217ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288342, "uuid": "5093fe65-8bbe-4778-a382-4d795f8906ad", "comment": "Malware payload (Dridex)", "value": "ebda047971cbc7a7091276f8ba9366196a383c1e34ed0e0ea4eef831d4a662363b5e541982d53e0633c9ee16366c8490", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288342, "uuid": "5d012d5b-400a-4382-a14b-5960048e1159", "value": "0BF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288342, "uuid": "7bbabf0f-a7d2-431e-82e0-246b181d41b6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288342, "uuid": "bc793229-4245-4a43-bec2-bed5ca2f54db", "value": "3072:Be45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:g4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288342, "uuid": "fe2d3a71-bce3-4f68-8a3d-b2ea12d6f8f1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288342, "uuid": "626880ce-ba2f-421c-8b7e-bda6a65b4366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288342, "uuid": "311d392f-2c0f-4ff9-925d-7820e7927d00", "value": "f39c4672_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750249b2-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316948, "uuid": "e14bcc10-6ba1-42e5-a3fe-f746d0b911ce", "comment": "Malware payload (Dridex)", "value": "aa0aa520f866ec14abeee60a1dc7598b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316948, "uuid": "c3ee7040-f757-4b21-a010-084c6e54684d", "comment": "Malware payload (Dridex)", "value": "0408776b0f1d5308e42102aae2ac7bd204cb871b7e873f0abb2bc7ff7fd90c94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316948, "uuid": "a2b0d237-9989-4c1b-a9eb-8a5157558310", "comment": "Malware payload (Dridex)", "value": "182ccb16327fe70e7fbe708e7713137ec74b2a9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316948, "uuid": "ff81f439-0166-4198-a4dc-2df6be5dc6f4", "comment": "Malware payload (Dridex)", "value": "3cb27b8c5dea55c405c8db912914a369fcb0a46b104a0330f45d37eb5521c8e87786a58726f5994a85341837221681d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316948, "uuid": "213caeb4-6987-45d8-92de-1196265860c7", "value": "9CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316948, "uuid": "c72afb23-8e07-432e-8214-761b2aca53cf", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316948, "uuid": "f2d29d16-207a-47a0-a73b-780fec0d0657", "value": "3072:vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316948, "uuid": "8be15a0c-be46-4515-a5ef-cd0acc9a1a79", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316948, "uuid": "c24ce27e-ff1c-48c1-8d0c-10740bf6c523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316948, "uuid": "7562e7cd-5fb2-4ce0-aeef-87301aa9f1cb", "value": "aa0aa520_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c856acf-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339295, "uuid": "33e097ca-4b4a-4c99-a38c-77668d207f63", "comment": "Malware payload", "value": "a6710ff2597a95ce139f01615bd042ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339295, "uuid": "1b46bfb6-d7c7-4604-b8d7-5d3bfc35e712", "comment": "Malware payload", "value": "042a107a2cfcf762e40ba1f07d5fc7a34803eb6f7c4be8fd41e51d77215b9508", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339295, "uuid": "b6816457-2b9a-42f6-b69f-b8a154aed544", "comment": "Malware payload", "value": "4c599be8d8694cea0b598013480c54ba907bc874", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339295, "uuid": "d64a3269-4f79-4194-b98d-74f6af57ea0e", "comment": "Malware payload", "value": "37e12692e6eae92a5c8cb6a2b132c480effc5d1e7b86216dbe06e32510a1c020f098ae771f560b376e123d29eabb41b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339295, "uuid": "86cd6a23-54d6-46fb-82b4-6405a98bded4", "value": "02F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339295, "uuid": "50ed58ff-070c-4e82-848f-316a585b7404", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339295, "uuid": "def5caa5-ddb0-46bc-82d6-3baedf197855", "value": "3072:NkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:1ERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339295, "uuid": "5bffb1ed-76a3-4ee0-91c5-a02c0b8b123a", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339295, "uuid": "c0d0041e-8267-404e-825d-cc96ccd41c32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339295, "uuid": "abdec880-07b6-4175-9a44-b79fdc5250ec", "value": "a6710ff2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9646ee0-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331290, "uuid": "5d90eb8c-61e1-42ed-8216-68292ce3b082", "comment": "Malware payload", "value": "9f1a40f130ad2342725181606d275fd6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331290, "uuid": "ebe60398-77e3-498d-93f4-49999f9a8435", "comment": "Malware payload", "value": "047602d3a5d93681b2a8334310a9584d27a7da00479b54e4cb875ad4bb22c6de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331290, "uuid": "b30f2639-886f-43b3-856e-f171cab391e5", "comment": "Malware payload", "value": "c5acff88f220e2f7b2c1fd695da681ee21655add", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331290, "uuid": "839e22a7-f45d-4cb1-9370-1e228ec11e13", "comment": "Malware payload", "value": "79b432aa5dfc049907d6b8c58af7412ad1cb1d991a4479b3e9b3cd16251fd7c1e2b7a5b239e2d187a541f8b0bc12bf6f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331290, "uuid": "ec8c11f0-a628-41a7-be05-cc21bcefa07b", "value": "ACF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331290, "uuid": "05ae2b49-8ef6-4dd1-8994-aea30fc53d89", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331290, "uuid": "81ff441b-ad7b-4010-bd45-df105d21c1bd", "value": "3072:uWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:u42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331290, "uuid": "7ddf6560-0957-4ac1-ab94-06e838415af0", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331290, "uuid": "9681f334-d7d7-4a8d-a506-76b8f5a42cb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331290, "uuid": "acdffb4a-cd78-4a4a-9e3a-bc7a34ed7730", "value": "9f1a40f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7681e25-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338642, "uuid": "8b00651a-faa3-47fe-aad8-dd6135f20411", "comment": "Malware payload", "value": "5ec777f59f0ec88be6bdeb2fad947d5e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338642, "uuid": "8eed2838-8297-4b6f-a180-c63f6c4ee762", "comment": "Malware payload", "value": "0480dcdc45dc5455f7ac014c20a65c5a5c8fdac4acd61673b37d9df8bcedc5f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338642, "uuid": "aeae00f2-d835-4672-9702-4342d1309e8d", "comment": "Malware payload", "value": "8ad91c0fed43094d0778204b014698309d7c2bb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338642, "uuid": "34f6179f-9ed3-4881-b120-44c336e66cc4", "comment": "Malware payload", "value": "066161c5dff270b88c2a6f37a025ae5a9e03e7bfd397bea53ad0ea68183b9c9fa683f5d205b3889a4298aafc7a27953e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338642, "uuid": "30148e6c-b4ee-4b4a-8796-44fe8d58bb36", "value": "8BF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338642, "uuid": "ff1d2c26-9dd7-44e6-ab3c-28a87a79b3ba", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338642, "uuid": "5d353174-5601-4aec-8b7c-e891db8a2501", "value": "3072:HB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:h4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338642, "uuid": "d4ea1e77-c884-4a4d-bc55-ad471eef8b59", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338642, "uuid": "d5bb92f4-3ba3-4a6a-8725-859e948ddbb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338642, "uuid": "c9e984fd-4ea9-4f62-8844-71ffda037ccf", "value": "5ec777f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e12334-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331391, "uuid": "fd1bedcc-83e5-4514-bae0-9ae5ad4e20d8", "comment": "Malware payload (Dridex)", "value": "383355c4689a110cc97105a68a4a0449", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331391, "uuid": "4cce766f-b0df-4619-a76c-deb7a7a135f3", "comment": "Malware payload (Dridex)", "value": "049103e740145cec658c8407ac7a6648fb267a11ff92ebcd4f20eb9abe2d31d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331391, "uuid": "d3dae8e2-d2ef-49c8-a0dc-ca615c8bed43", "comment": "Malware payload (Dridex)", "value": "f3f0c2709536e69d677b013bccf4655b8f35abb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331391, "uuid": "bc681a1d-6b3a-49c2-b027-ca7f1aee9383", "comment": "Malware payload (Dridex)", "value": "ba96b8a23ad2a10df1d4912287665b26a00f2df329a23b44c716535d9a915261a7f8701f5a3ede46e04a0f228d442014", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331391, "uuid": "d2eb1958-f2c0-46b5-9225-84098e9bce79", "value": "A4F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331391, "uuid": "4cccab98-478c-4a1b-a2da-e2f4fa9d08ed", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331391, "uuid": "95830ca9-a01e-482e-aa4b-78e6901a7c1f", "value": "3072:WgG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idxc:gERMVPG6+Y63HoG1QawL40Prx6Kzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331391, "uuid": "1cfac108-9d3e-425b-8522-8d42e57da3dd", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331391, "uuid": "11622fdc-3ff2-4f03-8f9b-5d73faec494c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331391, "uuid": "ed087e58-f6e2-452a-9c28-078ddeb5dacd", "value": "383355c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7bba1d-ae5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620301014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301014, "uuid": "85e058a7-a509-4016-9849-04c5401a8c90", "comment": "Malware payload (AgentTesla)", "value": "8eec65a6a19f3f54da87e009289a1904", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301014, "uuid": "ad29f769-8a26-4716-8938-52743743872a", "comment": "Malware payload (AgentTesla)", "value": "049ba08f998d24b995efc44a84abae967ca8a948487b1595a8969f28e44e53a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301014, "uuid": "e0b3153a-4b17-4b8c-a400-db75aca0ddf4", "comment": "Malware payload (AgentTesla)", "value": "1228b1057baf79d70ddbd0fb72e937df236b8e94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301014, "uuid": "595bcd02-41b7-4603-b57f-d3eeb6640e51", "comment": "Malware payload (AgentTesla)", "value": "a909a5cdd7f13c35ab4c6c6f3110d0cc0b68701fddf93717e9c022356383ddfeb1da17c85a6ba61dac22f919562bd231", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301014, "uuid": "a3759436-75fa-4d67-8eb0-7c88c4b8e97e", "value": "50B423690B8161E38798C8381FAFE4473C3799E0F789FA066A9D7405DF16E7208539AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301014, "uuid": "33b6828d-5200-4f8d-9afc-1530d1deae5e", "value": "12288:fysbjdnvq/oukWHKWvSFHokma0SO08aBBYKx2wWz3u:fyI9vq/oukE9vAHoA0I5BhbWze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620301014, "uuid": "0a902df4-f43b-4524-8c77-8c7b7a4d605d", "value": 509360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620301014, "uuid": "f0e903a4-6fa2-4b94-a53a-b1690489d7ac", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301014, "uuid": "344c0fa8-6301-4b6a-b393-9ccc3a3dfe0a", "value": "BL-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97cb088-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266463, "uuid": "5d8502d6-c34c-4eb5-a87e-95c16e0a9dd8", "comment": "Malware payload (Dridex)", "value": "d8d425de5efb2a21669533460bc17ec7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266463, "uuid": "9a2a67d8-0239-42ad-b1d1-07e6648af583", "comment": "Malware payload (Dridex)", "value": "04bbdfd8541fcbfd8e83d50cbdd6550a4e5228272cc05854d2d0d7fa2b5e9f00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266463, "uuid": "04d11c88-3e4b-452e-8dd3-421ac56c6a7c", "comment": "Malware payload (Dridex)", "value": "2902393d1d85ef06db7894db38a72f2b9f22871b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266463, "uuid": "a8696d99-95fb-48a9-96cf-08516b7df072", "comment": "Malware payload (Dridex)", "value": "b9d660a355032aab296478d5af919e4441f74fcc8f5c94a1b35e7ccfc7028516c6dc2356db65850bdceb3e4440d20477", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266463, "uuid": "c14c25da-adb7-419a-8ce6-6a7d833b0301", "value": "5BF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266463, "uuid": "4a4bf0d0-e1c7-4a43-aa6f-82701a7d806c", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266463, "uuid": "64d4b01d-00d1-4c54-b4aa-234bdb4bcdce", "value": "3072:tWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:t42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266463, "uuid": "87a3a395-3307-454f-acd2-ac7988c2c274", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266463, "uuid": "32685cc3-6d27-499b-ba4b-d741cb2989bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266463, "uuid": "90d0edcb-34ed-46ad-af89-043ba8585a0f", "value": "d8d425de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad34206-ae2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278599, "uuid": "bb94b9e9-de86-43dc-b0d7-46d4839a67a0", "comment": "Malware payload (AgentTesla)", "value": "7b1069c13e708747013c54f5e5fb169d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278599, "uuid": "a6274214-b148-4fdc-97f0-a6155df0e686", "comment": "Malware payload (AgentTesla)", "value": "04cbfb054ba2e12e1804dae485ae854ba1baec7b11a834ce407aa86920306ad9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278599, "uuid": "c50e253f-6de5-4c16-ad33-36e1a9670fc4", "comment": "Malware payload (AgentTesla)", "value": "2bdf48bacb765c5ff03cb8ba8888b5b1de50a699", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278599, "uuid": "e4af9902-2495-4b25-970e-afc58afb397f", "comment": "Malware payload (AgentTesla)", "value": "9a4e4ee69774259541e6fb9ea9ac6579bfe38702c65d205840c1227bce4f69356d0311176834cbe2f799cbdd140eee22", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278599, "uuid": "1a69d26e-995c-4f4b-b5ac-1693ae32b5e1", "value": "3AE423E98BBBB80C46595B2DAB9E7A960EBD0010FD47033E4521CF14FDEC8815BA4B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278599, "uuid": "1037823e-f4e4-48b9-a884-5dd9d8c22fdd", "value": "12288:iHTJb6hkS4eF3gNRibRj/C/pHqoUXEppT+V+9xoukZLwqyE/T4IkTcsbeXY7rbU:eIKDeF3gObRzfoU0jJNkZwqdT4IkYsbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278599, "uuid": "ad74dda0-6c75-4f63-9730-4cdf59e411d7", "value": 719453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278599, "uuid": "9e9979fb-4736-4751-9c2e-e7deada6c138", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278599, "uuid": "8106b1ce-8929-46f7-890d-ff8363e07667", "value": "attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c6fd74-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277323, "uuid": "0c55b566-3742-4eeb-965a-31ce561201f4", "comment": "Malware payload (Dridex)", "value": "a9298f30a61cad5f3a771290a52f3b40", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277323, "uuid": "16373261-194f-4f06-b8ff-99e7f310c610", "comment": "Malware payload (Dridex)", "value": "04ce39785af183ecbc7f72f326467b3d368d77c710b8fba03b8b47a4f8e304b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277323, "uuid": "f6ea45b9-f87a-4786-bc1a-73a3f466ccee", "comment": "Malware payload (Dridex)", "value": "7a8d4f534e5327fc8d5d81b23598dbacc9bf695d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277323, "uuid": "431ed7f8-0549-4fda-bce0-58c967dd8a3d", "comment": "Malware payload (Dridex)", "value": "ef9434e9b0746b33b0cd8354435dc5abda562622878b026f3fc3896ad551a02c0fcbf447b9c6ecda5bdf2b5a4a4a4def", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277323, "uuid": "e9b831a7-cc74-4e65-adda-24f8600ce6d2", "value": "0FF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277323, "uuid": "8691ba09-b7ec-452c-969c-c091ae4874de", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277323, "uuid": "08190c41-0ba2-4f5e-a8b2-39be8dde8bbf", "value": "3072:yWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:y42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277323, "uuid": "0249635d-24c1-4437-be80-124055c0cc6c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277323, "uuid": "be179236-e532-4b6f-bc12-cb8b9485498c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277323, "uuid": "807240f7-4497-4ed8-b0bc-90840a034ff4", "value": "a9298f30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca4c3f6-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266495, "uuid": "25493a80-5da8-4d80-9eec-e7185b7a1419", "comment": "Malware payload (Dridex)", "value": "88e00b7d71c6ae94f1e2d85c169c3729", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266495, "uuid": "913fb140-4ee2-4d42-9a71-b537f0aa9a42", "comment": "Malware payload (Dridex)", "value": "04dab36f7bb3acb5f0d1d8492af5c8dd77357091fd46980aa5d699466c00c750", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266495, "uuid": "5c9eaccf-f008-4145-9374-09070eeacdf6", "comment": "Malware payload (Dridex)", "value": "aee93b2a19ee52e310b16415061c7f1f3d1dc467", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266495, "uuid": "d0b41a6a-68cd-4cd3-836a-7e9975d00373", "comment": "Malware payload (Dridex)", "value": "db4ac4e19a1b2fb1dc5d9f3b56f743bcd3d06ebe886a321837cd52b56343f6d462e34b080ddb719427b1bf2180e7e9da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266495, "uuid": "21fd1d7e-07dd-47bb-a101-00fda27ce098", "value": "57F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266495, "uuid": "106e3f9f-32fd-4c08-bbe3-3f1d88c8e8a9", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266495, "uuid": "fd69dc23-26e7-43fc-a25d-29defbc95012", "value": "3072:SWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:S42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266495, "uuid": "22b48ab2-dde2-4fbb-8c7d-a2035c0a1322", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266495, "uuid": "e1e96957-81cc-43b4-b01d-6a9e6ab13722", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266495, "uuid": "6c5120d0-aa1f-40a2-96e7-de6da48a8d65", "value": "88e00b7d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54806151-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270079, "uuid": "fee82a61-a8f9-432d-a564-46d314cda7f0", "comment": "Malware payload (Dridex)", "value": "1a54741519f13d3fefe2465ba85c5d00", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270079, "uuid": "92486a36-40c9-4209-8686-b73924019d63", "comment": "Malware payload (Dridex)", "value": "0513c8849847946b3f205d51b9efbf35813dd810b9bfdcb105381344463fe659", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270079, "uuid": "e3cdf8e6-14b5-4f48-b696-f09a09aa253f", "comment": "Malware payload (Dridex)", "value": "96459a433d80f15c9da00f64a47b9dfaa293550d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270079, "uuid": "9a8283ea-0b4d-417c-ae5c-12ac3ea6629c", "comment": "Malware payload (Dridex)", "value": "960c505879ab5a03cf4a21a5258808734bfa5ca670b95498f1ca81f966a387cf12b176db72d4604d7ff86784afcb8bd0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270079, "uuid": "a89b76bc-5efb-43b8-adc9-0535c168aa43", "value": "8FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270079, "uuid": "d758f0d5-0d64-4d70-98c9-e8ba290b8e28", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270079, "uuid": "ac197b2f-6add-4f20-bdcf-98fb08b70168", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270079, "uuid": "23ebec64-fbb1-4c41-9404-32206ea2bf33", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270079, "uuid": "27f26063-b2c0-4375-9708-e05d643546e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270079, "uuid": "bea2dca4-34f9-40bf-88fd-6a0434bd50a5", "value": "1a547415_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51077981-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338792, "uuid": "a4ce8fc9-2a9e-4483-a276-5832dc2c8406", "comment": "Malware payload", "value": "7877e88968ff77c7dc7e8eb6662b6c14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338792, "uuid": "696c2a3c-025f-4077-9ebd-a0d3463ec7a8", "comment": "Malware payload", "value": "0552f00bebbc78f98028527acade69f07fd232fc4b5bbba4974da498358b533b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338792, "uuid": "6c2fa055-c9f6-496e-b515-b28279ab641b", "comment": "Malware payload", "value": "ff37cf44217b4b37ac21b8a3225459aef6d92e3e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338792, "uuid": "b643c220-916d-426d-bb06-11c956ee640e", "comment": "Malware payload", "value": "f12bba0c0f93890a986914004234b86b0ffc661cdc90316190237e1be47601108c88e58ccd6f8ed5b5448a361812f0e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338792, "uuid": "2a3639fe-eb5e-4a2b-b5e8-5fb953fb6121", "value": "3CF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338792, "uuid": "c5a52a9d-b705-4658-9309-8956f75b19b6", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338792, "uuid": "accd3a2b-2012-40b4-9f1e-2b5498dd5c5b", "value": "3072:8iG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:EERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338792, "uuid": "e08d4c87-02c8-418f-89dd-4a9e9b6c4077", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338792, "uuid": "1e83d89c-f21e-4363-bd16-a1c7a2e0deab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338792, "uuid": "c7eed593-2b31-4a25-a850-d3ab31f42cc1", "value": "7877e889_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38261716-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620288070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288070, "uuid": "4b5286cf-553e-44a9-a164-44bb75512750", "comment": "Malware payload (ArkeiStealer)", "value": "a3d5e9eecae40f5985873058a71630f3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288070, "uuid": "b9cde424-4330-4a91-93ce-94a576ba4e00", "comment": "Malware payload (ArkeiStealer)", "value": "05a17812b71bc21cd19fadf91856f197b5605f5a3a109933978108ab07421b45", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288070, "uuid": "75333838-eb35-4624-baf0-cefef7583bfc", "comment": "Malware payload (ArkeiStealer)", "value": "706df6f74640a6acc53ae284f23d70b657cbafd6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288070, "uuid": "ed07dea6-fba7-4788-8a3c-3c2fc65f0314", "comment": "Malware payload (ArkeiStealer)", "value": "e18c151b0a47e197db72e6074aedb2124240f5e62a26d82d5396633414e9b8ff84a64712b2ab2e4678a2208bd2e9014f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288070, "uuid": "67a75056-ed9d-4c64-bc95-e6510c08f791", "value": "9BD4E130BA90C03DE4BB12F88DBA737CB62C7A615B6451CB52D516FE12246F4AD3139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288070, "uuid": "ec76a039-5237-4413-801a-fe64aec5532c", "value": "a5b69fd08c26fd0fa1bf9842017901f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288070, "uuid": "217de1dc-b4b2-4e5a-b7a9-fec16f6a9674", "value": "12288:u4dY+/xoBiMMWSjuFo5sgnaXbOy8v271kBNjB7fPUsY1HJ5oE:s+OBiMMTBsgtA1kBNNfPUnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288070, "uuid": "6da633b2-36f4-441f-9d2a-04333c41c479", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288070, "uuid": "276d7689-213d-4371-8a2d-daa6dd7db409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288070, "uuid": "85d49c9a-e429-4a3f-a5c6-63c6d772c3ce", "value": "a3d5e9ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0ab35e-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339136, "uuid": "6cecc95c-432c-4759-bf5e-61aad6de2173", "comment": "Malware payload", "value": "8e0b9066ce90de6abefc834b65a4f77a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339136, "uuid": "0af850a6-8116-4a1e-9ccf-e0894e6f50e9", "comment": "Malware payload", "value": "05c68d4f4a190abe2f5a2b81be76630a6dbcb8b4167aa5fd0122f6c65fc42e5f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339136, "uuid": "ad75e430-a9f5-490b-97d8-f654380cb6cd", "comment": "Malware payload", "value": "c1a99239f9a6070bdc7cd255c613f7c9176b9caa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339136, "uuid": "c166b846-d405-46ec-99fc-5063b4d7c939", "comment": "Malware payload", "value": "d734d643d5eadda38fdf763c5a36d8e819e3a12acd2c32b26b84e3f08354d8080e71704d4c02b3e90bc659de9a2075e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339136, "uuid": "1bd3dca5-845f-477a-860e-359af9d2881c", "value": "B8F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339136, "uuid": "cfe8905a-f4b7-4ea1-94c8-7612933443b3", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339136, "uuid": "12faf4b9-7ecf-4d11-9732-001a429e59b2", "value": "3072:4jG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:LERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339136, "uuid": "b38645ed-6323-4c22-8896-6eb47dad2f01", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339136, "uuid": "9f3a5030-ab7d-4f58-9565-927d50c04578", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339136, "uuid": "e3db6a38-4549-42c8-b4b6-3aed0512db8b", "value": "8e0b9066_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc950ae-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324103, "uuid": "64eaa9b8-ab2c-48f8-aa47-63010ca9d93d", "comment": "Malware payload (Dridex)", "value": "fda51d43cfad9963757d01d5a18644a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324103, "uuid": "3f684f9a-d170-4e22-ac53-2aca56faebb8", "comment": "Malware payload (Dridex)", "value": "066dcd8fbaa6ee379fcdc0bc07dd617de8ad89c68710dce1e415670687400283", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324103, "uuid": "8c56a5dc-0826-4b29-a301-5e606cb8102c", "comment": "Malware payload (Dridex)", "value": "8f82b0be4c8565bfbf9bde275972f012da96d39d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324103, "uuid": "8f5bf821-de8e-45fc-be3a-bb74dc8c60d6", "comment": "Malware payload (Dridex)", "value": "a58b0b3a04d5971b7be25a5602989916a72f2a7a38fb90088a9b5fc0e78ce4fb43e8f093182e56dcf72eaf496f0ddf53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324103, "uuid": "6506f3ec-a608-4a23-bd38-38be1241e322", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324103, "uuid": "d213e8ca-3749-47de-8290-df95616fc664", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324103, "uuid": "b43c754e-1c89-4140-8499-40ae801b35ad", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324103, "uuid": "1bd7f9ba-bdcf-492a-beb8-ec4e2863d954", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324103, "uuid": "eed4f7b1-8d3e-4708-8e4c-ad370db2b627", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324103, "uuid": "27bedb9f-d116-47fa-bcbd-2c5c6fbec588", "value": "fda51d43_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e04c0f3-aec5-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620344854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620344854, "uuid": "efd06fa5-c898-49db-a634-157b3a0686d3", "comment": "Malware payload (njrat)", "value": "3233acad69df2c322f902829a18a25ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620344854, "uuid": "b7e36a81-a4e3-4f42-8944-ccfecf4dd1ef", "comment": "Malware payload (njrat)", "value": "06aba312b446bf01180d633c94686c5ab2d102d40156b5cd9a9255cc6fd5b69c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620344854, "uuid": "91d70780-27ca-4e83-a8fd-58f655ebb37e", "comment": "Malware payload (njrat)", "value": "9b3e345ce2ead3d5964988a809df109551c1fdbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620344854, "uuid": "8ff33315-80f1-44b5-82f0-be502b6de5cc", "comment": "Malware payload (njrat)", "value": "fe17cd581a114c33806aa74ffd1681a79cb63817ce4b45b1afb9284598153d0f05066e0156a722a1137e9fd0ec9372f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620344854, "uuid": "c2682acf-b139-480f-b448-fa67f28ce90d", "value": "A9563342FAE288B3EB17173141A9FB53CBBF75200F11E7BB63D50E94A8724D25624627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620344854, "uuid": "cc630db1-be01-495c-8868-90e7c8da6d41", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620344854, "uuid": "4868e852-08b3-4fa7-b9ab-28eb8cdbc580", "value": "98304:H5M4o1SCcMwvc4vZ4aAyfIX5dZiIp1gkm1Lvk5HEZ1jMEQ3egjOXBvdaP+vDv:HmvwvNGmfg5gkWL1QPjgdaPEDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620344854, "uuid": "fa278063-d189-41ef-a967-388fcfe17ba7", "value": 6108776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620344854, "uuid": "7a1bd659-fd1c-4758-876f-a1e831304470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620344854, "uuid": "0b83f0d3-1d32-497f-a923-f3271327f5f0", "value": "06ABA312B446BF01180D633C94686C5AB2D102D40156B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6075bf15-ae6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620307894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307894, "uuid": "e0457c11-87d0-4dac-90fa-600c3db075f1", "comment": "Malware payload (Quakbot)", "value": "52495058069bec6c8605780ac1142f30", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307894, "uuid": "32fe56e4-2132-40aa-8280-a156b93ca689", "comment": "Malware payload (Quakbot)", "value": "06b8de5e8597f3424cf9ae9ed7ee38ad1555a3252799fd50d6eead7592aede03", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307894, "uuid": "682f8fc2-fe85-444e-bfe4-73baec423946", "comment": "Malware payload (Quakbot)", "value": "36a23e388db51469b45dc44352ff7dd29bd672c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307894, "uuid": "49b5568d-8e4a-48bd-9127-996e74d06d49", "comment": "Malware payload (Quakbot)", "value": "8f8ba533309f7833b431bb644143b792e3280131ab4258d51dfd2baded794f3d6396718e6dfd1559690b06e92c5ab676", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307894, "uuid": "e732ba15-6d23-443c-975c-36100501137a", "value": "CAB39C0BCC094AD7D12E93FD6D074DF96E0E5718D8D62FEF44221F8A3A651631E4B0AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307894, "uuid": "3b85b3c3-47fd-4533-8c62-54a460122e11", "value": "3072:+YQvKINbjvw548LMb/oqKO8NnS8+60KcP:+CAbT648LM7D98Np+ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620307894, "uuid": "ce95bb38-8595-4329-ba9b-01792ac7ef16", "value": 113013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620307894, "uuid": "68990eec-4a01-4f6b-bb66-f980cdada1e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307894, "uuid": "680a3e29-239f-430e-9004-2e783450532e", "value": "Complaint-1192571481-05062021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747320ef-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270132, "uuid": "db1bbc3d-c54d-4157-a456-828645ed1eee", "comment": "Malware payload (Dridex)", "value": "35c4a34fe0d46cb9d20e889ba83ebe14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270132, "uuid": "c9ccb5c5-600b-42ea-844e-2f6b490d7c74", "comment": "Malware payload (Dridex)", "value": "0707c3d33c8336533566bcc193e9fe681a1f474b2b6ff051671f4095e75b71f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270132, "uuid": "680de031-9c19-4087-9c71-b7bf1a2377fe", "comment": "Malware payload (Dridex)", "value": "8c7610c590d6456e3759e49d89da22ab490ffbcc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270132, "uuid": "95938e2d-0a3c-4af7-b33e-71a1b4f20bc9", "comment": "Malware payload (Dridex)", "value": "a21d2aae74353c0f0019fb8ee3903eeb828fd2a0a656d730e999705fc0b4f5c303880b876c768fa595f34cf50fc5cb0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270132, "uuid": "07c6608b-95f1-4a70-ac4f-397156ce91d4", "value": "D4F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270132, "uuid": "0f14b47b-7b5a-4e03-a3d4-5579c5ba4cf3", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270132, "uuid": "bc61985d-dbb4-4aba-b053-94a48a31dbf8", "value": "3072:YA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270132, "uuid": "3cd7a7c9-c69e-4ab0-99b5-a9b0ee8a2578", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270132, "uuid": "6613bb89-3a07-4e3f-bda8-c955bca17d0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270132, "uuid": "43e21884-b727-43c7-ba62-70a7d18721d1", "value": "35c4a34f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d03a73-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309801, "uuid": "b6d1e673-4a44-4706-b96b-fb702ab30b9f", "comment": "Malware payload (Dridex)", "value": "3126141ab0b62eec6f77d89444413c04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309801, "uuid": "31c69306-8469-4245-b0b1-cd12bc0ac3cb", "comment": "Malware payload (Dridex)", "value": "0732950e690c3e97dfd2e7442e3df480036c6f25c9bca6ed4397106d31ada165", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309801, "uuid": "7513d0d9-d780-4233-aa85-876c68b634eb", "comment": "Malware payload (Dridex)", "value": "5b2e5aebfc4fe0b115b13822d10dd9908e89311d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309801, "uuid": "56f991a1-16ff-4f41-a1e3-09f6fb81addb", "comment": "Malware payload (Dridex)", "value": "8a740febe085a86865cd4df9f91b445b74e3e66dd701e5c918d77e00e15e58eb15768dc1f3978d8ca870f4d7f594e7e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309801, "uuid": "55026cbd-6ca1-450f-ad10-869a175759e2", "value": "D9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309801, "uuid": "e804c1fc-96d4-437e-8833-d118c3f44809", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309801, "uuid": "77b336d9-78da-42c0-8f07-009d70f5bbb4", "value": "3072:8lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:8lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309801, "uuid": "c0f17370-7be0-466d-973e-3a633176bf92", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309801, "uuid": "76edecdb-30e4-46b3-8598-acaf0d8a40e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309801, "uuid": "c122f625-3623-4c79-9941-59d94bddd101", "value": "3126141a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ae8f66-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284467, "uuid": "c4f8bc7e-6913-48fe-97b2-ebefa65f9ee5", "comment": "Malware payload (Dridex)", "value": "2ecff685a448a1cb025594119125f93e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284467, "uuid": "5d5a112c-14c4-44d7-9a1f-abfcc52a2b06", "comment": "Malware payload (Dridex)", "value": "0749fab039e4e93cd056158e85b081bab8dcfff690904d7c168e2840da9b6008", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284467, "uuid": "8fc3abd6-aa13-4860-ba30-09df9d247f9e", "comment": "Malware payload (Dridex)", "value": "08314258ff7aed9a2fea674ae5c3990724e7573c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284467, "uuid": "3d991200-5e66-4fd5-81d2-a29966758353", "comment": "Malware payload (Dridex)", "value": "4a5d9c7fa251efc7ccafabab1906537eec82464dc0632b8224e3c15f2406b3067924a0230efc8edcf40d6f29af368994", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284467, "uuid": "722c387e-0168-4c4a-afbe-98da34664d66", "value": "51F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284467, "uuid": "b4027540-b5f1-4512-9ba4-65f523b01435", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284467, "uuid": "c80b7040-b8df-4f52-ba1a-61a3f8ed23bc", "value": "3072:RIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ac7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284467, "uuid": "fc2ad0a0-d60e-4eeb-95e1-d7ac0e75ab53", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284467, "uuid": "8d56064b-a656-4503-bdf6-9415fbdd71ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284467, "uuid": "aaab7f4c-ab98-4367-adc2-4b5d1694f597", "value": "2ecff685_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0b78b9-ae88-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620318678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318678, "uuid": "70e07dac-0e1e-4c89-a041-405242fd80e0", "comment": "Malware payload (OskiStealer)", "value": "15dcf73ba7415cdddcbc2f840510cbd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318678, "uuid": "618ccf9f-14e4-440b-b637-5d7e2d47d1e7", "comment": "Malware payload (OskiStealer)", "value": "0768e83e8d36f21ea90867dcf3935ee48795daf2e4a0017979e752b865c95d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318678, "uuid": "5b4bbd4e-1d3d-4220-a7f6-1894590d8bb1", "comment": "Malware payload (OskiStealer)", "value": "01bd1af8ccb0643cf153520210e7e7dcd7ff0ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620318678, "uuid": "31605e1b-31e2-487e-80c0-ebb4c62aeeca", "comment": "Malware payload (OskiStealer)", "value": "eec25163e9e900321e5504bf442f1babc27631c56df5b23d7e44bb998eda72043a92200453207483276b3d01ff82c321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318678, "uuid": "6a7b8a57-86ef-4e09-9e6c-ab7f1d803590", "value": "0DF4BF24A399DE59D43E63385030020007F1ED4BD723E78D7CA878A95D75F81ABAAB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318678, "uuid": "71da01ff-e942-4835-9777-d8848a94b98a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318678, "uuid": "b7213f74-0202-4b4c-8f36-4ed1e44fe405", "value": "12288:hSVNhWwMQ4qcibxITWLBAK1gnabpldrMDDSuogs6xLb2pMi3:oV714qciOyZynYD1X/6vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620318678, "uuid": "649554b5-2578-4ca2-969a-3f3927925bc0", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620318678, "uuid": "16e8ae9b-87f4-43db-8628-9ab69cfa3fa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620318678, "uuid": "c5863716-487b-4378-afd1-3effe4ea5e20", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e750c4d-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298925, "uuid": "a537ef4d-f29e-4b7d-8d91-b927ccd243f5", "comment": "Malware payload (Dridex)", "value": "9ff3b677fe72343de7e60e0e0a3f2c95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298925, "uuid": "0742dbc6-af78-456c-9aaa-7607b4f475e0", "comment": "Malware payload (Dridex)", "value": "077db278b09f51fde0f4c375b0c6e5a878468cb68ca53aad209575d6224a00ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298925, "uuid": "6df30db0-9d59-46ad-b4e0-825dbefcd11e", "comment": "Malware payload (Dridex)", "value": "e69cbfe1ff1e5dfd3376748e92c5502bfa5acd45", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298925, "uuid": "aee4a896-0987-4f1a-b2a1-5f0a6bd7b3fe", "comment": "Malware payload (Dridex)", "value": "ea53b200fca75831417b5557f3b4cbc40ad3c7d7bc449e8a8c6814b989603751eae8dceaa76388b195beeec61a980864", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298925, "uuid": "36c7282a-bcb1-4986-8914-a293e8205835", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298925, "uuid": "b73c0287-dc04-462e-bb8f-9bd27b382a15", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298925, "uuid": "265c9bbd-f8bd-4897-a81e-4129732942b4", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298925, "uuid": "0b379b17-312e-479b-b902-70c7afd9ef48", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298925, "uuid": "764115ba-6f10-404c-8a38-de0460c87158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298925, "uuid": "bbdff617-9f0e-4e61-a9c5-3a1d24717d9e", "value": "9ff3b677_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545db752-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316893, "uuid": "142935db-56a3-4f2a-9e68-bc92d3a68ca2", "comment": "Malware payload (Dridex)", "value": "86a40bdd6fdc9cb7ad75e2f9b7cf5713", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316893, "uuid": "50781199-2dcb-461d-9266-f5b4d3f9f376", "comment": "Malware payload (Dridex)", "value": "079b098bd289f6e20619e5d51f36b70299b0cba8c47f32611a7214a8276cf9b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316893, "uuid": "fd02d539-3822-4145-a880-0d320fae0bc6", "comment": "Malware payload (Dridex)", "value": "f6ee6e5145e7f93a500a790b802d4cbb2f01d8cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316893, "uuid": "20e030ea-cb86-4e9e-95cd-5cfcdc52d5d2", "comment": "Malware payload (Dridex)", "value": "f68aa5283c627b2298a0ce64e88035b43f4f0af75b05897909ca75ab81a87ba877de71d6a0a36a7e08c7a097ac316d04", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316893, "uuid": "3e3e8c81-48f0-4937-947d-48991dd381d1", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316893, "uuid": "eb658b36-5731-45a0-8bf8-811f61f97022", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316893, "uuid": "6a6dea1e-109d-461f-a0fe-fd4a6a5c5fb0", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316893, "uuid": "e8bbf38b-2f61-47c1-9b19-b2757e9eda2c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316893, "uuid": "82a0468d-5e4f-4b18-9289-57e0869dc986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316893, "uuid": "7ed0ea24-f7f9-4638-8137-d82ffee67b99", "value": "86a40bdd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763678c7-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327688, "uuid": "c8e49f89-3155-40d2-ba3a-6e19fc8bded2", "comment": "Malware payload (Dridex)", "value": "677d9927ddbab3af0df46712cb308386", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327688, "uuid": "cb8a2275-e106-49c2-81fc-259e82d48541", "comment": "Malware payload (Dridex)", "value": "07aa51c426e7f4f10bbda0d67acccbcf2a5f9009ff09368c9f76acf03f53defe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327688, "uuid": "ffc96ae9-55c4-4bbb-b927-cac71781e799", "comment": "Malware payload (Dridex)", "value": "ab97a0cdc35bbd25ca9384857dc13ec4b1ba106b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327688, "uuid": "0b6fe216-32a4-4819-89de-73b993ebe4ea", "comment": "Malware payload (Dridex)", "value": "9214daae904ed4263510d9a487f6040658a8b882ca6b6dc1ea2a57056cc26556c9832102fef91123d1af7d8e178c81a4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327688, "uuid": "1278a263-8ca2-4c29-a0a8-f2ac24498113", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327688, "uuid": "d98607d7-6974-4845-84d7-b19be81352a7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327688, "uuid": "6aaf7bcb-a982-4cd4-a094-0eb17f86f48b", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327688, "uuid": "a48e25f1-1201-4281-b9f7-19018fe25b97", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327688, "uuid": "f120f83c-9850-4b5d-a290-6113495f0cc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327688, "uuid": "96f6f5e9-bf7b-4d98-addb-e47145a3b102", "value": "677d9927_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f02403-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313428, "uuid": "a1973eb2-e805-4c31-8acc-c03e4de6c8c8", "comment": "Malware payload (Dridex)", "value": "a57835f6eb013b92a858084c4b43c402", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313428, "uuid": "07014653-15d5-4f9e-b66d-22ebdebbe9ce", "comment": "Malware payload (Dridex)", "value": "07ea11033214b6fe637da7d70fd14b7bb1eb85a022e5a04760f48e673c7e87a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313428, "uuid": "4ba3cf71-a184-4458-b1bf-cc67626bafd0", "comment": "Malware payload (Dridex)", "value": "61edc316dd2f0853ece213cfa8c7fa861e5d4b13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313428, "uuid": "88ab46ae-4ff0-427e-94a8-cf3979b7de82", "comment": "Malware payload (Dridex)", "value": "ebe64eb7b0b17498928bf1bba0355978a736b86aa9f9cac0dcf6c79cca91d0c510c62e98f84b82bd43dbd0b873476044", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313428, "uuid": "ec503135-e394-4427-ab43-a1c05a873f93", "value": "6AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313428, "uuid": "36aa595d-83c0-402d-ad79-5f4cc5729b65", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313428, "uuid": "e5cc8de8-4b08-4f3f-8126-9521ead7acca", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313428, "uuid": "033373b6-556f-460d-a168-6dcf2e49c212", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313428, "uuid": "190436ea-b9ad-41d9-8de1-b5e9393f83b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313428, "uuid": "2c024669-88dd-4ed3-ac9b-d2f27b46f380", "value": "a57835f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05490652-ae39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284548, "uuid": "87ff3df9-ba89-4316-ab80-fb4726de531c", "comment": "Malware payload (Dridex)", "value": "0ac1b521596b17a5ce6004da116502cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284548, "uuid": "1ab9104b-9796-4bad-9b8c-dc5bfab4d7ea", "comment": "Malware payload (Dridex)", "value": "08023057577367017b11307cc6df11372a1b8f906488324c06edf8dbd23c8bd7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284548, "uuid": "e7e5409b-0df0-4b4f-bf8b-e97fb68fe463", "comment": "Malware payload (Dridex)", "value": "4e560a31f9d8b5b59c18497e5432d5dbad62e0cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284548, "uuid": "d5ce64c7-103a-496b-80b2-05e58c3b3241", "comment": "Malware payload (Dridex)", "value": "bea307ab40a418d321da527dbd2d955cfad6b39f95d0afb5caf5b32aa753a37213b5c9e863428e2e9a62375c7ce975d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284548, "uuid": "61ebd1ec-27b4-4fb1-a9b1-497b353fc5fd", "value": "57F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284548, "uuid": "271ec526-e88d-4606-806f-f905c79165dd", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284548, "uuid": "39a83454-9426-4500-be8a-5625a385f89d", "value": "3072:AWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:A42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284548, "uuid": "219684f3-8e35-4bcc-bfe8-3cdab5594873", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284548, "uuid": "4c8f2617-a252-4e8f-8f1c-353d305b0b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284548, "uuid": "fc261861-bccf-4c28-a0f7-fdc2b5d277dc", "value": "0ac1b521_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2082c52-ae3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620286127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286127, "uuid": "f926225e-10af-43ce-a5a7-93169352edb6", "comment": "Malware payload (NanoCore)", "value": "3c7713c8717ab2136196e47d450a2222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286127, "uuid": "30c24366-8bb0-4338-a13b-20e5ad909e86", "comment": "Malware payload (NanoCore)", "value": "08610c330e4c1245c7b694f173010cb9494c50d9b070df88132fac1bb534f7af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286127, "uuid": "1cc9faf5-ee7d-4d37-9c4f-f232ab9ada38", "comment": "Malware payload (NanoCore)", "value": "fd76f9042d6196a4f5e79555debeabc79e2e0274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286127, "uuid": "da5ca362-90c6-4057-9e89-51a16ef10ae4", "comment": "Malware payload (NanoCore)", "value": "f347afca82b08e21b7f39f003d8b22106c97e549489b0f1ebc4062d711bcadd2f43f2924aa96c7e304b2ad60999f4ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286127, "uuid": "1c926e62-83b0-42b8-a90f-9bb237e19f83", "value": "27857B316777B9287784CD5329CE0235631B39AB397EB6BD384453682B3A1F0D583B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286127, "uuid": "9fe74321-1e5a-4daa-81af-40c98f08db6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286127, "uuid": "892a6c36-20ab-491a-ba41-5a8efaaba4cc", "value": "768:WDYDyRw56NjXiErzUDFTT9f9QfD9Z1V+c79/CBtBTO+WvBZP4rOHRWV1Ye2JFM8Z:WDYDyRBiE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286127, "uuid": "a4326f27-cc79-42b6-8ae4-9859c0b54c1c", "value": 1750016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286127, "uuid": "69bd722c-0b37-4a08-8cb9-4f171fe3ac5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286127, "uuid": "40b8bc2f-57ce-4b56-b4ee-a2126a2e1ec5", "value": "3c7713c8717ab2136196e47d450a2222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b6569f-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620324137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324137, "uuid": "b2f36201-ff6f-4278-8ef9-06a76655aeb4", "comment": "Malware payload", "value": "a8d3dfe95b9c5fbce4ca4d61f014e8af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324137, "uuid": "5b6ccae2-b4b9-4d03-898d-ba04c5c33058", "comment": "Malware payload", "value": "0973fc8ab7e03cb337955f0fcd7725f494733207498a7875df4ca208cf407c97", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324137, "uuid": "757c27e3-21bc-4721-a2b5-5914d2eefeb9", "comment": "Malware payload", "value": "080cb5671bd3cc36836b37e7e5b55b15d74a9c4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324137, "uuid": "4b679504-8b29-470b-953e-320df8eb712e", "comment": "Malware payload", "value": "cdd2d7df4f49a4ce70e47361de17e98df1025efef7f233b9320c67332cfa0b188dbf4b71c255b72c0910589961d7f368", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324137, "uuid": "451e3cca-5270-4ebd-a865-cf415e59af78", "value": "66F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324137, "uuid": "8802676c-cf10-4b33-ad81-944f47170d95", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324137, "uuid": "890f02c7-fe59-42b1-b351-3130802bcfc3", "value": "3072:sWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:s42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324137, "uuid": "e6074c67-70dd-43aa-870b-bf7b3154dc5a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324137, "uuid": "8e7b5c6f-8330-4a40-9509-5c949f17647e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324137, "uuid": "f873eee5-1572-4670-97f1-4be0df5dd75b", "value": "a8d3dfe9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bffd288-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280855, "uuid": "d04fcc18-d9e2-49e7-acfa-23da8b71fac8", "comment": "Malware payload (Dridex)", "value": "7fbf1006d53bf4f9740a090c12fe49fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280855, "uuid": "6ecd0350-3e84-4738-9c87-88c291fac69f", "comment": "Malware payload (Dridex)", "value": "09d17e4dc58fd578118df1e37ed7d29a83dfd4699c3775e116c43d50aacf0818", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280855, "uuid": "9cbc254b-2abc-4d9d-adb8-e9e6308f53bc", "comment": "Malware payload (Dridex)", "value": "4a91322a173c196b15e2227672b6d958d1823bf1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280855, "uuid": "2c73c74e-d923-4b01-805f-605dd4f04bf6", "comment": "Malware payload (Dridex)", "value": "73d9145bf2c4122339a22989d4c8771e40311775a6b9e69059a8b72b673143b7f7abb4a8f148bdf1aab4b1882cd377d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280855, "uuid": "170ddf84-14ce-45d0-b7e3-def50078d4a2", "value": "8CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280855, "uuid": "4cad6c76-d5bc-404e-a908-eda9cf0d9b2e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280855, "uuid": "3a4ab34e-b5f8-47a4-bba4-e0b5ebf29e9d", "value": "3072:7lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:7lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280855, "uuid": "ad54928e-e506-4eeb-b5d2-8c4148896ff9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280855, "uuid": "fc57a16c-c019-4fc1-9be3-729fc8a58d29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280855, "uuid": "fc603f26-4f89-48ab-81c2-4dd94651f8b7", "value": "7fbf1006_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac8e047-ae31-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620281122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281122, "uuid": "b06e81a7-f132-4d36-90a6-d44bba7cc903", "comment": "Malware payload (Stop)", "value": "60f668d0e8cf34c46b626409e78b0dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281122, "uuid": "0d2ad126-bcbd-49b8-8c80-4bbd302d0048", "comment": "Malware payload (Stop)", "value": "09d2850085ff6cbe46fb427311af739e0628572289ceb4c3180ee50682070b98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281122, "uuid": "714cf407-a931-4d7c-b0d9-d017924a3977", "comment": "Malware payload (Stop)", "value": "2e810168c67bebf6774cc965201c5b750011aeac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281122, "uuid": "cc30bf72-bcab-412b-be5c-b81a40dee02d", "comment": "Malware payload (Stop)", "value": "7686043fa51bced57b8e1add4a06a616318f41b65ade3946425de687f6a6183f2e97240eab973495a4b258169cefa9c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281122, "uuid": "dd00bf3e-3568-4e4a-be69-22251607b4cc", "value": "A2050220B580D076FC13157688A1D3F19EAD78A2556256BF76CC39FAEF382D1B62230D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281122, "uuid": "edd8de9a-30d7-4436-9afc-da8e6c261820", "value": "f82467823ad136f325b286fba7047ffc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281122, "uuid": "aed3b1cc-0e49-41f1-96b7-26971c1540a8", "value": "24576:FUufB+jHA+KMioC9qGk95Ltu7lzLjp+zy:LZYzK18P3LtgZgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281122, "uuid": "99f4a61c-8ffe-41db-8e6c-fdafb9ae1408", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281122, "uuid": "a56da5f8-795b-44fc-9ed4-dcb83e40dd1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281122, "uuid": "8dc64bc4-696a-42f7-b881-32f74823b866", "value": "60f668d0e8cf34c46b626409e78b0dd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fbf4aa-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284471, "uuid": "d4e007a2-7313-44af-b58e-dd17edebe379", "comment": "Malware payload (Dridex)", "value": "43b5d336a9c996ec7b0bd01e23b2a47e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284471, "uuid": "bbf30086-bd43-4428-bffc-0d1694ba3b9d", "comment": "Malware payload (Dridex)", "value": "09e8aee9396994c679d2bdfd4b0b89fd9912f1f0bb8d87ee7438491a0570cf87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284471, "uuid": "adc2db28-5195-4fbb-9b66-baee67892352", "comment": "Malware payload (Dridex)", "value": "46f3805427a219c496bd7ec172803e41d91a99fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284471, "uuid": "abf42746-0af9-4877-b909-9348a373bd61", "comment": "Malware payload (Dridex)", "value": "866a13b377e5e626c3d456bd7c2aa0d4864606bdaafd34562cc43597518d6f02b53b3c080a839fb228d588d07bd0b99c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284471, "uuid": "8e21b510-55a3-4f6b-bc4f-08cb5b9a0b09", "value": "49F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284471, "uuid": "4e5421be-6281-4fac-a138-cd9c51ae20f2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284471, "uuid": "39380808-32dd-4514-9ac5-7ac33318ed5c", "value": "3072:NiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:WeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284471, "uuid": "309e5e63-aa00-4067-9592-7a09eefe077c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284471, "uuid": "2bf2cd26-7921-49d3-a5bc-2738bc64057d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284471, "uuid": "d2099d82-e530-4b9c-85a7-e6519f87f0e7", "value": "43b5d336_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701c1a8d-ae7e-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1620314363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314363, "uuid": "0f7bb33f-cbd9-4584-92e9-fb28510b1c05", "comment": "Malware payload (BazaLoader)", "value": "b80f4b91c29963df1cfd0d0a8a30e5c6", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314363, "uuid": "738cc8fd-f302-4537-9198-2a2470cbe4d4", "comment": "Malware payload (BazaLoader)", "value": "0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314363, "uuid": "6af37f68-e87b-446a-9f1b-a789f6708a85", "comment": "Malware payload (BazaLoader)", "value": "09c6ae06e0c10672d91f6850118f41dc3dd66e72", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314363, "uuid": "a3b66460-00e9-4aee-8cf6-b665d7e0e8f7", "comment": "Malware payload (BazaLoader)", "value": "fef4034a7dca5df5fd877d750942c5333f622965c94409e97953769713d086d11d79f485e9f2e227ee25a0af6944ceaf", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314363, "uuid": "022c50a4-474e-4ace-98ad-7eb28b098f72", "value": "95B48C603143C127E2326E36CD0BE5FC15C17D29EE2A190B75D63F6FBB362518A3A265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314363, "uuid": "7cfcfd86-6562-4798-b9bc-d8406d7d01f5", "value": "e8d4da784bae943bf5ac23216925ec04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314363, "uuid": "99689236-dc0f-41b2-bc08-bfc579d6defc", "value": "12288:ga6g2O+gAaY9cc40TeAjaRoA5FZuY+F4:gZlOBAaY9RCy05FZuYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620314363, "uuid": "6a46e676-b15a-4701-b61e-30ccb0df4966", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620314363, "uuid": "aff277a6-6209-4d53-b7ad-b2b4f81cb588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314363, "uuid": "4446443a-0a20-4a90-9777-71d6e6c9bc5f", "value": "vegas.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e55fb6-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342095, "uuid": "239d536c-49d2-4d42-b268-453f18514ccc", "comment": "Malware payload", "value": "143a98d2e29d9b3fea396bb559a93fcd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342095, "uuid": "64007875-efc4-4d51-9ed5-0f2c2e068ba0", "comment": "Malware payload", "value": "0a88a65caa66407e0d8384ebee75584d8a1107ae38b5e146387ed4bde59f14f8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342095, "uuid": "cae2eb9d-a2f4-4af4-82dc-d4b67bd998f4", "comment": "Malware payload", "value": "66ce63a4487dfc2d86ffd0dd5bd0f8d14e59a1b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342095, "uuid": "fea06037-1bad-4ee2-bb72-3460b42a7ed6", "comment": "Malware payload", "value": "af4b25ef12e0210ba28fd6b2268b9a49edb6150e34732e4e206f05fd7f2fea9889f2f4f43efe9554bd4934ca99d9dfb6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342095, "uuid": "9d3cf960-19aa-4801-9dcd-29362c9fdefc", "value": "C3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342095, "uuid": "e36c5d64-77cc-4d8c-8f83-acd64efc92b1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342095, "uuid": "19ed1901-b370-4df6-9b59-8dc6027bb71a", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342095, "uuid": "69ee78aa-f2f6-4f8f-9cf4-c493cb778d9a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342095, "uuid": "95d14109-2b2c-4904-8765-d4d83a1aacc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342095, "uuid": "a8c0012f-49c2-4e60-a685-0f1e56aaf420", "value": "143a98d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec260cde-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338623, "uuid": "1dbb67ea-9d4d-4e08-8e7b-32dc097388a9", "comment": "Malware payload", "value": "9b164b6a0c0b6e03dfe81a5ab55d1171", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338623, "uuid": "a9d2ddc6-3b5f-47ec-922d-f2b45029b69e", "comment": "Malware payload", "value": "0ad074640044bc2c4aff0c03c18772955aad2d189b2dd096b889161cd75a9b01", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338623, "uuid": "3bdef0bc-46e5-4682-8bd0-af735dcfc465", "comment": "Malware payload", "value": "4bbe8b9a8c218c3c1658dd9e11d2e2d4e45a39a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338623, "uuid": "bcdcf79a-fc6a-4828-89ef-295be26b9648", "comment": "Malware payload", "value": "e1474f1dc39cd1702271a05c9299cf0c3e06759e9818ea038281296719814fd0d49aec3b6d4487a8ff7c69d05d04bdd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338623, "uuid": "e26e598b-2b17-4a28-9853-fbc5a8fec41c", "value": "E1F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338623, "uuid": "753a4725-f5fb-494f-b734-3fe3904836f8", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338623, "uuid": "fbee958c-2f48-4f89-92b7-993b17697f34", "value": "3072:KjG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:pERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338623, "uuid": "b36d6b3c-cb82-4ac2-8af1-992cb3f320d9", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338623, "uuid": "edf2bbb5-cba7-4f3a-a01a-e6898fbd324a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338623, "uuid": "87d11349-e22a-4d1b-b319-ddf2e0a4b499", "value": "9b164b6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ec6040-ae7e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RevengeRAT)", "timestamp": 1620314457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314457, "uuid": "581b9480-4030-4597-90c8-28e867481b4f", "comment": "Malware payload (RevengeRAT)", "value": "c170cd907fb133c381e21175d2cce6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314457, "uuid": "468c51c2-fe6c-4e31-90b6-650377d5014f", "comment": "Malware payload (RevengeRAT)", "value": "0b4ccd794d4c74c73f78eecf5bd9057fb7ab1d558aab5937b6cf7aa52d53373f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314457, "uuid": "ccbc20dc-8997-4a58-9e74-ec09581be673", "comment": "Malware payload (RevengeRAT)", "value": "06b052a7698e1c544f7f6422608ea242a0466983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620314457, "uuid": "2b95231f-1b1d-4c1d-bd9f-971fedc2fc0e", "comment": "Malware payload (RevengeRAT)", "value": "133482566e62ed9350493ae2a970155eab3f1dc2c0a517f37df8b65d7d21957bb8a457a1c0a10f10631f3f4582701d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314457, "uuid": "89bd59a9-74b0-4583-9bcb-e123551acacb", "value": "9E93025F7B4B9694D99903B7C4A32104512A5202B2B9AFEF25D45DB35F3348EC38BC9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314457, "uuid": "866b62d1-418f-410f-8a7e-cc4294dbc2e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314457, "uuid": "b2ad20c7-824d-466a-a1e2-a12b0d163f26", "value": "1536:3ScSbb0POqOU+JZdUlzo612tWMOPjr9OW1i+8T1TETwA8:3nS/pfYjtr9Op1wUA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620314457, "uuid": "7dbe969d-e5c7-46ef-8c8e-525037f79f68", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620314457, "uuid": "6779202c-daf6-48da-aad1-5342b61bde3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620314457, "uuid": "f4947505-a10d-4030-bb19-ad95dcdb2d8b", "value": "C170CD907FB133C381E21175D2CCE6A6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9733191d-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262889, "uuid": "27dd05d8-6c5e-4f5d-a711-4258db9d398a", "comment": "Malware payload (Dridex)", "value": "6663fb58e095bde4c47320b5ad4e5f11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262889, "uuid": "59987e83-45b3-48ed-9bce-9d6d2d5e6290", "comment": "Malware payload (Dridex)", "value": "0b7dfef1846f4aebb2b40be7a4ab5bac88ed84f22b5119432faf19b92632d8c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262889, "uuid": "46f3df6a-567c-460e-91d6-32be84e0cc14", "comment": "Malware payload (Dridex)", "value": "536d5168481eaa9654fcd54c217c096d79c80a78", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262889, "uuid": "e167c6e8-f198-40e2-8938-d7733d357ca3", "comment": "Malware payload (Dridex)", "value": "c674c7d59d49af29c012d96f0636a59f3434d94288d5998f2d04313e1611a324cca67727e96f3540674d6d57ff81e9b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262889, "uuid": "0399d9ae-ed72-4ba9-97be-b6e2faa21beb", "value": "31F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262889, "uuid": "2accf18e-8e4e-4e26-9bf6-5990db895493", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262889, "uuid": "f8f7950f-7e86-406d-9265-017431617551", "value": "3072:veWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:ve42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262889, "uuid": "6dc6c74f-e532-48df-8593-c5a203fc68fb", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262889, "uuid": "a3705667-4c5a-42c5-8250-bc69e2bc2af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262889, "uuid": "1ee9f42f-9323-4ce2-8ca4-8715c1e29d96", "value": "6663fb58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b13c17-ae86-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620317755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317755, "uuid": "7afc806e-ebf6-42c8-b389-d8d318b70241", "comment": "Malware payload (RemcosRAT)", "value": "ccc2e680bdf80b7037b28a20baab2d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317755, "uuid": "be24ad6f-f932-47b8-a144-8dc7ec610cd4", "comment": "Malware payload (RemcosRAT)", "value": "0b7eaab988ec406ce0b6df31d9abdc68e535c529c6ac5b5a5c9deb4e4fbe6611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317755, "uuid": "b805681c-b2c6-4a72-be18-3c4b324a7153", "comment": "Malware payload (RemcosRAT)", "value": "ae83ff5f0c48c1848a06b5ed247119380907446f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317755, "uuid": "2c6ff55a-2c69-4f16-9337-c8a49f4fdab3", "comment": "Malware payload (RemcosRAT)", "value": "c8fc2baea74566775723807e457e06adb92bcf68425802960cbab8e0ebd7d46aa2266e6e8a12d8a0ff469321acf2a5e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317755, "uuid": "0a6c82db-8f0f-436a-9101-b4ef6861970e", "value": "2165C2AC321075EEC577CDA29BD91C24E61020BA572FD103972303F99A9EE97DF245E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317755, "uuid": "d821b4df-7e18-42b5-b5fb-d266492c2f7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317755, "uuid": "54f24ffb-f117-42d7-a991-97d578a748cd", "value": "24576:NZ+Da9mYuogB2KypKK1oLAzW9V62rGoYmxqXwwuI:niupKpwoXqXMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620317755, "uuid": "143d95c6-7b55-4d16-a191-4a2fb69ca20b", "value": 1473024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620317755, "uuid": "b12b4e0e-db34-41fb-9f6c-dc1f3711bf19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317755, "uuid": "1ee38de3-f5e0-4a19-9808-d9a50cbf77d8", "value": "0fbceb4a8af5ab7e3267616253254d75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57709a98-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620334937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334937, "uuid": "42eb881e-ecf7-4b2e-af6e-f0694de9d8ee", "comment": "Malware payload (Dridex)", "value": "ba857ecbe320e2a6bbf38ade42725ed3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334937, "uuid": "af349086-bb99-49c9-9a24-288c22bc8db0", "comment": "Malware payload (Dridex)", "value": "0bfb00de6272668c40c77b1a8fa5c43b3a6fbc3e5a6cce2259df60430a20b31e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334937, "uuid": "8d98855b-694d-4c15-bfbf-24c9bd259bd5", "comment": "Malware payload (Dridex)", "value": "88c3100014eb7e68b07abefec0fcc4ac751568cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334937, "uuid": "90d6f315-b73f-4dfc-9b0b-7e54ed08c440", "comment": "Malware payload (Dridex)", "value": "38338a2a3d3d963895f47a576c81ea4696b437c3a734852a5b4f59c9e28163c4aee63262d5320d1f7cfbc8275301ed58", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334937, "uuid": "5535db3d-5ecd-4f35-9fbf-291da0709c2d", "value": "31F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334937, "uuid": "80c1363f-b71f-4a5e-b3e3-fb6aed349086", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334937, "uuid": "fddee152-317b-426f-ba64-1bea1b8d9c57", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334937, "uuid": "53503608-afd4-4bfc-8d2a-0538a4d8fb46", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334937, "uuid": "026a84b7-d6b1-4ccd-b338-2e9cd01e31a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334937, "uuid": "3c2413a8-5de2-4ec5-97d0-2fa92246481f", "value": "ba857ecb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf994ec-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320614, "uuid": "1202945b-9286-427d-8501-80fc72f21df3", "comment": "Malware payload (Dridex)", "value": "844ea70362bb2ce88e0cc0a60a323a9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320614, "uuid": "bfe73c43-0c39-4cc4-bbf8-b38109a2560d", "comment": "Malware payload (Dridex)", "value": "0c1a259da3e07dee996ed30c0957b9209e669c84ae7bdd83aa2235e8132ae9e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320614, "uuid": "a089483e-6118-48b5-9642-2fa68e8f35f0", "comment": "Malware payload (Dridex)", "value": "b674984601af5113385b12d6b91ac2c7cee66def", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320614, "uuid": "94f32c5a-fc45-4942-9ebe-59862763af16", "comment": "Malware payload (Dridex)", "value": "a740e1a2422403312b4a6f0048dbb6a373eb9425afabbe2ae0aa9c26548726882541cd239a5022f01dc307358d4b1884", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320614, "uuid": "08b6e4ee-cc06-4016-b00d-333eed6679cc", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320614, "uuid": "2ab7400a-cfcc-47dd-981c-7b3a8dec02b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320614, "uuid": "3b7258b1-51bf-4bee-8ebf-2c6adb6aefa3", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320614, "uuid": "909b131e-6f48-43f7-af32-39bf0bb2aa41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320614, "uuid": "e4984059-b8a4-424e-9beb-fbb7d66cd431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320614, "uuid": "3946e5b1-bd0a-4cab-b905-56e17bbc2c7b", "value": "844ea703_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ff34e2-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339012, "uuid": "274af6f3-4c21-4623-a2e7-8a2a4bcec426", "comment": "Malware payload", "value": "9253e14defb4f92b05255dca7592591b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339012, "uuid": "f2a427b5-b31f-4800-ae64-d1bdd3221c2e", "comment": "Malware payload", "value": "0c604ee45f1a9bf85cee4f2c17c3a12aaa921303b03181f637b2c05a011f6a6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339012, "uuid": "9e6328e6-635c-4c58-b362-0a050f49a7b2", "comment": "Malware payload", "value": "deb0f9108752dceb7d491daece8db223179e620c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339012, "uuid": "ca89c2bf-4f32-4699-a1da-8735c22b8528", "comment": "Malware payload", "value": "ef04959e85d2656d5b827f2c0f90f3b1e45ada1d100e45bba4bc889481d84d15b8a33a503733ba032b65f59ddd18f2f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339012, "uuid": "132ce836-8232-42b9-becf-41d0e64d174b", "value": "02F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339012, "uuid": "310f7512-9763-4d83-ae3f-3782667fe38f", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339012, "uuid": "ee3fe832-043a-4625-9d1d-0feb4e248f26", "value": "3072:vLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:iERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339012, "uuid": "f9f472cb-07fe-4998-b2d8-c1478dbaf6c3", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339012, "uuid": "78a42d95-81ad-4c25-bde9-f2aadfb3126f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339012, "uuid": "d9d4dcaa-b758-43dc-95af-4e3ae30439aa", "value": "9253e14d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da487ceb-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338593, "uuid": "29b0421d-7b64-461a-860a-bd2919d62fce", "comment": "Malware payload", "value": "66de3af160dcd9ff4143c4cee90d07df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338593, "uuid": "207f2948-af37-4c03-8f84-3932e24e9923", "comment": "Malware payload", "value": "0c62226afa8a00d2adaa0d823e1931ae067149eb1bed5e67a473747f47aa97a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338593, "uuid": "213b85ea-05ba-4f8c-a904-f2d01743db6c", "comment": "Malware payload", "value": "4bd49ab0d899bb86309f3475566eac5531390278", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338593, "uuid": "342a5b2d-656e-4300-94f0-23b46fa0477c", "comment": "Malware payload", "value": "db9c96713fe9ad45553da658e9694acb5be70358eca6fed9b62cb850513150c08d7defd919f5aef7eddeb6a2540cb1ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338593, "uuid": "8d9a293d-7f9f-416c-acc6-4107e75482bd", "value": "AEF3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338593, "uuid": "fc1f8a90-67ac-4bfd-b0a7-a440f23d0160", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338593, "uuid": "cc78df98-4af6-41a1-a501-cf701e7a5a7c", "value": "3072:ykG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:8ERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338593, "uuid": "2604e944-d4f5-4922-8966-70a274591fdd", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338593, "uuid": "5edd7d7e-0d94-4d22-86c2-4909d91a6351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338593, "uuid": "c9d6edbe-00d7-48ac-8866-fcfd4b7288a4", "value": "66de3af1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da50105-ae5c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620299702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299702, "uuid": "2b29561c-3ded-4e39-bc53-7c36ab6af70d", "comment": "Malware payload (Dridex)", "value": "68896898cbb7c358cfe96c63f7a6ed06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299702, "uuid": "2629447f-ee29-425c-b3bb-6fbb5781ab17", "comment": "Malware payload (Dridex)", "value": "0cb59d8430574880c5b1b14d0137c9392605f48e53792407d4ab368b9b01d902", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299702, "uuid": "9912ad7a-e8b2-4e82-adc3-795b573ed82f", "comment": "Malware payload (Dridex)", "value": "c81438bd64a01a5a0e0cc15bf5b0d5a1f568ee8f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299702, "uuid": "db268a92-f30d-4fd0-9a45-4c32e246522c", "comment": "Malware payload (Dridex)", "value": "4a43adc46db84706b0cb55c6dcd053d6010c6f2f21b0a23f07e6e171f5bc2217af04cbfb3bd11571ac953c2648dec04e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299702, "uuid": "c0e724db-2213-4241-81f0-fe35501eb275", "value": "95F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299702, "uuid": "7731949d-e88e-4195-b72a-cb722e208dce", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299702, "uuid": "4940096b-3b9a-4010-8f4d-3ac7cadcea88", "value": "3072:ciFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:/eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620299702, "uuid": "9e74a8ec-7e7a-4f51-9167-b8f92c9adbe2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620299702, "uuid": "5711cb76-abed-4140-b093-9947ef4e175b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299702, "uuid": "367f9c2d-fbde-4109-a869-ff92c7571c8a", "value": "zd1uT5UZFn1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71098ec-ae2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620279263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279263, "uuid": "c75e06b2-a208-41a7-beb2-096d6ee16566", "comment": "Malware payload (TrickBot)", "value": "048e9dd2f02e03f77d7b9030e8adcb27", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279263, "uuid": "ac3b8982-690e-4994-8e8f-a34e48d9b9be", "comment": "Malware payload (TrickBot)", "value": "0cbb778ba97972e04788fa7fee0d36e4c0e584df2dd07fa9cc93c6fa1a81a6b2", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279263, "uuid": "5cd69dca-260c-47c6-a0c9-40192dce7abb", "comment": "Malware payload (TrickBot)", "value": "074eab60d9a2046942c8d1ee1c36eaf0c3e07dfc", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279263, "uuid": "f7a65021-3a9d-4c79-9272-25a497bb750f", "comment": "Malware payload (TrickBot)", "value": "b960477023f159d3b4c178065a852c9a1ff8d6dec5244bf5cfa4dd14c76696840b7b2f59e85d19cf3e6f76d50e2996b8", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279263, "uuid": "09f2a98d-09f3-48be-a6c7-c31dcdc924e9", "value": "6AE4E002FBE0903BD6B285310FE77B3A57F9A9905B755EC763909B0D48321C16E3636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279263, "uuid": "91d9317c-cde3-4ba4-b0c4-0ed8db482848", "value": "82d7aabbacaf14bba1c321d3fe1f95b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279263, "uuid": "08135c3d-4091-4ad9-b870-96444777b1c7", "value": "12288:3Y8Id8iWYsKut3o4iek/WGtMqZtEfl4GnFfTWokO:i8i9K9pd9sMqTaRn1bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279263, "uuid": "3f50e0e8-c0d9-465c-a646-981dbacf2892", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279263, "uuid": "ecefe673-8a19-4004-9e8a-c0919d334107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279263, "uuid": "daa5088f-7dd8-4719-88bc-9d17ff28571e", "value": "redbutton.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be592e4b-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291731, "uuid": "24f1f2c6-6dfa-42e7-8d94-4d3f28536edc", "comment": "Malware payload (Dridex)", "value": "e22732ec061a909d4ca4b38e9786b25c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291731, "uuid": "d3c572de-eafb-4075-985c-2e09918414c3", "comment": "Malware payload (Dridex)", "value": "0d24952388f2c7996638c4d700b0bcd7461eb18aad8a81d43ee69acc79327582", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291731, "uuid": "9f3d092c-1198-4a2b-93c5-960d7175aa83", "comment": "Malware payload (Dridex)", "value": "62346d03ab1372c8d19ce943072b2ef72cc6a83f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291731, "uuid": "e75cea22-ccce-4a61-b8a9-016967cb0b0c", "comment": "Malware payload (Dridex)", "value": "5435570c672f271e5ae60d76d299ad0a6451ec3096251220757bcf20271434d9fd41dea63b1c406154e9650dd89789c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291731, "uuid": "2a7d907a-bcdf-4294-9dbe-1ed4b6bdd761", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291731, "uuid": "8c5bb2f5-e3e9-45c2-8403-fa1864f19ce9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291731, "uuid": "a6c67ff3-23e7-4d0a-82fa-ff5ac63dad3f", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291731, "uuid": "7b7841cf-0436-48fa-855e-43b9f7e36bf5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291731, "uuid": "42a34c51-55b3-4f4b-a7ef-da971ffdbcf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291731, "uuid": "243e0432-1ea0-47dd-a0ba-303e8c9b0822", "value": "e22732ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3f857a-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339103, "uuid": "56410fc7-e2b8-4b03-98a2-e4251d933fb7", "comment": "Malware payload", "value": "beab9b784c41df00d80a6b994ed8eaa6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339103, "uuid": "19f2e9fa-11e1-415c-8fa4-78c22d002172", "comment": "Malware payload", "value": "0dd47ebcd6b055d70138d6d1127020aea283986267b5e2b48a645881ea5da30e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339103, "uuid": "2c178e4e-f577-40e3-9a8c-7cfd03ccc264", "comment": "Malware payload", "value": "51016bc42df09a3ffbefb5a57303b156d0c95614", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339103, "uuid": "e92a9025-65a5-406b-b32c-1217e341d39e", "comment": "Malware payload", "value": "c14a9359a6ee580e87fc9dfdb751eb1aeb1cc5e8db619656237ab0afdaa6e5a257715d4871ebc6de59a8dace52021432", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339103, "uuid": "b54a1c35-a952-4682-8590-708d0537abad", "value": "E8F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339103, "uuid": "7e83008b-d7ae-4407-b045-124becb3d411", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339103, "uuid": "ed44c520-69d2-437c-9a1c-573d7c613180", "value": "3072:QjG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:DERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339103, "uuid": "d004fed2-abd9-4c85-b749-41049dbc9128", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339103, "uuid": "7d5f8740-bcf3-44df-90c6-bd92355b48ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339103, "uuid": "601c402e-4034-41c2-a76c-166f1eafdb3e", "value": "beab9b78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf29cbdd-ae3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620286149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286149, "uuid": "23c933dc-1482-4290-953d-9ad59978ad35", "comment": "Malware payload (RemcosRAT)", "value": "f6dc84a64d99e09993ed396dc2dd5b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286149, "uuid": "340f84b6-e5c6-4b59-b0cc-020abd53c0e2", "comment": "Malware payload (RemcosRAT)", "value": "0e67ac2d835d51975b1f8cde8ab3eacfa184fd4dad00b83632f214740c0a94c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286149, "uuid": "763a4b49-dabf-4da6-b7f6-8230f682360b", "comment": "Malware payload (RemcosRAT)", "value": "e36d570d720afc692a7c3f6e2e8cfac89448a54c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286149, "uuid": "7cc6f0ef-f3b4-46c0-a76f-425383b1b6fb", "comment": "Malware payload (RemcosRAT)", "value": "fd97fde913b38c33e26aaaa1ccba2a351dc60f49bf0ff744df0f5d4f0dae3b888b97c982bfa12161952f88cfeebd69de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286149, "uuid": "5548d5f4-8fa9-422a-8d49-7d15538e04b8", "value": "B345F6600379A76873B8FB106F21DBD86E173EBF453280A2561574436A79E40DF4B3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286149, "uuid": "16023148-ddca-4fa0-9a47-ed7e51a27ae1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286149, "uuid": "92fea345-6b56-4bcb-b5f8-305ead0a296d", "value": "768:efsW1dr3zD9lQ9inIZTM5RNkpUPKdgxedrAl2KOedrAl2KdedrAl2K4edrAl2KGk:efsW1dzzD95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286149, "uuid": "f6447c11-9654-417d-b127-2dcd951c6d6d", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286149, "uuid": "d2f5675d-75f2-45a0-9fd2-f45378a9e667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286149, "uuid": "b02134da-27c3-4244-a58a-9c5f810056f2", "value": "f6dc84a64d99e09993ed396dc2dd5b80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5121b2-ae6c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620306706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306706, "uuid": "dc47052e-2a74-40fb-9322-e96989018bbd", "comment": "Malware payload", "value": "38fe72663ed2e7c4d590a5858ee30295", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306706, "uuid": "f2e11a8f-75a4-4d34-8d83-8c93babdf074", "comment": "Malware payload", "value": "0e8842ed343c5ac26e78c3e79578b343bd1b085ee01e61374ee908c8110bad7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306706, "uuid": "36140bd5-59fc-4292-99e2-7c9955113a16", "comment": "Malware payload", "value": "1f59152138c0c196bab1edb9dde78502c54a06ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306706, "uuid": "a59c86d6-bd65-4ad7-b0cb-d6697e4bbdf0", "comment": "Malware payload", "value": "08ef1c58e56b7bb4c16ce17ed9711e67514ea9b6a47a46792db406904fd920a8e96b5af9d0aee563aae2e325df0ccc72", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306706, "uuid": "4e8159e3-ba1a-41da-b79d-504c490da42a", "value": "18E42362AB54409EF4B246B731400A4C7F640B81995B7FB2FB09F9E424D81D3E677ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306706, "uuid": "6a80e697-3494-47b9-8f00-63af2c158cb8", "value": "12288:3dteH40R31mnFs92E1ULNRTHHX4SjYE9JQQUStUscKg/RaAFabfl0jaGST:3dc1sFs9b1ULNRLX483UStgKgZJFabCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306706, "uuid": "1d41b766-795d-4a99-ac55-ed252b15810b", "value": 663475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306706, "uuid": "c86456b9-c1e8-435d-bbf5-073febfa9f78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306706, "uuid": "6a9f331b-60d6-4862-a16b-42315b159ded", "value": "0e8842ed343c5ac26e78c3e79578b343bd1b085ee01e61374ee908c8110bad7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c38f862-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338784, "uuid": "16606023-0b07-447a-8c9a-b4939d26092f", "comment": "Malware payload", "value": "988675bfeb9d7202fc9c8bca79f2e507", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338784, "uuid": "a5f0e9ec-7d87-43a5-8e04-5efcd4823e4f", "comment": "Malware payload", "value": "0eb2d1c5a18be09c45f5199ece3b0faabe393cedd27d3fdee0d2beb8e1f90721", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338784, "uuid": "c409f2d9-002d-4284-a477-92556b793f22", "comment": "Malware payload", "value": "3eb9dfea398bf83fd7b2b05afe2b8f0a4b999caf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338784, "uuid": "fb368e35-8c14-4f75-aac2-13c03a6cc07f", "comment": "Malware payload", "value": "f6f18ad95190d25a62a864a1fccd5dc290ba0f7ed1afea7b1207e4b64f88b32bec093a1eaefdd636055109c62f8e8957", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338784, "uuid": "d89e21bb-e502-4b2f-b238-c13156c3f583", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338784, "uuid": "16f66e17-69c4-4040-ab68-07db3f35d4a9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338784, "uuid": "dc764d9c-0dc1-4595-98b6-418f45cad500", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338784, "uuid": "637b8bbb-8fd1-4987-a914-323f5d724ff8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338784, "uuid": "04ec83fe-165c-4f27-9c9c-374d53eadda9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338784, "uuid": "f3283e1c-0a72-46fa-9cf1-72b0e5f70efc", "value": "988675bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940086a6-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338905, "uuid": "0a64dceb-d85c-41ce-96e3-4ee2e2f95e7c", "comment": "Malware payload", "value": "4b84ccf5b01fdf6757e4ca0c829fc253", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338905, "uuid": "e8d143c0-ae97-498e-802a-1899fa096b9b", "comment": "Malware payload", "value": "0ecc78abfbc02d37813f759ff046ae7b1206fcf53182ca647b8e59b29e6ca2de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338905, "uuid": "8503f956-7829-4c79-ac9c-5a3bf193f224", "comment": "Malware payload", "value": "34aabb07827737d3e18da6cc02e544abd7b2b38a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338905, "uuid": "aad88952-cb61-4e00-9844-9cf5ada98c6a", "comment": "Malware payload", "value": "d86a6d879dabab22baab4df56faecf32f5ce83577d241510f85531e58a7bfbbe6b6d076f0bb304baa4a759b71495bdaa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338905, "uuid": "4aef456f-281d-4137-8344-2583a9b57668", "value": "ADF3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338905, "uuid": "983cffc0-1d17-447b-8fb8-b9fc1a1358fb", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338905, "uuid": "705acf5e-a6ac-4ed5-a7b9-f4d0667a8dd8", "value": "3072:TLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:GERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338905, "uuid": "14961308-eab6-4070-ac1f-422c0c51a9f5", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338905, "uuid": "ea1b23f2-4e99-448a-8ebf-8a23ecb9c2a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338905, "uuid": "4e5685cf-ba71-43f0-99f2-8ed7f4d3f221", "value": "4b84ccf5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12dd6c0-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339464, "uuid": "b4d1b109-4616-49f3-b783-146392ebfbf5", "comment": "Malware payload", "value": "cfee0cfcc6255a608e26100993eaf75e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339464, "uuid": "105a568a-9bca-4c5f-91a3-a71e12e1e5ef", "comment": "Malware payload", "value": "0ef153e13b94e0eb54e15653c1730e517a01011dbade304cae2260612d91e72e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339464, "uuid": "41f910ae-192f-4dfc-8e6f-003c5de09873", "comment": "Malware payload", "value": "966f8ffa144818da879220f3c9b545e6958c291a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339464, "uuid": "335ccc2b-be80-45bb-9d3b-42d7c1cc1043", "comment": "Malware payload", "value": "b7392017233c2adc2cc0e274f35ba2af2cd8c4c5eb16f041b3f6465d85da6197c5b2489ebeb833e09dde4f32d816fa49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339464, "uuid": "e1c1d04c-1bc1-4142-8e83-c23d8622b757", "value": "02F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339464, "uuid": "1a5b13cb-d176-45f7-b2da-56f556bcf293", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339464, "uuid": "dada8bec-fcae-4990-86bf-c1f304f2eb7a", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339464, "uuid": "73ad69c4-9f7e-476f-9e0e-8a0208849c05", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339464, "uuid": "ad01fb0e-293a-438a-9a25-8143adfbebe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339464, "uuid": "d4de1768-200c-4d40-a4fb-0e8b21375ce3", "value": "cfee0cfc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8431ed01-ae71-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620308813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308813, "uuid": "bd06dd4e-dc42-48ea-bc3d-49477addae36", "comment": "Malware payload (IcedID)", "value": "f07a8a1226e19b16ca014d0ea924e0a2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308813, "uuid": "06e03f44-9e30-4892-bcc3-87345a2e0342", "comment": "Malware payload (IcedID)", "value": "0f5508f1852fb24e927410e7abfc94ba3b029944a4302e06b0f5317f4d9cc7f2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308813, "uuid": "88816a4a-174d-4be7-87ef-c282581740d2", "comment": "Malware payload (IcedID)", "value": "3337d7ce751cfa6d30fffc46ffcc00c462af8805", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308813, "uuid": "009fd1d1-e0ca-4cc8-b44d-2121f5c3f90c", "comment": "Malware payload (IcedID)", "value": "7e8e2ca705646f892b20ac1cef5bf8385ee67d4d921f767dba56ae6e31e6d8a78c77e3461b73cf20cc3a373feee40fef", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308813, "uuid": "ff488b0f-7e5d-4b53-9f75-eaf4f6e9ce0e", "value": "E5733730AB699B80EDC679375245CAB1D3324F90574373E7FE6CBB4D2B68981482216F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308813, "uuid": "444e2c72-19db-43c2-9604-dfb0003a02b3", "value": "1536:eFsrZxoCOkB1bTDkNnhipFnY5IE2vYjsRBFl:eFSX3DMInY54vYjsR/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620308813, "uuid": "1faa3183-5099-49fe-8b29-79089986a746", "value": 77742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620308813, "uuid": "244df5e9-3238-4e90-9b31-28078baa1bcb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308813, "uuid": "3030422a-9187-4392-8db9-078df80f137f", "value": "particulars_05.06.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9828a7f0-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327745, "uuid": "04fadcea-762c-49ee-afe6-a560f24311c4", "comment": "Malware payload (Dridex)", "value": "77ce5e39c8069d65f3cd71fb080a9bfc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327745, "uuid": "8ea79e4a-030c-42eb-9b7e-1b6f8c5f43be", "comment": "Malware payload (Dridex)", "value": "0fb97ed82e95593187f56c1a5609c606d363e866e9682a155fdf1a3f486db4af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327745, "uuid": "35498317-b53f-4718-a965-b91722d25f38", "comment": "Malware payload (Dridex)", "value": "d0b25e740d6c16a0c5130343f2992a009d9f8a04", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327745, "uuid": "fbda2327-6079-4ab3-9a9c-ce8c7a07acc0", "comment": "Malware payload (Dridex)", "value": "23f95af5c8477448e200d8d8c983ef079d5d9a1d37009e6842f186721948a98c45ea1b85321b0354058a722d8edabbb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327745, "uuid": "6c6cbefe-acc6-45f0-9174-1ad9882d3598", "value": "75F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327745, "uuid": "20119d25-fcca-480e-b729-8736ba63c3ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327745, "uuid": "267d3f74-e531-4dac-a2fb-0ba90c10c788", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327745, "uuid": "f5024008-13ac-46c5-bb03-cbd93f57bab1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327745, "uuid": "b6d6f17b-53a3-4f84-b43e-4c4f3f775872", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327745, "uuid": "c7eee78c-14be-40d1-8764-203d9b9358d5", "value": "77ce5e39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bffa415-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316906, "uuid": "cc71d3b2-7534-4471-af2f-968e48dc94f7", "comment": "Malware payload (Dridex)", "value": "a9da51e2a3f3ebe9a14a7238934a1b0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316906, "uuid": "ca2256c5-848c-45de-84dd-243ae297480d", "comment": "Malware payload (Dridex)", "value": "0fcba564643e5aa3bf92cbece227df84f118748480d9ab2059590d6b370c724d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316906, "uuid": "fc71412c-d83a-48e5-87a2-05816f2d9c99", "comment": "Malware payload (Dridex)", "value": "d28f38203e049e33bcd29cb5050b95c4a05bd629", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316906, "uuid": "72a605d4-e549-41e0-bff1-ab0eb8991c95", "comment": "Malware payload (Dridex)", "value": "8b67107e26b2de04d7dc59d1ac5e0777738c663f40bfafcc7fccf86cb312ec6597701d4868e021c4f94ed19c595a389b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316906, "uuid": "8a01d8df-6b3c-4fdb-b36d-9d842aa8795b", "value": "FAF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316906, "uuid": "4065ff9a-7c72-46a8-b6cf-871cee1d4bc3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316906, "uuid": "62b0d0a5-b500-49b2-bb42-8e2c3f2d2ed5", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316906, "uuid": "cfcd9f53-74e2-40a9-8eb6-b63f3d448543", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316906, "uuid": "fa915a49-5a9e-44ac-a37c-a23569fe7c69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316906, "uuid": "3aec1c3c-750a-443c-ab2d-02dffbb0480d", "value": "a9da51e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce02939-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259355, "uuid": "e16e670c-5692-4430-83d2-a0b8dbb955d7", "comment": "Malware payload (Dridex)", "value": "6dfbf6b2ece3e329e06c88c76b0e4b89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259355, "uuid": "07e4da19-4fe7-4db3-a0b2-ca8aab29f40c", "comment": "Malware payload (Dridex)", "value": "100c4c885b10cf0cdb7f64599a80bed880329fe8f090c5c284ecb72437fa2f12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259355, "uuid": "0b7a7804-86c6-40c3-b817-0a9730650213", "comment": "Malware payload (Dridex)", "value": "9f62d2c7637a513ce54bcfea46ca15b65b3618b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259355, "uuid": "ed64c215-de69-4446-b80d-75e6be20b2be", "comment": "Malware payload (Dridex)", "value": "9975f835a6c3ef65c39e89ed83d3f83c0436ab07d33e5f0959ad1e2a0492a5b10add7d554c6f2254a56b6aa3187b78c1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259355, "uuid": "7009e9f6-47ef-4933-813c-3c1da3424f17", "value": "7AF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259355, "uuid": "c9e2d754-f8c6-477f-b10a-1bfe627889f0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259355, "uuid": "53df79aa-963a-4d4e-bfd6-eca0a366fcc6", "value": "3072:bB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259355, "uuid": "06b268c9-87a6-4aaf-a244-0ca6c7078815", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259355, "uuid": "bbacad23-0c33-4427-a34d-fad66a71a121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259355, "uuid": "685b0d84-d22b-412e-b2df-4f010b86f1e3", "value": "6dfbf6b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12372e4e-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295308, "uuid": "fbbb5e2d-8044-4f23-9dae-85d253f858bb", "comment": "Malware payload (Dridex)", "value": "09e3c759480d4cd9e04ce3c27c8344f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295308, "uuid": "3098a00a-abb4-4c0b-9305-24491d0ee6ad", "comment": "Malware payload (Dridex)", "value": "1015b308f2d1b8301d3a6f33df32d75bf7deea8205eb5cde00e7cae6f607b77b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295308, "uuid": "60ef52a4-33cc-486f-8a58-f604e878fca4", "comment": "Malware payload (Dridex)", "value": "7920f5f9146827f2bbc0ce50e57898230364b411", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295308, "uuid": "6a7b8b90-b54e-4f37-89ff-4bd88cec39f1", "comment": "Malware payload (Dridex)", "value": "aaf7d4cc04d84fdb98a29bcd6e691d7f2e030c16c2f43957df2f5fa8f34bd731a246eb0c3858c0ec2af63a0da70d7cd6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295308, "uuid": "f7ed241d-c25b-47bc-b0a7-5b7a9cda8270", "value": "90F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295308, "uuid": "8784b199-e465-44f3-b9fa-4dcdb3e67a31", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295308, "uuid": "1578925f-d706-4fb8-aa82-24d2e4a3592d", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295308, "uuid": "43a65d79-bf89-4f73-b37a-2d58d53702ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295308, "uuid": "ed46b8bc-6c19-413c-a7a1-7151e81b1929", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295308, "uuid": "e6ce5983-96f2-426c-810b-cd508758cf09", "value": "09e3c759_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1edb42-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280906, "uuid": "d2686f90-215a-4b4a-ab81-d39feada6bc2", "comment": "Malware payload (Dridex)", "value": "a653aedaaad8317b7f9b4d40a03639fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280906, "uuid": "dd23b14c-3550-4a63-a5dc-7cef1f13c311", "comment": "Malware payload (Dridex)", "value": "1048067568293588c9957bb7fb8abcf4f2bcfe9924209f0317696d91a96bd5e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280906, "uuid": "92c63b00-b46f-427c-a085-5ff8a852b1fd", "comment": "Malware payload (Dridex)", "value": "c45afca1b024970089ba83725099a27772647291", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280906, "uuid": "bbed83f6-9e92-4ac2-b0bc-046d075002ef", "comment": "Malware payload (Dridex)", "value": "6aaa1ca81c8be9c38d4d46f85105aa2be92443182aac87bc4a4d0c1c9bfc23547bb88fc413c1055b69cd895e0c209b2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280906, "uuid": "a87b4c9c-7813-41a3-8e46-c576bb055bb5", "value": "ABF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280906, "uuid": "867cb850-74c0-413e-9d54-68200aa49483", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280906, "uuid": "f9cd92ee-cab7-4c45-a931-38e5458394c9", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280906, "uuid": "6595b33b-bd29-4de6-881e-b23a46017ac8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280906, "uuid": "a93618d5-5181-4a21-91e9-077513fc1f13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280906, "uuid": "641fb28a-9e8d-42b5-a019-f25e139899ad", "value": "a653aeda_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f88aa61-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277264, "uuid": "45b12dae-4f3b-43e0-b19a-5fac068b92b8", "comment": "Malware payload (Dridex)", "value": "0a53ce0374a72b3bd0aa59192eaab6dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277264, "uuid": "41801603-52c7-489c-97b0-d1ac9cfb15a0", "comment": "Malware payload (Dridex)", "value": "10805d111334fafc87a83484ea76f9a4d3afb125a296cf58328f01f48974f432", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277264, "uuid": "d03aa82a-8cbc-49dc-86fe-7bc49bfad06a", "comment": "Malware payload (Dridex)", "value": "d46e92807ebe50fcb115ecb4e49232b6a84f38e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277264, "uuid": "5e2092bb-8e6f-4d46-941b-ae9082aa0903", "comment": "Malware payload (Dridex)", "value": "31141c0842c760e93416d96ad9eb186e8a644452adcdce55bcf66953db7f56c3f1b1db29e5f574f02ba684c518f8d137", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277264, "uuid": "01bdbceb-8131-4610-b7cf-f94e944abcc7", "value": "56F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277264, "uuid": "2666ff0d-3835-46bd-b4d6-cf5d5696831f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277264, "uuid": "1c13b703-903d-4380-a408-5190c2a1548e", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277264, "uuid": "65495fc4-dd52-4596-a88a-30111bebc9cf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277264, "uuid": "4969ea8e-0c38-4426-8715-7d7ee51151a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277264, "uuid": "f4294f66-a18f-4275-89aa-1ba2a724b8ca", "value": "0a53ce03_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca074995-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291751, "uuid": "3f53e82f-ae82-40ad-be8c-846709fdef79", "comment": "Malware payload (Dridex)", "value": "6de016172fb34a5c87f9afd9aa5f3fa3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291751, "uuid": "e59ece3e-e44f-496b-9ace-6b9b3111285b", "comment": "Malware payload (Dridex)", "value": "10bf1a5420c6c1f01eb43719bb90e3fb8eb24a3b36b99b9f960b975790a65526", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291751, "uuid": "0d5ec935-ce71-4213-841a-662dc9abbff7", "comment": "Malware payload (Dridex)", "value": "0c6272932ed0574bb17cd0336878f98b42f1a27c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291751, "uuid": "dc6e99ca-48cb-4eaf-8706-64476749edc9", "comment": "Malware payload (Dridex)", "value": "2a3864f16cffab7ac55d223d0056f5ceffa9e13e580de7c6ee96fcb59f95045e32157346911c951f21a7bdf9932840b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291751, "uuid": "7518882d-15e4-4cb4-83f2-203ac88192fe", "value": "0FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291751, "uuid": "ec030b53-e860-4996-b6b2-6ca91f2ffded", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291751, "uuid": "c6591d6a-4564-4374-8e2f-b6c5f3772176", "value": "3072:niFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:8eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291751, "uuid": "475c67ca-1901-4db5-86a9-ee33a409b12d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291751, "uuid": "dc62cb78-d3ae-4712-aa46-f1a6e22c9e52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291751, "uuid": "aaf2fa5b-d87d-471b-b7b7-437c314ebe07", "value": "6de01617_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e09455a-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298844, "uuid": "7eb6102d-09f2-4b68-a155-fd2c75a71f03", "comment": "Malware payload (Dridex)", "value": "ab7f80732140d903341a286e74765456", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298844, "uuid": "85a9f5bd-d5bf-4cad-aa9a-cc4944ef141f", "comment": "Malware payload (Dridex)", "value": "10fd8eada73d4ca2beea0d0bbf32d95c1f6d61125d77381bc38a3fe77b96da50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298844, "uuid": "5e86805b-7cfd-469d-b725-0b029ec0976f", "comment": "Malware payload (Dridex)", "value": "7839d76c2022f91a2c99992686e75001e94d9496", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298844, "uuid": "9c2f1761-f5ad-49ba-9ed3-e367ff8027ba", "comment": "Malware payload (Dridex)", "value": "6f8a43b5f2eabd2f7a9647972d1d5a7564f3b7fd38dfa0f3afeccaaa92fa68814cb671008da0b2f31f28e4aec015b82b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298844, "uuid": "647b4431-aa00-4345-a80f-f04143953b59", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298844, "uuid": "b232db51-9930-4517-b6df-152d632da3ea", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298844, "uuid": "ab4a7f55-eeae-4bdd-91e8-c11b29a57271", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298844, "uuid": "69da061d-3fc1-492d-ab63-b5b5857361ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298844, "uuid": "20fadb74-e995-4bb2-b01e-fd6199ed6431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298844, "uuid": "08e4a004-008b-4f13-9ce5-36f0d7679412", "value": "ab7f8073_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b1b036-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259289, "uuid": "946605de-55ef-47d7-a20e-72f0b9e0841a", "comment": "Malware payload (Dridex)", "value": "3d2f21606b000941bfc118a4977a195b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259289, "uuid": "5bce36ca-c76a-4900-a90b-2d26dafd54e9", "comment": "Malware payload (Dridex)", "value": "1162dd9431faab3cfc6a9369d7ba0321e59444f270bd196992bbfc133b64cf94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259289, "uuid": "650e5e93-b3dc-424f-ae72-affc77e54fe0", "comment": "Malware payload (Dridex)", "value": "ce0f5edda1e624f6e73a24b80714d76899488705", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259289, "uuid": "0dd777cd-b75f-47e4-876e-4a267c79d569", "comment": "Malware payload (Dridex)", "value": "da2b60f6a286ca49612d549d18cc37bbcb9031dc20877e389c9159d656452a1f98ac9bedf2ecdd7ca223aa30d1b017ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259289, "uuid": "f465b02a-8367-4df8-84d7-1ed3d565962d", "value": "7FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259289, "uuid": "42ddf628-ff16-4342-97a7-3af848c30f0d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259289, "uuid": "1ec4bd56-9bd0-4c74-9f2e-6cd2bb21f49a", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259289, "uuid": "be057460-ed00-44dd-a4b5-d3824ff589a3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259289, "uuid": "d41e6a0d-29d0-47db-8ec5-125ba92a0b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259289, "uuid": "1f98227c-2b25-43be-913e-1be2d09c8793", "value": "3d2f2160_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e582b66-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280913, "uuid": "2c40fbe6-d111-4784-96f4-8cdda0408a07", "comment": "Malware payload (Dridex)", "value": "5fb5a47b7679296ac2156d321e3d0de3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280913, "uuid": "93a518a6-2b47-4671-bc56-e41fb538acda", "comment": "Malware payload (Dridex)", "value": "1164a19b4b9ec19bfe9174316992c1bb552645eda4e0c2a22f5a89b80b96f762", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280913, "uuid": "79a1fa5e-a271-4127-b8a0-27c5186fba84", "comment": "Malware payload (Dridex)", "value": "205a8a1b44e3d59bf6aa3ccf2b2fa9909e48657a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280913, "uuid": "9890dce5-d419-42d3-b28b-50cd54c225a1", "comment": "Malware payload (Dridex)", "value": "8b1d6cce3c2875fed2f23b4f3ebb8d6d1a58377aeb1c9120de53d8e6f0c43cbb3ab744f4881807e54e2ea4680deb0c35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280913, "uuid": "32a20e34-b970-41de-9991-f831f8e8476a", "value": "9EF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280913, "uuid": "2d8b9be5-d0af-43f0-883a-9fd492b45b15", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280913, "uuid": "40b95003-2c48-4b4d-b24f-347d1e67caa9", "value": "3072:AIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Zc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280913, "uuid": "d9c045ef-437d-4069-9494-722ba794bfd4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280913, "uuid": "a301302e-621d-4e18-9c48-78ef70346cb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280913, "uuid": "3180e4e9-aa3e-4c1b-85ad-9e67de6a3907", "value": "5fb5a47b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0812f5ae-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295291, "uuid": "00fc7f0b-4e7d-4a71-a0b5-59cf4dddcf84", "comment": "Malware payload (Dridex)", "value": "94a5ebab452212b78d721b780d7a666d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295291, "uuid": "95ed3dba-e62b-45cf-af13-dbf330f8ab5a", "comment": "Malware payload (Dridex)", "value": "11ad143344da3d02b8567ec9e28e38fde59b1dd52e6f52b653ed49d42ca114ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295291, "uuid": "5edd6096-f950-40b5-bcb3-b485baae8c27", "comment": "Malware payload (Dridex)", "value": "15d0375aa827f86a638c23a1ead3247bd0ae45c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295291, "uuid": "f98700eb-5b7f-48e4-8816-4afc46428e2d", "comment": "Malware payload (Dridex)", "value": "3022ad4dce28fb3a491aff4c7abe73350adae52618ec7f949b4b067346db7cc3cf88b058878ee79eb38ebb4389676c0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295291, "uuid": "0f1de9dc-6c6b-4c93-9ee1-0e91a90cf70e", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295291, "uuid": "a814c41f-e5af-4dae-bd7f-0301a3ae425c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295291, "uuid": "ef17b91d-cb14-47d0-b4e7-9746a3fa8d78", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295291, "uuid": "00776e0c-d357-4255-9081-06d541c5b370", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295291, "uuid": "c2591e6f-0df2-4745-aee7-dc5999913aa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295291, "uuid": "4967b653-ce10-4a17-950d-7337655c5b0f", "value": "94a5ebab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ee4b81-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259295, "uuid": "dc24e3c9-8db9-4989-a9c6-cc091c79f3d0", "comment": "Malware payload (Dridex)", "value": "78b585512ee1bea9aad14e3642419822", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259295, "uuid": "e311a245-e629-40c0-85aa-004811409a4c", "comment": "Malware payload (Dridex)", "value": "11ad901e5037630625fe2333bb92d8912fad05c9af9f378e0e03159532b1d842", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259295, "uuid": "b27f7ca0-45b9-40b8-87b5-c83330260ec8", "comment": "Malware payload (Dridex)", "value": "9339e4c7c88f3cda19265a786fad0f220c6e09ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259295, "uuid": "dbd8c0a8-ccdc-4ed4-99bc-245f46bc4050", "comment": "Malware payload (Dridex)", "value": "686dbc233ce03c67077eb73720c2e90cca24468544d26ca0bcd6fd5275ee4ca6ed6483bc8d92a76818e0dd22e89e2fee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259295, "uuid": "5b9329d8-ce48-4a00-93ad-a0e3d1887b07", "value": "B0F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259295, "uuid": "b87e8493-f4bb-4ecd-8070-d1911269ef10", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259295, "uuid": "a6012485-6e31-40f7-bf6b-8ce529e9ee25", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259295, "uuid": "a9be30b0-3086-473d-a351-e6b1584ee56d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259295, "uuid": "8b6c1022-b451-42fc-8082-8944078848c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259295, "uuid": "d38a974a-ba83-4c44-bf6d-dc7fce25da78", "value": "78b58551_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779d3637-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327690, "uuid": "46856c89-9dcc-410b-883f-807332378ba6", "comment": "Malware payload (Dridex)", "value": "e1903084230223a9f508d0813dc2f24f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327690, "uuid": "6976b2af-3d60-475a-a701-7bdc4d06f375", "comment": "Malware payload (Dridex)", "value": "11b16d39daa9e6d63d840af841d4801121ea9e2fe847b55bde62872ab521f773", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327690, "uuid": "d0037af4-8fa4-4984-88f6-ecb45065bb83", "comment": "Malware payload (Dridex)", "value": "6dd4870bd50d082de2211cbf3357cddc4e917943", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327690, "uuid": "2b838b85-0614-4fdf-ab80-4a9c5c6e0f64", "comment": "Malware payload (Dridex)", "value": "cafe132c7fb6beccd759f32a694c34ee72c1eed8cc51eaceee2689fa70d83f095adcbb7b135370e9665e179068711be7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327690, "uuid": "a596ed75-3cba-4d93-b6bf-1abd2f3bce15", "value": "71F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327690, "uuid": "d782e333-a23a-4d50-9b0d-e79328f8b4a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327690, "uuid": "afb4a168-4c28-4800-ae40-8cf7b53574f7", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327690, "uuid": "92b904d4-b405-4842-8eb2-adff4eede058", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327690, "uuid": "f171823b-e4b6-4b22-9774-b09fdf6c6d34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327690, "uuid": "1955baa1-4be3-42f9-862d-4d0ce4c07c13", "value": "e1903084_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4eb1bf1-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295258, "uuid": "12a31f4b-3f6c-4614-b5af-2b5b11464749", "comment": "Malware payload (Dridex)", "value": "43b0c7541af75d1b678ce1785e4379ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295258, "uuid": "8fa1b5cc-816f-4482-9b8a-147f99a803dd", "comment": "Malware payload (Dridex)", "value": "11d75dc6edbd220db3a6aca862c920427e866b439acdd664f9d75e536c49e6f0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295258, "uuid": "73fc77cc-7a60-4fc0-89ec-ef428013494f", "comment": "Malware payload (Dridex)", "value": "4653e4d27af5fc06d0689aabc7396df940b130b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295258, "uuid": "f4a38ce9-cb4c-4c08-a3ae-2f838c1d7f1c", "comment": "Malware payload (Dridex)", "value": "4619e54ba7ee0048ae65de8c5edb884615044c66d61548fb7bb6468a8192341d9cae9e96ee0b37b9f08e8c1bc142eca1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295258, "uuid": "13144eea-01d1-41d3-9670-cbcfef6b603e", "value": "AFF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295258, "uuid": "97d8f16a-c14e-40a4-aac7-b72fcf19d0f8", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295258, "uuid": "ebc12361-6f65-4688-80a2-bf7254013b63", "value": "3072:cB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:F4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295258, "uuid": "111291f8-1525-4f27-a922-366d14dc486c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295258, "uuid": "dbc737cb-d0bb-4651-adb0-584bd61977ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295258, "uuid": "49e2e0a8-0fda-4d0d-a939-2cbdd6c59892", "value": "43b0c754_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f306c47c-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339493, "uuid": "61ae0c06-249e-416a-bae1-7c5b2cceef89", "comment": "Malware payload", "value": "a37e930858b6eb3d01c4ffed4ecc4493", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339493, "uuid": "0cd0bed8-57c4-47a5-9944-be12f17be818", "comment": "Malware payload", "value": "11dd224099af87c3c99b5f119522dd5bb09749f9eab76932232256f4437054f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339493, "uuid": "fe1e3fb8-1919-47eb-a499-9b4b8bb9d712", "comment": "Malware payload", "value": "87b448327a1d619de374bd2140a66ab54584afff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339493, "uuid": "c78ad801-0e79-41e5-9e48-ee5b980cc502", "comment": "Malware payload", "value": "0192dccbba8d553476bff38774f174850290b8fbdad15feabf8efe5568eddb9590a4beec7ce102abfd969177c08af0f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339493, "uuid": "91e8d5cf-71bc-4887-81c3-6cf353c4748a", "value": "83F4232D27FF843D22972A79EB0C9C214D2A7C8CA2F3C94BD511049D16FE93615A739B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339493, "uuid": "46bbbe4a-0e6b-4125-944b-3172f0324b56", "value": "12288:7QgJcONVGeq8zNXjQceL3mdbmyCby4yBmAO55WIa2O2KOdppJg:0stB0cyyTGA25ah2Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339493, "uuid": "1ff522f0-28af-4038-acd1-41a1e687ad23", "value": 740005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339493, "uuid": "44924bd5-6c46-46f7-9693-c47b08fff210", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339493, "uuid": "5c66d181-4599-47cd-9f7a-10683b243197", "value": "a37e9308_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5b330b-ae89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620319160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319160, "uuid": "fdc9bb35-9743-48c0-8a29-8e258eafb4aa", "comment": "Malware payload", "value": "af603291bd5aa5c496c7b199163c5cda", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319160, "uuid": "e6694ef5-419f-4a85-a699-f2ca7405bff6", "comment": "Malware payload", "value": "127571a418fb8717e011f384d07787dadbd0aefce50a137c01a0ce8d6933e940", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319160, "uuid": "2cac75da-d16e-43bf-bb33-afb566e4e841", "comment": "Malware payload", "value": "46a8f2614f598c93c2ca8c245a12f26a1ada86b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319160, "uuid": "3cc27cb2-e952-4c15-a172-6a08ca201124", "comment": "Malware payload", "value": "dd72a1fdf1fca11130e083d63e989582994072e480fde447b00ec62746643228a5b07810cfbed10c8dab79b3d6255631", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319160, "uuid": "0a718c8a-d8fa-4df2-8cfb-f50f2c4934d2", "value": "B1D45C0057E45B97C2AE03B9E198E63173F5DE05A25AAB8B690BFAF53F7339144009D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319160, "uuid": "e1566541-b63e-44eb-a7a9-f19848d95adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319160, "uuid": "8a90ceed-5e4e-402f-9128-304a0ccaf977", "value": "12288:41fxhwL8mLAHefRIZtbVqrTwqEZFLp3unHnMY1:AZyJAH/ZtxqEZ5punMY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620319160, "uuid": "64393479-c8f5-46bf-801a-3b521415fbde", "value": 654136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620319160, "uuid": "b6ddc226-3cab-4b44-9525-577d7164f695", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319160, "uuid": "f2290dc5-eacf-4441-9e25-63d9b70d92a2", "value": "127571a418fb8717e011f384d07787dadbd0aefce50a137c01a0ce8d6933e940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07453df8-ae39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284552, "uuid": "d37a8f5e-9dd6-4ff8-a256-56f8480db020", "comment": "Malware payload (Dridex)", "value": "37663b8f8e087c0fee3373844cc59dc5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284552, "uuid": "3ea7a34f-9f7b-4213-aa88-04d1a0eff502", "comment": "Malware payload (Dridex)", "value": "128bd9ed98ad3b04923a4a7dc763c2857a203e40696e0c38d67c4615f9c7ddcb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284552, "uuid": "8f11d3ca-923b-41af-bffd-da08db8197b6", "comment": "Malware payload (Dridex)", "value": "7641a0014f4f93bf13d4f03f305eba0c3536e039", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284552, "uuid": "405180b3-d87c-45d6-9eac-1f01f15821b0", "comment": "Malware payload (Dridex)", "value": "762928face704345179444879e7771af3510a5344c141990c002a1acad9a5f1f3c2d092c7abb2bb2e90cfff1b293adb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284552, "uuid": "979a4cf1-052e-48f7-a16e-19a2792a997c", "value": "B1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284552, "uuid": "1effe22d-4d0b-4c93-9afc-0d2f5ad9a44d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284552, "uuid": "0ad0c130-ce0c-4b2d-bd09-553a669c5950", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284552, "uuid": "747b5e9b-905f-4c42-b6f0-f358cbd6ffc6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284552, "uuid": "30fb4eef-3be1-47bb-8920-122b4423a730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284552, "uuid": "efe0ff07-4059-4e09-a0df-d25bff6e730b", "value": "37663b8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29089cb1-ae56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620297064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297064, "uuid": "a37f8af2-7d09-4440-a72d-bf984070549c", "comment": "Malware payload", "value": "97680c19eb7372a5a6104836eb2eacf6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297064, "uuid": "2211a836-44bf-4ada-b773-3c391b3f42f5", "comment": "Malware payload", "value": "12b6116974f1dd42d7ae0c4d57cbba29ed3e8a069096c9991e9d5210330ace36", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297064, "uuid": "fdc215f0-f30c-4601-be6b-aaa9e54aecbb", "comment": "Malware payload", "value": "f89fd944584b2f9da2c716d395a5b342315b53d2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297064, "uuid": "647811b1-8660-4103-8c16-02acb42afac2", "comment": "Malware payload", "value": "099f190c900c3dbd4c44dc9c68813d80ba76ca3c0bc90b6677a4a266702f814d99c469eb5990e0a97d8572fe6a2192b6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297064, "uuid": "2c72334d-0f88-4d60-aa03-80588d82b42c", "value": "05428DD6A7024339D31B6432504089947B297640CF853E53A661E8FE99FF6CB07ACA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297064, "uuid": "8cf47938-686a-4bcb-aa2c-6b50829bb65b", "value": "192:sTrXz2OynCRmimJYm2Y20F9mIdZl3M/gaqltpmmizliSmSQIHA:suC4iKYm3ICl3GRqvpmmmliSmSZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620297064, "uuid": "5b6dc0c8-df80-4599-93ea-1d4b90557ef0", "value": 12798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620297064, "uuid": "9a2d7754-ce57-421c-b513-ad9dd4e7c95a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297064, "uuid": "9cb11974-9bbf-451e-9a08-7197679810dc", "value": "Order Purchase List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8327aa-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324071, "uuid": "e1a35693-8c24-409d-8733-33318f859cac", "comment": "Malware payload (Dridex)", "value": "22cbc09b64d840ad3f0334888f91e435", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324071, "uuid": "fb3e6579-dd0e-4179-a9c7-a03c96a45a32", "comment": "Malware payload (Dridex)", "value": "12b8b6408f83d54ddc3ccc07f2b811a6692375422a05494b54ccaf64342001d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324071, "uuid": "90dae7cd-0411-4319-a24e-a15fc767dc7e", "comment": "Malware payload (Dridex)", "value": "36c8c575743616c111b69823d5662fcafcf5a5b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324071, "uuid": "e64c316e-9a59-4a96-bd07-424ed4efd3fc", "comment": "Malware payload (Dridex)", "value": "3931a25d5fc3b96e1603a50fd25d27eed1824bd20c83652d7076c65dcabb2fc7e243860e1ba6111b20fb2ab4bd7e6f6c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324071, "uuid": "df169d69-052a-4a05-aebe-2dcdf0a4991b", "value": "44F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324071, "uuid": "6dff4867-8252-4e29-8c69-c8df8816acaf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324071, "uuid": "feebd75d-bcd5-452b-9cd5-d557a948f86f", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324071, "uuid": "8a17cd4a-bb92-4275-9e97-ff47f50080eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324071, "uuid": "05d3fd57-7fce-4d5b-a904-3597e4d788bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324071, "uuid": "728ee0da-9a29-43b9-aee3-508d5698d20e", "value": "22cbc09b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2d73e5-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270093, "uuid": "1f14a756-b9f6-476e-a7a8-8b5b0032fad0", "comment": "Malware payload (Dridex)", "value": "d79ffd2a2570dcf6edd69cecba8be734", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270093, "uuid": "e1d5316a-4877-47e3-b39b-55b1babfcfe0", "comment": "Malware payload (Dridex)", "value": "12d53ae6002eb2963f18e98f7f6565391a8e2b01cc0275ceca79de1719e7bde4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270093, "uuid": "e079116f-0f16-45c8-8aea-cf63770cb63b", "comment": "Malware payload (Dridex)", "value": "ac25aec91e1787bcafedd2e501c3e09284a5d727", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270093, "uuid": "b866dfec-a21a-4bba-b4c1-9e4b9902d04a", "comment": "Malware payload (Dridex)", "value": "2f40d07ab92e88a8923d45e8a6a239276409fdeaf156611bc10ffa429d48e85928e8b3c202a21de3e576642c2c6529b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270093, "uuid": "a0bd12cd-2d46-4f69-a829-eb67c2195aa9", "value": "3CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270093, "uuid": "92eb721c-e3b3-4db9-a9c7-50abfef74a81", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270093, "uuid": "fa0b6fbc-5b6e-4433-bea9-00812656c358", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270093, "uuid": "17ad6b48-98e1-4ded-83a8-9dcca1c43d1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270093, "uuid": "2cd51c4a-54dc-4344-ab2b-20b46fe00d8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270093, "uuid": "21f98aa5-dbd4-4f0f-85df-673ae47b4f2d", "value": "d79ffd2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1347f7-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320508, "uuid": "d4a96385-afd8-4af6-ba4f-3f2743cd00b6", "comment": "Malware payload (Dridex)", "value": "3ce468914667ccdbbd2535cca301b0c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320508, "uuid": "4588ba54-5c9f-458d-9436-c39d924bb233", "comment": "Malware payload (Dridex)", "value": "131924d1cf227a289116581263775473f8c2b24cb04b651d5f7e79158314f3f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320508, "uuid": "bdf2436a-a346-4ead-a188-3cc7a393e5fe", "comment": "Malware payload (Dridex)", "value": "edd35acb734c343a12ec62917f3fe0c1f7835265", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320508, "uuid": "ceaf2967-1643-4919-bf8a-75c95ee1fc88", "comment": "Malware payload (Dridex)", "value": "b0afa407a9d400b6a7e3782e858d91b154c504663002b2852340bfd07438f6aa29e960b1cec570938cff19587087c566", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320508, "uuid": "2abceb83-ffd4-48ef-959a-52b8a98e2fea", "value": "DBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320508, "uuid": "c6c90571-5801-4795-88b7-4ba98261bef3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320508, "uuid": "a3459b38-14fe-4366-8692-dc7d5abdf5a0", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320508, "uuid": "1a98d68a-efcd-4407-8aac-96c41c2a817d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320508, "uuid": "cb8faefd-55b9-41c6-9929-c965db561567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320508, "uuid": "f10e5b24-452b-4738-b231-637865b351a1", "value": "3ce46891_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e271c0dc-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266451, "uuid": "839d2006-e16b-4aad-8127-e74e1b07ad49", "comment": "Malware payload (Dridex)", "value": "082483708fc932acaaac9b4d44b7c0df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266451, "uuid": "33fb34cc-0398-49da-babb-4da17d26518b", "comment": "Malware payload (Dridex)", "value": "138c71da94e326e95417bc7b7fd052a4819d822123f5bcec6d13b8f42fc91044", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266451, "uuid": "92f8dc98-706a-4d94-b0b3-56185844baf6", "comment": "Malware payload (Dridex)", "value": "a9ba56b9e3764b78a4c6cf0f58863588d2f757f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266451, "uuid": "00d81b91-e3cb-434d-9b0a-89f1e29009c5", "comment": "Malware payload (Dridex)", "value": "13e5396469ec0c94620b90caae7d86416906905893aabb1002580eb3f1649f77910c74de9d5b11e479cbe155757b3d9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266451, "uuid": "41aae029-5955-4ffc-9cfa-73a1499cc41e", "value": "13F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266451, "uuid": "a668b86b-3996-4957-a0df-c58485ea1225", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266451, "uuid": "82cd7212-e35c-4a5d-a086-479a8490f4fd", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266451, "uuid": "a50c3ca9-e56d-4907-804d-b262fae1f0c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266451, "uuid": "9bf625cf-f696-4bc2-b42f-f13e86e9cd06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266451, "uuid": "4739e2a1-1e2a-4d5f-9cdc-226715f5a359", "value": "08248370_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41c397e-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620288278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288278, "uuid": "67edfe16-dda2-4d49-9d9b-b2c05ae40915", "comment": "Malware payload (AgentTesla)", "value": "619840baecb0d791d90c2969bc0e23ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288278, "uuid": "3461f30b-5dfe-48c4-88dd-6fd1576af5ec", "comment": "Malware payload (AgentTesla)", "value": "13d0171a2ef946c23d3983b5b68a19de82d0882ab580014d519095f9fe31e8c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288278, "uuid": "92b029d7-4f88-46f1-a70a-df215287766f", "comment": "Malware payload (AgentTesla)", "value": "eab4f4d9976e2aeb4d1ce8f563e6640dd1b1e654", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288278, "uuid": "2b736427-7cd7-441e-8bbd-2f7406bc75d2", "comment": "Malware payload (AgentTesla)", "value": "8716ea440aa851b99fb499d65886013ad73955dc5ee9f0856ba92a5a211b5cf33dc79f048bb7e43f02a0693a0e5b63c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288278, "uuid": "809b4a05-0aef-4ec7-adf8-68d760e9ed8e", "value": "7335AD2212989920E17B63748462C23947F67E03E676D75CBEE87CDB3B336819A57313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288278, "uuid": "570b591f-3e52-46e2-b335-03ef7beae5d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288278, "uuid": "1b9f582c-1828-4b72-9a59-cb2e756755fb", "value": "12288:FEl9qj3WBno0MySWkAOSm4Wh7ZBw0EAWZAnqCdJjLrsmKBkOXk:FdW5SWDbm/7ZBDEAWZAn3xLrsm0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288278, "uuid": "8e3db679-c183-4f70-96fc-c81e5f2a4d50", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288278, "uuid": "5b513794-b985-4ee9-8b6b-2ddc8aa9d5ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288278, "uuid": "218d7807-57d7-4f8f-88ab-83086dc0fee8", "value": "OUTGOING SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1040303-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620281025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281025, "uuid": "3a877e19-5a96-46d1-81ba-d55ec1085baf", "comment": "Malware payload (Dridex)", "value": "ca4f7e0ed2688b273deb3ba1eec4f8d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281025, "uuid": "bf1efa84-d96b-4af1-a69f-c53835f36b61", "comment": "Malware payload (Dridex)", "value": "13f4370f4bc1269932f65acaf8399965779483828fef5956106c07fc5ac0658b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281025, "uuid": "7c164da6-9d6f-4cb6-8db2-24318f5e571c", "comment": "Malware payload (Dridex)", "value": "956616bc2ca7e152447b6950a348dc470695dc78", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281025, "uuid": "6244462e-352b-42cf-a319-ab5765958a2b", "comment": "Malware payload (Dridex)", "value": "feaa05eafb4fbc0c748adb66c7f1fd979b7ffa7a1fe34a9b87f99cb30e9c932f529760f2f85e50e9b27ef58e29caf5eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281025, "uuid": "ad753d33-efa7-404f-8ca1-a53e22292964", "value": "28F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281025, "uuid": "6061b32c-a602-4725-8724-fada639d973e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281025, "uuid": "9a870eac-6fe7-45f9-86a1-5e4f95f7165c", "value": "3072:EiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:HeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281025, "uuid": "f0d2c95d-4299-413a-9cc1-0a11cb5f1f17", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281025, "uuid": "0804e4db-696f-4e76-8d6b-1a0690739c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281025, "uuid": "f097088e-46f7-4d25-8ee3-de702e1f834e", "value": "ca4f7e0e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99077f3a-ae8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620320015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320015, "uuid": "5cb33745-85ee-43c2-9d53-8702734a254b", "comment": "Malware payload (IcedID)", "value": "6e12475814e89c75ead27a22fe4d39e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320015, "uuid": "e17fdd54-d8fa-4439-ba0d-f6c4815e18e8", "comment": "Malware payload (IcedID)", "value": "13fa17bdaa50b6ddeabad9b5ad62e269f81ce1295b5847027afc4fc7ceeb1904", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320015, "uuid": "ca58e499-4709-4835-a76c-26475c55cb87", "comment": "Malware payload (IcedID)", "value": "84b8d91aecf42d519c48ec1d1aeae0140d377e33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320015, "uuid": "364db442-f470-45f3-80a3-58b52b3933be", "comment": "Malware payload (IcedID)", "value": "cb9d90bc40260544522bdc89d9339ed5481367de92073c88fc79694a87d8e45b99e95c1e33409c420b244f2110bc42f4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320015, "uuid": "5c8554df-d828-459e-b04f-9e5369c4bfb8", "value": "92F362BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320015, "uuid": "a1c7a91a-6edd-4753-a2ba-b5d4e4f3a211", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320015, "uuid": "594d2040-5824-4cc1-a193-12f8314208fc", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320015, "uuid": "3bbf0853-7d5b-4c08-b712-d34e5d1f5f6b", "value": 167368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320015, "uuid": "160ab09c-bd52-4b7e-b9c1-b4f0383d5406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320015, "uuid": "3a6b15af-9f5f-47a3-9d28-1721b4c81411", "value": "6e12475814e89c75ead27a22fe4d39e3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c3f00a-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620285090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285090, "uuid": "a1cab760-7b0a-4e93-a667-e40988718db7", "comment": "Malware payload", "value": "9b715b47ada1840bb9bcc265092231d0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285090, "uuid": "25fb6866-7d1c-4383-99d0-03742b8dfb85", "comment": "Malware payload", "value": "1469d4a9c7a8cddba111e51c987e3c847b1a4ab2d023ccdb1cfa00f8db07dd00", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285090, "uuid": "8d48a8a0-6670-4a51-982a-64206ef702c3", "comment": "Malware payload", "value": "0e761931a2e1e9c1ba9055dcd4872b5d3caf3e11", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285090, "uuid": "1dde6c6e-4268-47a5-ae8d-6551f7df6bd9", "comment": "Malware payload", "value": "31d089c5c1f1f1eae0843a253623aa2f2d754feea1109199401df65f965d4fa69a7a9e134966ff3316bf1c4fb48df784", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285090, "uuid": "95557b63-1d28-401e-b5a0-10040e1fdd8a", "value": "CEE301D9E7C7A0D5C8E412B568728D00B6B78F469C8793013DD2BA7AE7F949B44B0C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285090, "uuid": "3ba53626-cce9-4afd-aa0e-bbb0f388d2ec", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285090, "uuid": "3b53f24c-5864-4f0d-85c3-0e2b4dc6a624", "value": "3072:ccDxIPVrcqP/JFtsW7mGq4vpQNoQRdAcY7pZsPGR1+aJe1mgawzxsBub861jIHxg:ccx21HJFtsJGwpdi/sPGRUTV5n3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285090, "uuid": "4c9efd05-91c2-457b-989b-b4c3c19910aa", "value": 150532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285090, "uuid": "33223774-2e51-4bf0-b0aa-361b20b7d6d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285090, "uuid": "416fc3dc-bd9c-4518-b3f8-5c1d7d0a6b41", "value": "file.msg.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6885e0-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259353, "uuid": "fc9d9326-deaf-4725-975e-b044237069ba", "comment": "Malware payload (Dridex)", "value": "e0121e8f064b9c90d60c8f21b0d60234", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259353, "uuid": "6a887164-fdd5-4962-a438-ba824abda08f", "comment": "Malware payload (Dridex)", "value": "148a0c9926f089462efd9720e11ab0b8038f2b19308eba6285792bf67f329441", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259353, "uuid": "68d87573-21d3-432a-a94e-2f42a0afb573", "comment": "Malware payload (Dridex)", "value": "9d983aa0901d8f14b1839fb2eb501d9bef3f83e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259353, "uuid": "99485622-e278-4b09-8326-1febc81a5242", "comment": "Malware payload (Dridex)", "value": "33cfd9cd2eb527f605b6d02b668dc1a82e57824aa4436a4988522d7f75b7ab9cb068d15ed120db9c41f77d9a079b383b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259353, "uuid": "807b22e9-1d6e-4709-81f7-c89668a6485d", "value": "33F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259353, "uuid": "0d5329d6-e4ba-4672-8c69-f8fdd8843066", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259353, "uuid": "62610de4-862d-4343-9494-2a57f2026473", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259353, "uuid": "2fcf894f-dbd2-47f5-ad47-ad1a773d992d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259353, "uuid": "db615440-5e58-49e5-9344-3659536e95a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259353, "uuid": "39cb6219-e617-4c0c-93e6-0e3e967a4848", "value": "e0121e8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f9a3ed-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259350, "uuid": "f817fa25-f939-4eab-98c1-f22fb434f65a", "comment": "Malware payload (Dridex)", "value": "51d9508a2ae2d77c41a90dbeb4bc524a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259350, "uuid": "fc379e6a-e5b3-4902-872c-6f7e06df0c42", "comment": "Malware payload (Dridex)", "value": "14b34cc804b989b0042b4bebe7d12c8cc74cff9b8b033544d055565e91c1f2bc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259350, "uuid": "8cb3d1dc-586d-4bd6-bf5f-24830420fa4d", "comment": "Malware payload (Dridex)", "value": "1c4742c1c56ed4e0e4c19c30fbd9992f67537863", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259350, "uuid": "11adb672-266e-4ca3-b437-2266a167d153", "comment": "Malware payload (Dridex)", "value": "79f1abfa3adc43927044bbf5f9af66f360f8e7cfeaaea4829520956a1d18e5a86f2d92f789f8882eb8c6d741a20af177", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259350, "uuid": "b1e0b4c2-83cd-493a-b77b-030cf4e45765", "value": "87F3C085DBABE8BFC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259350, "uuid": "2e33c8a7-f266-4c02-bff1-6de2631f66fc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259350, "uuid": "1b32481f-149d-46c4-84a2-23e2e3d03552", "value": "3072:Bt45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259350, "uuid": "445de532-9968-48a6-a5f9-baf2532a9093", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259350, "uuid": "3f6a9333-1359-4641-b955-d824608824db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259350, "uuid": "5e2f3451-ee46-4915-b04c-437299bd01e4", "value": "51d9508a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd25dc65-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320532, "uuid": "0793c482-a6f9-4b48-ac0c-954acc1f7c7b", "comment": "Malware payload (Dridex)", "value": "436e251e4f6af163e43f769970e5b531", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320532, "uuid": "d97bceda-0850-497b-846b-9e05f7721261", "comment": "Malware payload (Dridex)", "value": "14dbe92f6262c8c3f429106f9ca9183a7e4eebb29b1d06a2db8908621fc16ebf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320532, "uuid": "25defdfc-d7e9-4ab3-b8ef-d5303f6b5676", "comment": "Malware payload (Dridex)", "value": "a38fc7368bfbc36bd0810037158a380900e9d07f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320532, "uuid": "e5944e29-2ebc-4e13-8638-a9f6e26f3885", "comment": "Malware payload (Dridex)", "value": "4640351de0b2050c602148f2030f19a50fc7ad5de6dc181ec66df1b88109a3ede281fdde4c4ed068cec881adfaca21d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320532, "uuid": "f24c4303-525a-4ff6-b774-203d735bfa1f", "value": "1BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320532, "uuid": "1bc1ed2d-93e7-4103-b364-3f6b3dab4623", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320532, "uuid": "b94fa600-d28a-46b3-8d90-76701ddda91f", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320532, "uuid": "34097fe6-0676-40f0-8866-08a28858ebc1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320532, "uuid": "ab37dd10-21b3-4fe3-8e5e-481676989e2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320532, "uuid": "ff65c74e-5b77-4a54-974c-9358ceb0cf30", "value": "436e251e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adef24b9-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273665, "uuid": "d2604da6-7dbc-4013-854e-e22ad30119ad", "comment": "Malware payload (Dridex)", "value": "02c699f472a8cc4f25d404cb356fcb03", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273665, "uuid": "47a37f74-e67c-4a0f-8942-af07b6167200", "comment": "Malware payload (Dridex)", "value": "1502aef23f3f1df38031b444a88f4e970daee3368ca326f7fc75469a3b3455a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273665, "uuid": "28493cc3-df18-4b8d-bee0-ffec407bcd7e", "comment": "Malware payload (Dridex)", "value": "787c55ac285cdf3e26b27568197bf141f943fbd5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273665, "uuid": "3220a443-779a-4829-afce-4ed2e6608010", "comment": "Malware payload (Dridex)", "value": "df92c09fa183d603faf3ce622d10e255091a6e6748da910b89ccc300079e7024fa13aa0343ee171ce30348ae0047367f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273665, "uuid": "5482d151-1cd4-4196-afbb-335fb34c53bc", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273665, "uuid": "7fff86be-7323-45e8-a961-b1497dd6dd62", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273665, "uuid": "05d1435f-7a5d-4c19-bb03-172a6c543721", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273665, "uuid": "79701b84-9918-4f1b-94ad-f8dd57ab4da7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273665, "uuid": "c2d12971-4ddd-430d-b526-28ef9bf84a76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273665, "uuid": "1420c4ff-f964-420b-a4ef-3c0695baa8b4", "value": "02c699f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded1603-ae0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RanumBot)", "timestamp": 1620264591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264591, "uuid": "19700b43-0025-4fc4-8e7e-9823df9c91e4", "comment": "Malware payload (RanumBot)", "value": "37ca9b74109005095c1886d355b68880", "object_relation": "md5", "Tag": [ { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264591, "uuid": "ed4758e0-4148-49ea-a631-2d19d8f37bbc", "comment": "Malware payload (RanumBot)", "value": "152d5bc059d5aa9de0b3b617a4bee4e0536e2f2a32f14ccf877d175670d4183a", "object_relation": "sha256", "Tag": [ { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264591, "uuid": "7cb62edc-0a1d-4e54-9a9a-8f82fc4a7558", "comment": "Malware payload (RanumBot)", "value": "4c0f0de609c24d89087467c943c8bd47f347d2d7", "object_relation": "sha1", "Tag": [ { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264591, "uuid": "dcca731c-bd8f-496d-b79f-950af398420f", "comment": "Malware payload (RanumBot)", "value": "cbb13fad7e7e22b0300dd2273533ccf32ec88381d2a98a8cbec4bbdbb1396274a4ac1b2661867b9926d5c3292565ace5", "object_relation": "sha3-384", "Tag": [ { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264591, "uuid": "7ca1d836-0a6f-421f-ac2d-17f631b78ecb", "value": "E1068D50FDEF68F1EA435A3148B6526F2334A2098735EEC3CA449E7BE8579D10E32356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264591, "uuid": "8f4aa26a-6f73-4747-9bef-bca394b1cfbb", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264591, "uuid": "90454e7d-64c1-4ed5-a28b-a48ce654d277", "value": "98304:nxO9DBbU5+vYrIcyqXDxK1pjtsyEgUN3ohS:0K+aymqpjpDSyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620264591, "uuid": "71d014d6-ce45-48e6-bd4f-283908d454e0", "value": 3986854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620264591, "uuid": "7f274938-7092-4c77-aa8a-cbb660a06067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264591, "uuid": "0d9a6a9b-4c12-45ab-8292-fafe22d53574", "value": "ranumbot.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d721a20-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285448, "uuid": "6f5cc209-97af-4ce2-88b8-b6ac6ffd461f", "comment": "Malware payload (AgentTesla)", "value": "f297656281cabed29e57f8f6a3571d37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285448, "uuid": "f9895694-4443-4487-9516-751723b7b20c", "comment": "Malware payload (AgentTesla)", "value": "159b0e2dcd8b4015913a34e777e0ff465bf99f8f0cfa63e423b075b91a06efa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285448, "uuid": "1f9a5959-cc4f-4c2f-88c3-cd3cebb2e5ee", "comment": "Malware payload (AgentTesla)", "value": "3df2a3a7a52267ed410e929de389959e9947b4a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285448, "uuid": "0cbfc345-ab90-427d-adb8-2b76c99f15ab", "comment": "Malware payload (AgentTesla)", "value": "46a96d9da1ef599991361f31665bc0c42e0ea785a2443a13a7931bc32c9b5265ebfbdff30d95d9eeea7f09c71cb24e35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285448, "uuid": "0eb34b80-6203-4585-83f7-c9b34d156272", "value": "F435AD2262988924E13B63748462C13947F67E02E776D75C7AE87CDB3F33681DA67213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285448, "uuid": "b5dc8679-c979-4932-82bf-a53ddf19238d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285448, "uuid": "4b8507e7-d758-4fa4-b42a-f7cc461a3f11", "value": "12288:urOlp37Qno/bCS0Zi5lVQLN/BmxrW47j3DSI2fquCMtTUBg8qHmocSkM:uWnOrZifVQ7Xe3UCZMIqHmocn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285448, "uuid": "23e4e092-f65c-447e-9d02-8599c7673f0a", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285448, "uuid": "4f6f3179-7c2f-481a-88d2-408bb2960d0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285448, "uuid": "d59617e5-061c-46d1-a2a6-6c1f5b478da1", "value": "Consignment Document.pdf (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e813719-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339325, "uuid": "6db763de-b9b4-4253-adee-ec6eb08ed290", "comment": "Malware payload", "value": "0db05614b2a2de24221a3cea3de5e1f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339325, "uuid": "4388373e-7a23-47cb-877c-ffe733dc2fce", "comment": "Malware payload", "value": "16419e1c8e1b622ee7dc1821b551023914c737b1c9bf1b39bad958acc10a79c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339325, "uuid": "92a043ed-aab0-4677-b508-be7572ef049c", "comment": "Malware payload", "value": "04da870b833082f65441819d074a2d9f4ba07e4e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339325, "uuid": "e5f1fee2-fa33-4ac4-8a77-e8447bacd051", "comment": "Malware payload", "value": "9bb343d68fd8576073984405ed21120df11cb41d99580623255b67936aa086e39b29ae830b8b68911c60a4666d2fc636", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339325, "uuid": "e7de99dd-e049-4169-8b9e-b254de9ebf12", "value": "72F3C004D167E6D6C51A583322EA3B3BA6314150D748F885EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339325, "uuid": "5b19fe34-303e-41ac-a54a-f03bb9133945", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339325, "uuid": "e7a06235-89fb-4bba-a252-2bcc549089dc", "value": "3072:0+G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/id9l:0ERMVPG6+Y63HoG1QawL40Prx6Kvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339325, "uuid": "3b2c0968-aec2-4726-ae8b-b1f7e2de6039", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339325, "uuid": "1300b93d-251f-494d-a02a-cc049ae0048c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339325, "uuid": "0036700f-6f6e-4c62-be0d-14b948572d58", "value": "0db05614_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb23bd5-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338924, "uuid": "5b64246b-86f5-4c45-ab24-83c183bee141", "comment": "Malware payload", "value": "a57988f7a77c02d8ee3a1c094e20f170", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338924, "uuid": "5109fc80-6e76-417b-8baa-aaea13136eae", "comment": "Malware payload", "value": "165637773b41e566bcc299df9a911a078e8e26b0936ed640a3fb80ec77ffd0f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338924, "uuid": "bdd1802b-a0d8-4bdf-b916-e0d3f934fc0c", "comment": "Malware payload", "value": "9e4ba63aa10eb651c28d411b121493c70b3ce555", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338924, "uuid": "ef850adb-75b3-4776-a008-84509de1cbb8", "comment": "Malware payload", "value": "e757d2afc29c039336abdb4f4db9dc25ce001a94385b9b11f0b8cb18267c3da1a66593527ba5a19417d384587eabb252", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338924, "uuid": "15975dfa-ec38-4b42-b27f-d77e6ca01d98", "value": "43F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338924, "uuid": "044c7deb-1ec3-4c75-9285-8431c58c4e33", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338924, "uuid": "8935ed6d-82c2-4be8-8be9-25f87970d89b", "value": "3072:mLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:dERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338924, "uuid": "6ff342bf-0ba3-4b00-82a2-e49ae3f2c624", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338924, "uuid": "84e30223-25b1-4602-a80b-cf7378660ec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338924, "uuid": "94f20759-2b59-4103-a79d-663d7e29f986", "value": "a57988f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fca0cc-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "614efd8a-9a0e-49ae-bcbf-33c92452a556", "comment": "Malware payload (Dridex)", "value": "6f0de4bbd5ab3c43fd9911140fdfc75c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "4bbcb1d5-eb69-44da-9e0b-9e2b6a6d9605", "comment": "Malware payload (Dridex)", "value": "16df77c9cc8c4ffb64d45ab155e96ca7cdc3b0f7fb2bd8c26ac77eeed1f4946c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "6e9d1b90-baeb-4372-9528-efebf1fa52a7", "comment": "Malware payload (Dridex)", "value": "46e57e273ef423992ed10fe997324fc2e78559c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "2c50ed9b-d823-4690-8d82-5b0b704dc9d8", "comment": "Malware payload (Dridex)", "value": "9432a9031d215600e78aaeae20bdfe07e9277832e3b9895775357c6cbce5ddd09604ce4acb1cc2c4327aa2cb8d9ac60e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "4f4a5e35-0fda-4ce4-a8b9-b8f2810dc67c", "value": "92F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "46888938-18fd-435e-8ecd-5fd67f75f419", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "1ab273a2-c03e-4725-828a-424a715437b0", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316920, "uuid": "f124bd18-14e4-46ad-b388-9a91d46bfda5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316920, "uuid": "3deed320-715c-4ea9-a258-a82002eab7f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "a19f65b1-2476-4ca0-8efd-9d59c2139a5a", "value": "6f0de4bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd004e0-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338710, "uuid": "51d77f9b-ec03-430a-a44a-79af3be28f5f", "comment": "Malware payload", "value": "093ac042ec76efd1fe14eee49073bd3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338710, "uuid": "af69bfb1-d45a-4bca-8da2-55c596c00944", "comment": "Malware payload", "value": "17270883b8b911427e5ec7cd94fe60f8b30a80b61d5705a2a1be63d20ea60370", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338710, "uuid": "9deb03d1-0988-4529-b860-fada851ee814", "comment": "Malware payload", "value": "63b1bec516463e9193ad03c90b2937ac9b7ccae3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338710, "uuid": "fd159887-d471-427d-9ba2-fa97a8fad675", "comment": "Malware payload", "value": "c4375b181171e73b5b7115c819c4ce5fca44f9c049672722d2e94cefea4104375fa40dd21405b98aa06ec65f8ed1ff48", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338710, "uuid": "dc9e9998-4bb2-49c9-9913-e52966fbc65b", "value": "86F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338710, "uuid": "aeb31201-4760-42b7-9e73-7d913ccddc2a", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338710, "uuid": "e1f76c26-b29e-4215-b001-898c970fb417", "value": "3072:FjG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:8ERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338710, "uuid": "e88b8423-b9f6-4f1b-9432-8ebb78fe60b8", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338710, "uuid": "7aa9bc86-00c9-4b99-9d04-057edfbb90ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338710, "uuid": "78d7d4ee-fc44-4f70-aa08-1b8fdb761d99", "value": "093ac042_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c4457a-ae19-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620270966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270966, "uuid": "8b71c646-a978-49db-a7ce-0381a3be35a2", "comment": "Malware payload (RemcosRAT)", "value": "8ba405455cf8c6776dc01cce9faef2ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270966, "uuid": "e3dec07a-7c25-4b1f-9828-1d48a43093e1", "comment": "Malware payload (RemcosRAT)", "value": "17828f7e3aa63c317b04baf8c3dbd4e069c12f66f45ae438094ae17cb7f5c7b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270966, "uuid": "6f9cb1c1-5f06-41d0-8bc3-b21a2cdb6604", "comment": "Malware payload (RemcosRAT)", "value": "f8b3e8ae0c018abd50dbc7fa4d9e50760fdf32f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270966, "uuid": "8ec33ac7-b9af-4de1-9167-f10c52ddb798", "comment": "Malware payload (RemcosRAT)", "value": "17343279955f4a685d065ecb6afbe51960b94825ee3a66b6719d725bfc436c95a200e688f69470fb2b64cd16ca34cfd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270966, "uuid": "3e397816-1c90-4bd4-b919-bee1581773ed", "value": "F5F50B151EE7DB9271687EF42F86BE55929FF5FAAA30E8C84904728C071708E4AD0F74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270966, "uuid": "a0b8a27f-0f01-4049-8208-89fd793b98be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270966, "uuid": "4e5a0a44-a4cc-48cc-994b-c5295b040495", "value": "3072:fD8y9RZwPn6rEqibCOjMPb4rCZNwcyZNLFrH0AzCzw60OuAsk3+uGi/h+e918psP:fD8yv47yTh69tSdp5dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270966, "uuid": "75214931-a6c0-4e73-a1c1-fd691e5f5c66", "value": 3407360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270966, "uuid": "49f070b1-cbd9-4a38-981d-85cf3771428b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270966, "uuid": "830253b8-e55b-4012-b4d1-25c3289580e4", "value": "Factura Serfinanza085399218111227761873550570.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fc5486-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295282, "uuid": "e9d787d4-3976-4b73-b735-6dc4e68f67c4", "comment": "Malware payload (Dridex)", "value": "afbb944a31e1fbfcd05726a5cffe2985", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295282, "uuid": "0b4ea003-11ec-4497-a2f8-70a7ce8199a3", "comment": "Malware payload (Dridex)", "value": "17acdc632f34244417ed85ba3f1b3cac5abbc7ce4615a6e2a0fcab9a5f4d6f10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295282, "uuid": "cd81d2ac-12d4-412c-b45d-3917605b1982", "comment": "Malware payload (Dridex)", "value": "e1f51a5de338ba37bdb5c292eedc3f769aac8c41", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295282, "uuid": "fc0ee5f4-707c-40d4-9ea3-9f66e8ad2213", "comment": "Malware payload (Dridex)", "value": "8c072879c0fb35f97a1c309a397276c2b6e5d7a635070cb33ee7777e3c0b25b3ccd9102548598f8d3ef1eae87e661139", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295282, "uuid": "a85ecaa1-3018-4bd6-ab11-daad794939d3", "value": "50F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295282, "uuid": "15713f38-da93-4d85-9bd3-385b33b7eeb6", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295282, "uuid": "16463a50-6085-4421-b611-f54927cd524d", "value": "3072:nA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:n3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295282, "uuid": "04f5058e-5513-4047-af79-0fc76e22c0c1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295282, "uuid": "2ebd93fe-8bed-4387-b500-09961f791b0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295282, "uuid": "29b4762c-698e-41ef-9e05-2cb0c52a4ad7", "value": "afbb944a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefe3d51-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266499, "uuid": "d06c6a5c-b024-4d14-a30b-909748357dc4", "comment": "Malware payload (Dridex)", "value": "d61eb8d7f692d2a05f5ef81d56a087ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266499, "uuid": "2a3b2061-e514-4fd2-be82-c331b2ee6eec", "comment": "Malware payload (Dridex)", "value": "17ceef98a515975c9a52890e55cf37d197373df591b9badd4a219c95ca006c32", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266499, "uuid": "6640ea20-c51a-4c68-94e0-e38cf089f803", "comment": "Malware payload (Dridex)", "value": "5eb8e60ad0c48526c95281510fc39fb1f454ca5f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266499, "uuid": "b987c4e8-125d-494a-9206-43e6616332c6", "comment": "Malware payload (Dridex)", "value": "a07bd62afcf6eb46f739805f508c43e987e0d75bc536a990be2149bd6f2a736541ec569f8abfb4a538d041df88b178f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266499, "uuid": "a70f9ec0-f7ca-4582-8457-bf507616d3f3", "value": "69F3D088CBB3E4E6EFB3D37966F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266499, "uuid": "3a2aabdd-9671-4193-a02a-65c6ba50d368", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266499, "uuid": "121eaa1e-a6a4-49a2-bc7f-de05af48fd96", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266499, "uuid": "5e82f377-7912-4b25-a844-5da600279509", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266499, "uuid": "209cf045-d137-4b26-9c19-e727943961bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266499, "uuid": "2f959192-80a9-49df-8b62-ca381939e62f", "value": "d61eb8d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fe3028-ae4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620292524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620292524, "uuid": "a152109c-dffc-4316-89ed-007675210102", "comment": "Malware payload (Stop)", "value": "5f1fd29052e8377d5e739cf5adb62735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620292524, "uuid": "0a8e477f-195d-4742-958a-11872928e8f7", "comment": "Malware payload (Stop)", "value": "17d78ceccf9fd168bf7e1d92260e5369bbd058639587ab92ea78763aafe0e5ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620292524, "uuid": "fa7ef36e-ff6d-4cee-b3c4-1dc66043a3d8", "comment": "Malware payload (Stop)", "value": "c5bce621d36cf186d831648e08eb622c61a13a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620292524, "uuid": "a458d929-4f26-42c5-9fcb-bf70d59371c0", "comment": "Malware payload (Stop)", "value": "b4d2a6bb11e51100b5d8d3472c24cb76a11cb069b41073eb03b0aead835dc6e7c22afff46cbfa2f13ed0a14807b585a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620292524, "uuid": "cbfe80f5-6f1f-468b-a5fe-b52c3ba16323", "value": "FC150211B180C43ADC0328319965EBB48EAE781252715D7F7ADD39FADF34691BA3630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620292524, "uuid": "2fd3f615-cbfa-4030-9bd3-99c6e9287a7b", "value": "ef8bfa67cab8f52c3f5ca31f772f6178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620292524, "uuid": "786ddf30-ce38-41fc-908c-dcce7f77b57a", "value": "24576:QfxZJdSzr2WfQc/fMwk7WpWt5N41gellzy:GI/ucMwk7W4t5N41/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620292524, "uuid": "3a0f0e57-b779-4d72-b3d2-cc54ddfc2d15", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620292524, "uuid": "e6a2941e-d970-482e-bad7-bca2e805c0d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620292524, "uuid": "222390fd-2c37-435f-be49-006c78a22e0b", "value": "5f1fd29052e8377d5e739cf5adb62735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc5664c-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620310443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310443, "uuid": "2d614540-8b42-4d96-8c3d-424a2c8aa087", "comment": "Malware payload (RaccoonStealer)", "value": "f1c6fd7daec2172416b97e4194a561cb", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310443, "uuid": "3dbbb4e2-5417-4024-843e-0f32dc8e31ae", "comment": "Malware payload (RaccoonStealer)", "value": "18c27b85f26566dd782171e00ea5b5872546b23526cca0ebb185caca35fdec93", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310443, "uuid": "affbac0b-a913-4185-a023-51669448186d", "comment": "Malware payload (RaccoonStealer)", "value": "526fa48cf911e1fa03cc55e7d91f1fc38afc3def", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310443, "uuid": "559d992a-a469-451a-89b7-2681c244e54f", "comment": "Malware payload (RaccoonStealer)", "value": "b5a37ed585576d5681d4cd6720362c5fe6e4c2028c92d6dd2b89801ff117823514ef10dd2015b42d7516472fab5a8f28", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310443, "uuid": "f5395b65-ab54-4d0e-826c-32344a614f0b", "value": "C2D4F1117181C036DC3704B64C25EBF14E6AB86256211ABF7ADC3DFAEF286D1772630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310443, "uuid": "963bed63-a5c0-4f5d-ade3-3210a5270a10", "value": "f7ec5170de034aa3644c4457a2b957d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310443, "uuid": "c999cc73-469b-4c68-92e1-aff6536e80df", "value": "12288:FqFVrhGBUIk+hg0ZsfHtpEHSXPb3+AbLGbzmr:F+VroBUIk+m0ktpEyXT3+AbLGbzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310443, "uuid": "82b87cc7-ce9a-4b62-bded-530ccc57c3c6", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310443, "uuid": "3a1bf154-8213-4af0-b6d0-f30f90d2420f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310443, "uuid": "2d7c8ba7-61c4-4d28-a88b-588bd3e94d2b", "value": "msoffice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd749db8-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620320559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320559, "uuid": "db8f09fc-1af2-4ef7-831e-e36b7acc58b3", "comment": "Malware payload", "value": "3ac831b4a5d480d6cc4834bd7051086e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320559, "uuid": "b3ccaadd-63e6-41c9-a0ef-bb57ce718525", "comment": "Malware payload", "value": "18ca145386b7d8df710c92536d5e7b3255e76d5b751cf9aa3871313d92631b29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320559, "uuid": "b4c5f620-532b-4348-99f3-9f2ea260210e", "comment": "Malware payload", "value": "2578f5c4344f1354e08762311e3376db25ccd400", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320559, "uuid": "1055aebb-defc-4b67-ba46-a8e4244d1171", "comment": "Malware payload", "value": "5fa925667585c41f53ab22699b4b63149b24f294fe47924bde225e3e740771d515d7641779abaa5201d36be6ba1c3835", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320559, "uuid": "c975ac14-a262-4661-b094-657cde255a01", "value": "799302BA39671E70616C051A4A5CAFC336884CB3990E5DD8F703FACB12796A849D0F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320559, "uuid": "0a840b5b-522c-49e2-9b61-d62f1d86e47a", "value": "1536:J1GIhSZcqGa6ALKJ1Gp2C9FqLI10drRjpdxjdqcNhC26Fn0QzokK:7GIhSZcqBL2Z8ArRjpdxjw8QnvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320559, "uuid": "31d52062-d133-4e0f-8c4e-814687bce544", "value": 93681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320559, "uuid": "f5465a3f-5927-440f-85ca-ef68ace092b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320559, "uuid": "573bfc7f-d473-4821-b78b-07a6bc44f110", "value": "3ac831b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c620c04-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338892, "uuid": "d5332417-01d1-4432-801e-11465d53ae32", "comment": "Malware payload", "value": "e245cd488491a42dbc288111513bbecd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338892, "uuid": "0d5737d6-36da-4c52-9d4f-e5723694b449", "comment": "Malware payload", "value": "191559d34ac89295e58b1b196fc9915189518b593ed17e5df65b8bdf724664e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338892, "uuid": "da8d7ea2-4260-4a33-a7d0-b57e0055aa66", "comment": "Malware payload", "value": "446f9426df267851cb861e1006b6d1d3e7b153a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338892, "uuid": "163ad0b5-e02d-4f85-898a-d1730e1fef12", "comment": "Malware payload", "value": "5a17fbdbb8ba78e180dc3143bda5c23bcfa64f4e778333d6299d24263f2ca4adb72bb900d95c36008c9be06e8a8bf0a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338892, "uuid": "e65a41b4-a4d5-4725-b1bd-60e1a5d0316c", "value": "DAF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338892, "uuid": "9121a8f4-2420-4cd7-8624-373418836a39", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338892, "uuid": "aefd3ca4-d713-4e8c-9fb4-0c9fee171aa4", "value": "3072:qiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:SERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338892, "uuid": "c93d9594-5e82-4b67-99c5-0bd042d3c3cc", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338892, "uuid": "62707525-2f18-4958-95d3-2727a0bad77c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338892, "uuid": "700cbfd8-049d-46cb-83ea-f566333e0cb9", "value": "e245cd48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a223f3-ae2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620278672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278672, "uuid": "7eab5e0c-0641-4a2f-83a2-8b75123440b3", "comment": "Malware payload (Formbook)", "value": "f1564a3a6e6a3227169d136c2652eaf2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278672, "uuid": "c36c7ed4-0183-4e17-853a-dd89b39ad569", "comment": "Malware payload (Formbook)", "value": "195f8028bfd632ee22ff9c3e25de3b118f0847fb21fbe91ba722ecbbfa5f2869", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278672, "uuid": "99825246-67d5-49cf-bb55-617e8a415eb0", "comment": "Malware payload (Formbook)", "value": "6c17ecc0377cf31207087f53cf4228ed98939d3e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278672, "uuid": "ae2a272d-f2b3-4fff-b0d3-d636c715c54b", "comment": "Malware payload (Formbook)", "value": "e24e4c6fb5e1442d98e82524c0530da511a377c7dd3125896cd53d9233b1149e386c25e38317d5cee6325eebbf95e993", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278672, "uuid": "615fd791-0dfb-41c8-a217-1621bc5fc47b", "value": "61053338DACF2296E15DF353C2EE904BDC9CB9473ABEB76E9F51158C14492AAC6CC005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278672, "uuid": "4fd33cc3-5d8c-490d-b96c-381b839e1e24", "value": "12288:x0hcNg+Mb8rVfvy/HJ/eY5cjU34FL+n9yPpANtmTpbgAbrfwTRuRDwqRikpuiybl:x0nPAr1e9d5cjDN+9aYtupd/fWRuSCyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278672, "uuid": "e292288b-8fa7-4121-bc75-641dc8fa5cf0", "value": 823844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278672, "uuid": "8f138e80-dcd9-49b8-9739-d8f773dc5ac0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278672, "uuid": "f5ab3369-da1a-4eed-9443-f4264e4af56c", "value": "PROFORMA INVOICE210505133444.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e239a4f1-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284490, "uuid": "03551f48-690c-4e8e-b75c-06949c2d6192", "comment": "Malware payload (Dridex)", "value": "467edcebb99a4416b991d5d1508d9c45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284490, "uuid": "d803f505-6925-49f5-aef7-914ebda0b088", "comment": "Malware payload (Dridex)", "value": "19719ecb81486217fdc82dc7fa3cafaf79593823fc1e7f096b785b28bc1d435b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284490, "uuid": "ac4c9907-c8c6-411e-bb47-23f6d0c8f5c1", "comment": "Malware payload (Dridex)", "value": "9ab84a4b1a1d7a5225482c594dee652de8bc97df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284490, "uuid": "16f2fbe6-a0a5-4476-96e4-d7cdf73ee811", "comment": "Malware payload (Dridex)", "value": "c5fb31c71e18db056ed5c23f60201264c57cb327c05434edb7e0281b1c0d9ca46d9e86f4ca11c1531204134f40f00690", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284490, "uuid": "7865a6a0-7b2d-4c30-b448-6da3b8425859", "value": "65F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284490, "uuid": "55a38f52-277e-45a9-8e07-6d7e8a6f3ec2", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284490, "uuid": "3148bdda-41c1-4480-85ea-cf80e4e87cdd", "value": "3072:KB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:T4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284490, "uuid": "7a7926a8-23f4-43f0-8c6e-f11ff66c0929", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284490, "uuid": "522e02de-03d3-4bfa-8dbf-5568d652f40c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284490, "uuid": "2379329a-2ae2-477f-8e38-e60e03e88048", "value": "467edceb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3a09dc-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270070, "uuid": "38e9ddf2-ee44-40cd-84ad-b6e23767deb7", "comment": "Malware payload (Dridex)", "value": "08e2ce280ff4495e0cf1b8747efaa524", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270070, "uuid": "609d382b-72c6-4dca-b174-445b591b5be1", "comment": "Malware payload (Dridex)", "value": "19c325f3a13a417daa67658a75b19f2b8fea866ee68453f8b35797a7b43fa4c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270070, "uuid": "fc309913-bc37-46ae-8ee1-874e809d22e2", "comment": "Malware payload (Dridex)", "value": "e4726794140fed3885eed3bd04b9cdb56a2fb891", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270070, "uuid": "c6fb60cb-641b-4144-ba9d-19fc550ef4a1", "comment": "Malware payload (Dridex)", "value": "652e4c392f20c3d77a179dad409f1300e3770cc691033a4ce45dabe84624e40c12c968ebfcf2940685314418241ea1b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270070, "uuid": "832570a1-4f60-4b93-a58f-2c4a5afa1060", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270070, "uuid": "bd4691e6-448d-457c-b3b1-f0a97d851e9a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270070, "uuid": "7c31db34-271c-41f9-8c02-b8af231947bc", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270070, "uuid": "4a1896e6-5ae7-4d22-9077-644e53edf7ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270070, "uuid": "e6607a5a-2036-4ade-8596-168e0b5d7c06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270070, "uuid": "9455fb0e-b4bb-401a-aeb2-160b8e507c69", "value": "08e2ce28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1012ce9b-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338683, "uuid": "7c82e8fe-5d94-4f2e-9f7b-7201caf2561e", "comment": "Malware payload", "value": "838b388220c100eb88d04b05c869c7a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338683, "uuid": "3506386d-b4fc-4938-bbdb-a00153986e93", "comment": "Malware payload", "value": "19e9a6d63d79198846564344d05e9a9d3015733c673a2e4e45897cc1ac630794", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338683, "uuid": "fd4a2747-01d4-4b42-ac2f-2a1451f0fe21", "comment": "Malware payload", "value": "fab5129676833080cbe1fd9598275122a1e6cac2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338683, "uuid": "8cd24dbf-40d6-4632-85ce-2a96dd1cb415", "comment": "Malware payload", "value": "60db25b30846a6f8a6c08f6472c0709e0d3b19c7c5b29ac7b64e2cf5d15779922ab78059ae467436bf2d0fad4b49f7d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338683, "uuid": "997c2325-db5b-4335-9f9a-c5cb3b3781af", "value": "9FF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338683, "uuid": "b1ecb3b5-b41b-4fa1-9b04-3694d852a34e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338683, "uuid": "1bb36e97-123e-4ed3-9a6d-d6752d6ef780", "value": "3072:xB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:P4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338683, "uuid": "1a475dfe-c71f-4da8-9e54-9ddec8800eb7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338683, "uuid": "4991719c-de13-47c4-a0cf-cb1d567b1818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338683, "uuid": "01e7a8c8-045e-4dfd-be17-5aa6ad046584", "value": "838b3882_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50a0fdb-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320572, "uuid": "d5c694de-820f-416b-aa8e-2281c27d3ef7", "comment": "Malware payload (Dridex)", "value": "48a7f01310d5440a451f26b02e8e8bc4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320572, "uuid": "95fbc00d-b435-4dc2-9b15-b2e5d3c5fc2d", "comment": "Malware payload (Dridex)", "value": "1a0cd6bc5a399f7d6e525b8f1678114f0b91affa3be2ac66ca0728ca8d654079", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320572, "uuid": "74cb98df-719b-4875-9b1c-9083ceeee27a", "comment": "Malware payload (Dridex)", "value": "7183b5db805615ecfcf5ad0344672e37954fa96f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320572, "uuid": "3d17b6b2-c5cb-492d-9b23-3c5ce79b4afa", "comment": "Malware payload (Dridex)", "value": "b4e6dd94a4ae51e22dec2212b77c72ea306fdd6280f5ed21aa8c11fcca48a31c22b18dc06fe4e8147815035847303e52", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320572, "uuid": "33583282-6a49-4895-acf7-2420403ece0e", "value": "3DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320572, "uuid": "f57fd8ad-2063-4daf-8b3b-b15d593b8329", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320572, "uuid": "700730f9-f0f8-4337-85b4-040190707e3f", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320572, "uuid": "e9438687-e87c-4565-940f-e294e13e96de", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320572, "uuid": "21192505-0844-4c27-8232-4bfbbbe83ab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320572, "uuid": "36686a5d-838e-48f7-8bbc-abdecf38e784", "value": "48a7f013_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7467b72-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339044, "uuid": "003dca5f-c51f-4831-bbae-c12516486d8c", "comment": "Malware payload", "value": "1f8b2a77712237ce9dd49769c7054093", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339044, "uuid": "3dad08d5-be3d-4f3d-90e6-4b474c033468", "comment": "Malware payload", "value": "1a1ee552840822959d4fb06cd4fd5c6ad3bc8d46b18c351b2c8ae2b8ba173904", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339044, "uuid": "8a98070e-ab2a-45cc-b41e-97a288541920", "comment": "Malware payload", "value": "3633c40e88808161dbcd32881c155657cc83d913", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339044, "uuid": "b79198f5-4957-4efe-9654-4d0f5617669e", "comment": "Malware payload", "value": "813fc13ec3a559402be326a362c7bfa1af8674fe23131f8ea568f793ab0115ab16a6b3343cc6fea4349a7171257daf92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339044, "uuid": "71975286-88ee-48c7-8fda-fd5abdefa8b0", "value": "D6F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339044, "uuid": "6d64fbaa-d866-4eae-be2f-cc6cbd367a7a", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339044, "uuid": "8a6e7bde-60ef-4f25-9146-d69b372cf438", "value": "3072:FEG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idOJ:lERMVPG6+Y63HoG1QawL40Prx6K4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339044, "uuid": "0dcbce8e-54ac-4f77-94a4-5abb4a24c679", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339044, "uuid": "80c83425-c3ba-4763-a7c2-d3c04c32157d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339044, "uuid": "87ee96f5-2cf8-4ec7-831a-1a8193c915ca", "value": "1f8b2a77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0d7186-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620306194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306194, "uuid": "65e9c1a9-e147-4c3a-a4a9-1b31d0c42a74", "comment": "Malware payload (AgentTesla)", "value": "ddaf0ebc48a8af23da9000011ce82c4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306194, "uuid": "e7d84b75-b7f5-4e37-b5d9-1478ff20c5cf", "comment": "Malware payload (AgentTesla)", "value": "1a3c8d4c234d4766225d3b266d3287d2412c1f7a7349456490971fdd811ce5e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306194, "uuid": "c3b3cb5d-d99c-4f40-9909-de069aa129c7", "comment": "Malware payload (AgentTesla)", "value": "8a5d850baa9413334775bc94c23d7d316456ce8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306194, "uuid": "f3c6398c-2fd3-4093-8f9e-ea5694add25e", "comment": "Malware payload (AgentTesla)", "value": "5584e558907a45cd1dc0364d161097497614c1d601caf61cc2741f71b18d16d76a90cd95c52f3af073666301d883e588", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306194, "uuid": "eaffe61b-935e-46b3-91e6-2cac70cb01d8", "value": "C9540203BD0993A2E8E1AF77E1D305410775EE627027F25A2888F3995E33FEE550A746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306194, "uuid": "f68481af-e78f-450e-b440-94ab55ba099a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306194, "uuid": "6ee4d504-426e-4ae6-a61a-3b34e9e502b6", "value": "6144:pTj8QLIzOpFdZ96syc2dzRdXu123BM4kcuj9Tz0ahS9UKBLgeRqNE:p3IeFdZ969CYdkc0VYEDSg/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306194, "uuid": "9f0d6a95-b6c3-46d2-86f5-3c2d3e096cc6", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306194, "uuid": "b3eec597-d2fa-4ee7-9d74-c04eee30075c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306194, "uuid": "c52d4d1f-6086-4776-b9bb-433dddaabf9c", "value": "ddaf0ebc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8f5316-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620313364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313364, "uuid": "8fa1c6e9-659e-4bbf-9289-378a07a87042", "comment": "Malware payload", "value": "e77f929062d3194063146d9d856f2197", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313364, "uuid": "be7f7d0d-6f0e-4aba-9ce5-34643f3d1550", "comment": "Malware payload", "value": "1a5b75f5e2a29346d20c5019d030af05cf77682c5cc2d892184c9c4bd463c3b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313364, "uuid": "bb1ee5c7-a6e4-4a1d-9ee3-f4f92d413bfa", "comment": "Malware payload", "value": "794bbd86be1ee39f264206b24435ca063e12b2e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313364, "uuid": "032f2fd8-d328-47d5-80ca-c4bb12f16724", "comment": "Malware payload", "value": "035e9b177a8ae85e9bb513b7f6b5d668f17fdbf583400f29b9383d326387eb36a081b43913247c7ece85ec7c7dfd37b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313364, "uuid": "bc7b83cb-fd78-4b90-a7d7-ff70da9e6a69", "value": "FF542398042DC2214C81B6B49B399DD3FDC20FD4C745A65B1C1EE1AAA8274B9771BDFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313364, "uuid": "6629c3e2-fd8b-4edd-bc99-f457b5231619", "value": "6144:/IRZmGm4Xf0qDiXppOI5f/Ra9ssws1HkOC4QQE3N+Y9:QR8NXqD6pO4RqrZkWy3N+Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313364, "uuid": "fe902502-755f-4ae5-9d98-aaedee0fac02", "value": 289938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313364, "uuid": "9b3561ef-e055-4569-a8c5-f4f31c46bda6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313364, "uuid": "e30f6985-1b9e-43e5-894d-eee92a5302a8", "value": "e77f9290_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fedd07c-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270098, "uuid": "7bd5a6e4-5da6-4699-a684-4cdb41e0da14", "comment": "Malware payload (Dridex)", "value": "335b49f2187d3a9b8657319041089373", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270098, "uuid": "bb231cbe-8192-4be0-9352-4a50097b3bed", "comment": "Malware payload (Dridex)", "value": "1a719b7803ad5d7085abaebe3b8e3911740e615fbc126d0a23b27f73113fb03b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270098, "uuid": "4a4f5e21-ce3e-4f52-a128-8c629eb11ddb", "comment": "Malware payload (Dridex)", "value": "178ffd5f63d3d356693424f5710583742c934ec4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270098, "uuid": "3145a9ac-71e8-4e0c-b477-8b45b4b74b17", "comment": "Malware payload (Dridex)", "value": "669109d1986bfd9e0edd7d145315f5b6f13ba1fda493e79d51ae36691c61376e24b3d6efc9b61eca2994bb47513067fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270098, "uuid": "88fa9e4a-3c73-4de9-aeed-d3594bcd2c4b", "value": "C8F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270098, "uuid": "91c021e0-9254-4a44-a4af-c204a2e2e205", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270098, "uuid": "1dcedd4f-2074-4fa4-8157-20a4d1eca056", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270098, "uuid": "1990e84e-93bf-4f65-9da3-b38582278ef2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270098, "uuid": "436ca5b6-6450-49be-8781-1ff6ddd33648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270098, "uuid": "ac053c99-b563-4753-b307-f365b9666634", "value": "335b49f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29373e4b-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620306084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306084, "uuid": "02594c05-4117-4d7f-b972-4d9f54b13720", "comment": "Malware payload (Formbook)", "value": "7c1896eeb884021f4d74144ec78be2e8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306084, "uuid": "2f0690c2-14be-4a68-82d3-370f6897dd0e", "comment": "Malware payload (Formbook)", "value": "1ab3c31624f7aed4e2ec9feecee3cff24e8904709800508e13b6526369e02236", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306084, "uuid": "00dc4571-6ab1-4b9a-95fb-7aea21a0d026", "comment": "Malware payload (Formbook)", "value": "b4fb3b31f69fc5b048eeb43ea6f8fd97f1fb8f7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306084, "uuid": "472c9ef2-ce33-4561-9c17-0d7378ca89cc", "comment": "Malware payload (Formbook)", "value": "b65b5e3a91ae5d4029e35d9ad5bef4a96e0500cc7bc72af9d3111107ce2c30e85b39a6fcf7602523da00b0b687c3c6eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306084, "uuid": "047f3fba-401b-4e32-abdc-5243a0300e01", "value": "1DF4AE25E3D08433D5AF1A344C5BB6B55C26FF002EE5B8896BF82D499F396817C282D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306084, "uuid": "707eb59d-331d-4100-925d-0c436bf4efe7", "value": "6b1c05b0b684805cab835263a8e57edd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306084, "uuid": "d0fdd65b-8a8f-4408-88ae-3b0348287377", "value": "12288:fo5FgaAY6Lwp/38cRQAr/sCu76nHqRAHqb2wrLSU/Oy/k:fv5rwp/Mc+AoCW2quKNeUD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306084, "uuid": "27167d02-57a4-43dc-8cff-1773058f3d77", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306084, "uuid": "2a9e3248-cd37-494c-8721-2efba0dc2ea2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306084, "uuid": "7c614152-f2e5-40fa-a82f-7bfbd1818f3b", "value": "7c1896ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d845f35d-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273736, "uuid": "a724be61-9bb6-4df0-be48-1722fd1cda96", "comment": "Malware payload (Dridex)", "value": "7eb8604a49a350b6e93795db4da2c44a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273736, "uuid": "612175b4-ed92-47b3-92dc-7614545ddd3e", "comment": "Malware payload (Dridex)", "value": "1abcedd9f5c928d4f929b06dc686ea4e575310f433b0111d2c36d8a23ba7095b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273736, "uuid": "6d32fadf-27af-47a8-a1cc-46bfe34c1742", "comment": "Malware payload (Dridex)", "value": "7fc48e97abc1c267317f5b2cc753e49ed229ad87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273736, "uuid": "ccb55b90-992a-4346-9022-ee16ee217322", "comment": "Malware payload (Dridex)", "value": "39b4e1983cd704f3be27fa509f451930661bc4e10263629e8d500222d5d99c3294b40e076981780824b7bfe403805e5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273736, "uuid": "5f725750-d154-41b1-b687-c450cb43809f", "value": "98F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273736, "uuid": "0139439c-2ceb-4725-8271-2e31dd1bcf0f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273736, "uuid": "5409a63d-49e7-4219-b95a-50d70ec61396", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273736, "uuid": "38cbb713-a848-4d6e-8271-ef0e0377338b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273736, "uuid": "aead46a0-b0b1-49bd-a599-6ec30acdb3e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273736, "uuid": "245701a4-3f99-47d1-b0b0-ccc331096d11", "value": "7eb8604a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1eca370-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291683, "uuid": "5f7caa3a-0f77-401b-8148-8b8faeb12a9e", "comment": "Malware payload (Dridex)", "value": "579bc7035c9f2541c3b9d16cd6de0720", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291683, "uuid": "df4ed032-041e-48c3-a3d1-ad7a536a65fd", "comment": "Malware payload (Dridex)", "value": "1ad438b8c3155a4612b6238cea5789f7c476a4b02649840dd442dc4c0afb6ff2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291683, "uuid": "8ecfcf76-c137-479e-aa7b-e0052b2d39f0", "comment": "Malware payload (Dridex)", "value": "41b14e323b27fc3720f05120c08394b797d50e51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291683, "uuid": "5c49c23f-cef2-47d8-a3ed-fc28c28d2de5", "comment": "Malware payload (Dridex)", "value": "957e029df208b70fa21346bb45442508c426b0a896b5ab23fa9cdecd007791a72e65ed618f8115d00c6767d3aaa2dba2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291683, "uuid": "f0404256-652c-4d97-bfba-731c856581a1", "value": "0DF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291683, "uuid": "a96059d0-84ca-4015-8b52-de075f664cb4", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291683, "uuid": "43bab34b-a50d-4ac6-ae69-a1157a13ba73", "value": "3072:YB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:x4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291683, "uuid": "0fc369d1-8978-41c8-8799-9b9620ac27fc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291683, "uuid": "1ca3ab56-e822-42fe-9899-da76e36d164b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291683, "uuid": "b5e22ce3-ded4-43c7-9038-24dd2051af23", "value": "579bc703_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56469458-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259344, "uuid": "31a9ffed-96e6-4c19-bdd6-32a1bbbea322", "comment": "Malware payload (Dridex)", "value": "485d6042703ac771165da27ae8f28859", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259344, "uuid": "227e3368-d927-4498-862b-71bfcbf8bafe", "comment": "Malware payload (Dridex)", "value": "1ad505009dabc6715b61d950eb7d96fda4ba77c98dce90d4cd199dce379f561d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259344, "uuid": "d0c9b9e0-f570-4c31-b96c-89cafd3249da", "comment": "Malware payload (Dridex)", "value": "69002d6c6db2ba5bfd6a2007b50fe697910619e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259344, "uuid": "52e4ee9f-faa3-42f1-8016-244a89a8642a", "comment": "Malware payload (Dridex)", "value": "46743c5a0f62bd762d9b24c86af41bed6ca236597d32f5939f00039b14b06a75e07b515ead35e1748b715638eebc1114", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259344, "uuid": "6be8c096-4cad-46cd-9af9-20f81ccc95d7", "value": "68F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259344, "uuid": "0935fac5-0fd9-4c98-9616-b44de24ce4e3", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259344, "uuid": "1cc43507-2e5c-474e-a31e-05afa1762f77", "value": "3072:/A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:/3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259344, "uuid": "62788b27-daa3-4cdf-961d-a10a9bae0287", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259344, "uuid": "5b2362a4-0bdf-4d1d-8f9e-d23979082456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259344, "uuid": "71f83ed4-29e1-400b-966d-72b4f26dd9af", "value": "485d6042_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1586120e-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339122, "uuid": "4f1b2d86-0ea8-4f7c-b0c2-c316b12138ff", "comment": "Malware payload", "value": "d978fc027acc8dc9581c27a72c99331a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339122, "uuid": "3df19f3b-e537-419a-8760-159615b825f7", "comment": "Malware payload", "value": "1b013ab1d1fe33a1a1cd5a15f8d2ce72ad6232827f60629e3062e095398201fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339122, "uuid": "df2119bc-57d5-493a-9ae7-6bacb41b942a", "comment": "Malware payload", "value": "77e3e92d1097681188cce70aa3575a40854aaaa5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339122, "uuid": "4abab7ab-186a-46e3-bdc6-11f01a97ce9f", "comment": "Malware payload", "value": "b5b3f82c31d5af9b1a5778b9f7e83a33133cbd3c83fd44dbf8853c1b719aff367945b712162b13ffd4902c2c1c30690b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339122, "uuid": "4d94d2ee-6b49-4ca8-95ad-c38613841af1", "value": "23F3C004D167E6D6C51A583222EA2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339122, "uuid": "7563415a-90b8-4031-bdbb-f8fd7cf7d331", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339122, "uuid": "2dc9fe27-7464-4f30-908b-50046df66f14", "value": "3072:TOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:BERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339122, "uuid": "8ec79c0f-0045-46c7-99ee-e12a775cac62", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339122, "uuid": "d130a5a5-ec83-47be-beae-b8e449aa6043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339122, "uuid": "362dda5c-36ab-4233-99e4-8e758edb84e2", "value": "d978fc02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88142a18-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620327718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327718, "uuid": "7abc4ea5-785c-436b-8218-aa7d423ef0aa", "comment": "Malware payload", "value": "a1f07f22e32902cf1c2493e3886e4ee6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327718, "uuid": "d42fccd2-156d-4f01-b81d-3c416588136f", "comment": "Malware payload", "value": "1b61d75451a001135e801d87d846f97819c3bb43419d95bacbe5c5593632ffc2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327718, "uuid": "2b9f7854-d5d2-4b5b-87f3-0f5656a7c1ed", "comment": "Malware payload", "value": "af0d2e3e25b4c406b6f43585a66b2b2e7a4d527c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327718, "uuid": "1b3fd526-997c-43a7-aa59-05a6a188366f", "comment": "Malware payload", "value": "8c5811256564005a35431b563bb202f6abc7a4c60da89dac29aa02617f232303069e054b51d2c051ce0c92769d1e355a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327718, "uuid": "a480e773-8569-4255-89ef-386988e20b7f", "value": "645108E27992B528775F1AC2AC3EE09E6C315782AE01D0A9DD56D8183DA13548F73C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327718, "uuid": "0ae6f0d8-596e-494e-b86e-1f4538607c5f", "value": "96:AvMV751UW4CMczgDb9wmPTa6/TYm8Ci0b:LF4o9Qa6/sm8Cis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327718, "uuid": "8c5cc4a9-091f-4e1a-a27e-5cf3ab314b62", "value": 3167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327718, "uuid": "8c0af7d9-8bc1-4b28-8c16-a1121e390cb1", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327718, "uuid": "dbd5eb4a-3d6c-4897-875d-39ac430023c1", "value": "a1f07f22_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e9122f-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339169, "uuid": "88f7614a-5c45-4541-ae0d-976072db529a", "comment": "Malware payload", "value": "98ab80ee74950d978430e057115773b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339169, "uuid": "13cac564-1fbd-4882-ae20-ace981b32fb7", "comment": "Malware payload", "value": "1bdd4f23b13701d55efdf35fa6972f52516b2e09cbc5fd7cd98bcc75c60bebe9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339169, "uuid": "2d606e27-c47f-4b0d-92a6-3db6dc07c30e", "comment": "Malware payload", "value": "0d375b716fcd618e1ff849a5730ec91823f080e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339169, "uuid": "ba3154ee-110b-4ef5-9f74-437fc2d367f1", "comment": "Malware payload", "value": "b90c3cdda34c5eefe4e0186bc390341aa0926e4ce32b68d54147e87e88a7b1e1e2ffdeca9c5831192e35b2525d284992", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339169, "uuid": "c6e20188-a05d-4a0e-b369-78de9f51bc8f", "value": "B2F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339169, "uuid": "41f2fd5b-6efb-462e-a83e-b2b832cf5e4b", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339169, "uuid": "484ca99c-5548-45ac-9702-78f552e0b871", "value": "3072:qEG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idOJ:oERMVPG6+Y63HoG1QawL40Prx6K4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339169, "uuid": "e9202bfb-b36d-4c9b-a79d-cc040c6de1ae", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339169, "uuid": "73637cf6-13a1-4c4f-b4ba-c16d2015aaa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339169, "uuid": "91bae708-3ca9-4a6c-8c29-c3ebf50d0fc5", "value": "98ab80ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1a7cd1-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339192, "uuid": "9f0dda7f-dffc-4108-b3fb-249f802a9717", "comment": "Malware payload", "value": "8b3a29dc61ccb4c9f80b9efbd2b69863", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339192, "uuid": "4a02c16a-5266-4a40-ab46-5f972bae5a21", "comment": "Malware payload", "value": "1bf3c2f1728e11bfd80c443ef6ac50a1b99bea72d534a5f3b65dd25e1819f9dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339192, "uuid": "786aefab-3103-478a-b5bd-021fd6dd190f", "comment": "Malware payload", "value": "176ab47aaf8e6f0b3d3e7402add5ec2474c3eb17", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339192, "uuid": "9bf08f28-0ad8-4d9d-8fa8-c4483c657b5c", "comment": "Malware payload", "value": "a85028c7ec251e7e2a0e802b278c63b8e8c676353dd348f68427222a827a51d67d1ac0fa88147907ab5923ef957df56d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339192, "uuid": "89b99a67-a61b-4bfb-aa63-95bdecb740ba", "value": "84F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339192, "uuid": "9d54a3ea-e513-4e72-aa20-0b7b8ee04a59", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339192, "uuid": "821a700a-13aa-415a-a341-f8e37679f22c", "value": "3072:neG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idDf:lERMVPG6+Y63HoG1QawL40Prx6KRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339192, "uuid": "bf12da09-2fb0-4e15-b472-1ad6dadf070e", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339192, "uuid": "3a7b1399-d5de-4431-a39e-59fe29f6663c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339192, "uuid": "3ea37845-55ea-4a1c-9d0e-ffb48c080442", "value": "8b3a29dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9838fe3b-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338912, "uuid": "8f6a9685-653d-409d-a624-a970cbd65b60", "comment": "Malware payload", "value": "d5a0db3b8ae640bfbb2aebbeda8efe5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338912, "uuid": "4661c60c-b7fb-4ffb-9269-30e40f5a03f4", "comment": "Malware payload", "value": "1c43f2a9f5ddf08101754594ef2410ca503761f542277193206212615fe3823d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338912, "uuid": "8306a22c-142b-450c-84cb-7bfd1da0b284", "comment": "Malware payload", "value": "c09f9db8b67093d7bd24db0e67809b9f4e69bb8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338912, "uuid": "2648afd4-5abd-44c9-b46a-0994d93a383b", "comment": "Malware payload", "value": "301771f7d081231686f5852d8545eadc499b4b5b75755be7fd4d51519816ac439624eeda13a930fc66d16ff091084581", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338912, "uuid": "5b6fb193-84a1-4b09-b266-396ee059c19a", "value": "35F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338912, "uuid": "e3e50d9c-9b90-4ac8-b7db-cd40031bf38d", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338912, "uuid": "7554a542-52d6-4bc2-bebf-f3f6f68064cc", "value": "3072:1LG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:MERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338912, "uuid": "728ca7e6-a7a0-417c-bee3-e2f852c40366", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338912, "uuid": "266d9326-3afd-4395-8b80-933ecf29d3e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338912, "uuid": "4165b64e-3f4a-414f-808b-5ab967d0d8cb", "value": "d5a0db3b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d914d4d-ae83-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620316587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316587, "uuid": "4122464e-a293-49ab-baee-e79eec7aec25", "comment": "Malware payload (Loki)", "value": "120cdb51978f2b4f035cbc8cbe3368a4", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316587, "uuid": "6cf866f2-521f-421f-96c9-e9d938347813", "comment": "Malware payload (Loki)", "value": "1c90e49314b25bd25286a00d7144d2785f1b6bf3d34c96d021025ad26b209cfa", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316587, "uuid": "cfa026db-1595-42e7-97e0-5fd677dbfeba", "comment": "Malware payload (Loki)", "value": "3f3882bb4a728aca3ed79a9c40704c3195468b53", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316587, "uuid": "eb226dbd-7267-493f-a037-3ef72d01d773", "comment": "Malware payload (Loki)", "value": "cabe0cbd97b10fc5c8f0d66bf39e41fcde993085454d6a1e81ee0eed6a8d6fba1e8881ab45d18fd63393f3f12c5ba4b0", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316587, "uuid": "4a693f31-4916-4ebd-9685-935efd6fbca5", "value": "B9A423BF1AF1CF97F1DDD12F21C81B2BE0A085CA25AFDA03689331D6476118A6D12E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316587, "uuid": "47e90cc8-04a1-460a-8318-a148dc4aa612", "value": "12288:ZCj2/CCj60Vj77/BzK6cHoZGgX/Caad3nx9:eb0VjpG6chS6FZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316587, "uuid": "417d92cf-21ec-48bf-ba31-79d1c03b4351", "value": 456286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316587, "uuid": "b2ada05d-4ba0-433a-9d3e-150518a18bf4", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316587, "uuid": "9d9f5ed7-0cf7-4e0c-8db3-ca5d7528766c", "value": "SOA FOR APRIL.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7357a3-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339298, "uuid": "294ae245-03fa-4290-b975-4fb623fb76c9", "comment": "Malware payload", "value": "b6e98c799b79669f73c0e2c470372248", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339298, "uuid": "2f630a48-7b44-48c6-83b0-6c7ccf39e297", "comment": "Malware payload", "value": "1cbb6f9ffa77eb9b59f1bbad1561920152db9ec101e2783cac030233d6333217", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339298, "uuid": "79568aa4-551c-46eb-b220-86f448f69c6d", "comment": "Malware payload", "value": "4da1241310d53d1aa9f68bd2cc227ccbaa5a5959", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339298, "uuid": "ef7d2730-4d35-44a7-92e6-6bfdf6715607", "comment": "Malware payload", "value": "4c1953bc2f1aa270ccb8c9d93c8c4909053f9e8809fc35b79bbeea8adce71653c7f5de8857290cc50574207782681ea5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339298, "uuid": "deb1e8e6-46fa-4d95-acad-2ad3c0b887fb", "value": "3AF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339298, "uuid": "603e8d49-e0d0-4a8a-b453-dd84da5c894e", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339298, "uuid": "8f3fcfc9-3730-4f22-876c-a1f714973b72", "value": "3072:N3G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idKz:IERMVPG6+Y63HoG1QawL40Prx6K0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339298, "uuid": "77d1c19c-59e3-4351-8011-353b8093a409", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339298, "uuid": "cefd7314-6afa-46ec-8774-60660236b5b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339298, "uuid": "f53b124e-2699-4e78-8691-1638184e0f5e", "value": "b6e98c79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325413ce-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334875, "uuid": "1e5cc043-f38d-4e40-9694-bbbc9e9e92de", "comment": "Malware payload", "value": "d44fbfb764aac23566f86bc2fce0716f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334875, "uuid": "e848cf3d-561a-47e2-9fb2-2bc567103b72", "comment": "Malware payload", "value": "1d0258bac0bb23fb1afdcd8168fdc46d9583c82d3244b42c36949579c3eb4f17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334875, "uuid": "92baa15e-ecb5-4670-b1d2-df96e8490c31", "comment": "Malware payload", "value": "529ea5459227154344ec870432917f390d18ca9a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334875, "uuid": "2d6b329f-bfbd-4edf-b0f7-b854bbdd9990", "comment": "Malware payload", "value": "307f9e1c13e3490526aae4a97adf5a0244c22064997af3e96467e934dbbd0ea589cc337ff6f53951ed0d8786e2ccba7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334875, "uuid": "31590a32-4afe-433c-b870-cb6727b71e30", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334875, "uuid": "907c7d6f-3254-437d-af5e-d4293a35c649", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334875, "uuid": "4f2927e4-710d-4a98-b634-92af76aa2990", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334875, "uuid": "ededc8ae-a28c-439d-ab52-a7da992181e7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334875, "uuid": "bfd14378-0fc2-4bd3-9b35-9accda3b75d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334875, "uuid": "e6eade68-3675-4f4c-b843-92044fa20c1e", "value": "d44fbfb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a0a4ff-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259316, "uuid": "42860012-3c1b-49db-af7a-002f914889fe", "comment": "Malware payload (Dridex)", "value": "629673a534fa5d19c31445705bbca194", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259316, "uuid": "afc0ca1f-a858-4053-977b-61cb6c608985", "comment": "Malware payload (Dridex)", "value": "1d578a143d419c0e818099936d8a6f3fe500b538eb98842a7c680a47aa47bf7c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259316, "uuid": "ca8a705d-faa0-418f-8633-e937d2a2d404", "comment": "Malware payload (Dridex)", "value": "0e4e0745e4954007858f46b4b1acabe971f2ecf8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259316, "uuid": "a54857cb-6f90-4199-8bd6-9dc896e36f39", "comment": "Malware payload (Dridex)", "value": "93472d98d05a12dff094069fe37437a98a8ce2bdd5a8d97439612dd0d302eec1b369ef4eb8252d16b99e0032b6d23f7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259316, "uuid": "22ef4333-c109-465c-a538-a9bab7789d96", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259316, "uuid": "d5281676-de18-422b-b49e-16edd1e52848", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259316, "uuid": "fa12d221-c328-4eec-add3-d0b5536ac95a", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259316, "uuid": "ec6b040a-5eba-430c-9a5d-dc01cdf44e06", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259316, "uuid": "045053fc-9f98-4e24-9456-f76115ef8fb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259316, "uuid": "e1e3c277-de38-44ab-b81d-48049df64a0d", "value": "629673a5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f09a70-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339230, "uuid": "fb50f482-82d7-4fd9-be9c-87d370df04b3", "comment": "Malware payload", "value": "429ef9f38ca06501b2cc29a5b078b485", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339230, "uuid": "86700757-ad7e-43a8-af2b-b584e5351072", "comment": "Malware payload", "value": "1d62f7ac6428c06397f549e9204025767f9b7b48c44b48e832186c4bd246688b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339230, "uuid": "e4a2de50-7f3f-4353-9ccf-294f385e1b3c", "comment": "Malware payload", "value": "d5f73ca3446b6ad50c94dc1eecdc0203d448cf0b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339230, "uuid": "6cd721d7-5564-45c0-988b-68f91518b3c5", "comment": "Malware payload", "value": "b89a0bc52c6c1e1d53bdbb56a3992ca7cb0ff3a197041b1fb27987c8593197c513d342fd12a8545c72aa16835561afa5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339230, "uuid": "72cf44d8-9e90-454d-b18c-bacd468e9de6", "value": "D4F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339230, "uuid": "4698af32-0c2a-41d8-a8a1-568d31d2b08f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339230, "uuid": "07168f11-6446-44a8-b248-796ca46fd270", "value": "3072:hB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:/4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339230, "uuid": "388fc3fe-c932-4374-966e-ba11db1319c8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339230, "uuid": "029e2c90-35b8-45ad-bdf9-3047c35e84b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339230, "uuid": "27cf7378-3be7-461b-93e5-c441fee9a387", "value": "429ef9f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67c1bcf-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620310293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "7bd609c1-ab26-4af1-a404-9dd9f735e271", "comment": "Malware payload (njrat)", "value": "04e8f73e317dff39c1a345aef19dc45d", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "03f06808-01aa-44dc-a0da-2a833fccd5f7", "comment": "Malware payload (njrat)", "value": "1dcadc3559a00ec3102c9fe950446809f56acb8514f2bbd6b5ee495bae6f1311", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "a43ba1c0-fa18-4f9c-b2e8-ce071bde8609", "comment": "Malware payload (njrat)", "value": "65776bec7ba1730f7b52f06950ea762d30dc34a5", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "d875794a-6af1-42a1-8008-d2625a7b8774", "comment": "Malware payload (njrat)", "value": "d4cc905340b40f7918520f7181cded65a8259c7b87338bcf261a3f1a20c7fd2df696a44e54c47776294165fad9eeb385", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310293, "uuid": "a24b24c0-2915-404c-9dd2-359b462e2dbb", "value": "8C242ACE326BD8DBCA6605F43D13C17D87339C6AE106E65A28B2772ED2B117713614E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310293, "uuid": "792f9e4e-8c34-410a-94e5-e893a9fbcf15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310293, "uuid": "977888b8-ef49-49e5-a730-6630c15460cb", "value": "3072:aBHig/xr+VBFaI1YIYiheeeeeeeeefYDeOiClppeppOpplppepppDppptpppjpp0:aJZrMBgkSOG9iO2RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310293, "uuid": "60a9e519-ac93-4c2e-bbde-1315acbb4ad7", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310293, "uuid": "e078bbe1-4641-4187-9a22-f6e5ef08fb81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310293, "uuid": "5dd3bbfb-f5a2-4172-b170-41e82790f835", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160c5814-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338693, "uuid": "42550941-2b4d-4180-ba6c-ea2b25dccd81", "comment": "Malware payload", "value": "7dcd0ed2e8b74a795a01cab9fdcd3f53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338693, "uuid": "911c86a9-98be-4a9e-817c-d24fc907862d", "comment": "Malware payload", "value": "1de43da10a90ae953afc3b234760c90349f121b83a9856a948d792a6ea8d87a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338693, "uuid": "780b3cfc-9555-4082-95c0-1578c467650f", "comment": "Malware payload", "value": "2fb20588d15ab931da75347857eb5673ea78bca1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338693, "uuid": "c688d1bb-a406-4ce5-8a18-de0b4670b589", "comment": "Malware payload", "value": "1ca73a0c69e458146d040c3a0f0c902d21134abeed65c33e5ecdea93ade27ad0565ebd6e08812dbd639a789c92f44a23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338693, "uuid": "1922266b-3637-43ec-8124-1562ebd10ef9", "value": "86F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338693, "uuid": "04a120e0-72ff-4123-a502-33b0eb8bd93e", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338693, "uuid": "0d2af997-78c9-46e5-a71b-23d0a72cf45f", "value": "3072:djG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:0ERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338693, "uuid": "5d9eadc5-e623-44ff-bc6f-49d979e125ed", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338693, "uuid": "7a1eca17-8022-4849-a469-45848f8eabf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338693, "uuid": "5a11a938-066e-48cd-b39a-ef7e4d92110a", "value": "7dcd0ed2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdf8463-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284459, "uuid": "de671a08-dbca-4618-8523-f20ce7f69880", "comment": "Malware payload (Dridex)", "value": "1eafb74f7ec15d0e3f4e553e0c92f780", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284459, "uuid": "c61c13cc-95f1-41be-b032-2b2388a73595", "comment": "Malware payload (Dridex)", "value": "1de5ff54d91df723422d8e5ce9359159702214f3e885087d792f6974f484ee97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284459, "uuid": "4039f359-8cd9-4ece-8e4e-c32e4a35962f", "comment": "Malware payload (Dridex)", "value": "b59f22d3aee055a9cebe2156ca20a75f130d639c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284459, "uuid": "5cdc11bd-6229-41a3-93c7-64dc15f6224b", "comment": "Malware payload (Dridex)", "value": "9352c9fd208ead742fb3e3e1ed5660a52c7f2d3aee31f8c7bda6a43a9448e40f5cd86b513a33df929563c766129a1c2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284459, "uuid": "37a0aca6-fbe0-4692-9b89-0a0de2cf2b74", "value": "31F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284459, "uuid": "abc32801-996f-45ec-a1c8-d467619b5fa1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284459, "uuid": "c18024ba-cfee-4dba-b2c4-69a0868d1166", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284459, "uuid": "62ae1bab-eef4-420b-9a19-5263518110d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284459, "uuid": "786fa4ad-eb9f-41a2-b93d-1d7c0bcaf444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284459, "uuid": "92c07ca5-4a61-4526-a156-c6f29376c154", "value": "1eafb74f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4afc95-ae5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620301124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301124, "uuid": "011ea331-668b-4ce8-b169-497f8978a5aa", "comment": "Malware payload (AgentTesla)", "value": "654d4c7b05ae70c261902a67491dad6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301124, "uuid": "52890a7d-c34e-42c0-a1b8-1e287ec141f3", "comment": "Malware payload (AgentTesla)", "value": "1e1345d2a58358d921cc27865cd7c972b53a9b8718c9ab23428ad3c687f9ffca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301124, "uuid": "9e6b30a7-5b09-467e-81f1-c5ee7d534d07", "comment": "Malware payload (AgentTesla)", "value": "66e2d4d8269a759caf5d1089196e2f0f59035f5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301124, "uuid": "0070338d-e646-4ce1-b756-d4990c2b609e", "comment": "Malware payload (AgentTesla)", "value": "075148da5c07caa1d8feadec1e49e08284053f03ac72932dd050080df6360978faeb87d20b8083c28e05e35de7a81d69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301124, "uuid": "7d2dc396-59fe-4e27-8c91-66a4528413c4", "value": "0EB423A90F8161E38798C8381FAFE4473C3799E0F789F9066A9D7405DF16E7208539AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301124, "uuid": "623db541-5169-460f-97e2-d725253825ed", "value": "12288:Cysbjdnvq/oukWHKWvSFHokma0SO08aBBYKx2wWz3u:CyI9vq/oukE9vAHoA0I5BhbWze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620301124, "uuid": "704785ba-80b4-4cd4-aa97-39025cbde1c0", "value": 509382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620301124, "uuid": "4d8a52b7-aaed-4a7f-a4d2-01a6c597a108", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301124, "uuid": "180d1547-28d0-4fc9-81e5-4a3a246132c4", "value": "TJ190001-P-IW-DP-GA-2047-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a545cc6f-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620310157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310157, "uuid": "07e75528-a91c-4a7e-b23b-f21617345ed8", "comment": "Malware payload", "value": "bdfa523e5a06c417e30f0daecb6215f3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310157, "uuid": "474cc626-a72b-4a0b-b78d-7f2177916350", "comment": "Malware payload", "value": "1e8441f0d32d3854e0b3801063f6015a9f09637d77b714f8e58fb8c198693a51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310157, "uuid": "a4260ae6-718a-47ec-b496-ab84cb38d3e3", "comment": "Malware payload", "value": "4d5b18f90129040a31431b836a8d006e90b47d81", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310157, "uuid": "8b98925e-45cd-414d-8bb3-aa2cb058e7df", "comment": "Malware payload", "value": "f0f5a8f055af3a96824c10f4448c1ee0d6d55fdaec919994e092b0eb019d00d0a3029aec6ea225466931713036da708d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310157, "uuid": "987d4787-ba2f-4eac-bbf6-afd4f0334d8e", "value": "6A162377626E4148D4ECC836C5377D9031F2123B5A82B8BDA5FB69C237364B5F602A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310157, "uuid": "1e5c4e8f-f335-407b-96f1-9a016a7d0aaa", "value": "ba244fcbc3516db06a5798ef9cfcebb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310157, "uuid": "e9fa9ada-d8cc-4fbb-b5bf-f5cdeaf95d91", "value": "49152:MfLe1QLqYinLEOz6VaAY0mOmD+MK03LRkpdWGZo09AxnemERApAi4EuWlV1d:MC1PYinTz6Va8QXD3LoA4ohJERAii/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310157, "uuid": "9ab58ee6-3791-4ad2-892c-ec3ac4878173", "value": 4122624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310157, "uuid": "130c8dc4-ff2e-4031-8dad-fec3e5bdbf17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310157, "uuid": "fc3d1f8b-a135-4d0c-9741-7183a8252fde", "value": "SecuriteInfo.com.BackDoor.PcClient.6627.23635.24808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3da0ca-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339024, "uuid": "26bc1577-4b0b-4cab-b2be-d25f300b450b", "comment": "Malware payload", "value": "686fc43bb1c36ea2cbe3f3a606ffacbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339024, "uuid": "e9127db4-227d-4608-a7ac-89de56fc849c", "comment": "Malware payload", "value": "1ec778e3827d26c84e4828b1dc7987dd04226969f0a9b60c4e7001c1a222c847", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339024, "uuid": "80ebb9a6-a9a2-43d3-9a30-ad7fe4e490d9", "comment": "Malware payload", "value": "3e29ba3ae03a89fdc9eef64f641c4d4dce8c9016", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339024, "uuid": "e1b5d4aa-48f6-4a48-973e-1ac7a1160a90", "comment": "Malware payload", "value": "b2221bfeb30533844326833326e00daca5cc068efaf70a06287cd227d967c6182c5e8ea0178b2d75db05af0eab960626", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339024, "uuid": "d1db0cad-851a-4da3-ab25-cbf50d073717", "value": "05F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339024, "uuid": "b1db247a-0ea2-440e-97b7-7ae41d4871e6", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339024, "uuid": "087a186f-9141-400f-8179-25527e6ea70e", "value": "3072:wqiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:wSERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339024, "uuid": "fe501672-4f54-4ea9-84e9-c0d7f809733c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339024, "uuid": "357e98dd-900c-4bd5-9d05-3a44cc9b39a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339024, "uuid": "ed28bc2a-d5dc-405a-b1c3-2b301cb17f58", "value": "686fc43b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080566a6-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277252, "uuid": "06f36ce2-f24f-4b78-9cf7-ac2d1050d98f", "comment": "Malware payload (Dridex)", "value": "e3f1d29a793f82bb2c8c29665483cf1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277252, "uuid": "6c137830-e573-4168-9974-4028c90d2a1d", "comment": "Malware payload (Dridex)", "value": "1f09e0e4087a3fa5aee89f3cb70464a8c8f8225252384137c6f5fe513b2de8a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277252, "uuid": "bc04e109-0252-41ef-b1ab-6a71f141a1d8", "comment": "Malware payload (Dridex)", "value": "d775aea1b93b2fdb38c82a997cdb6415d1a9e879", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277252, "uuid": "d9d6044c-4594-47ed-88b4-cbd4bf963d72", "comment": "Malware payload (Dridex)", "value": "2a730d25fb47eb8ec0327da7e0df692e17ee60fa22165e732c06b8f2c5a21da0b2bc3542a5567ba5e8a16d288951e514", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277252, "uuid": "606fce9f-ca5b-4669-8318-7b9502e6c2b2", "value": "4EF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277252, "uuid": "7b98625d-4b2d-41e2-9621-f3ed050b4889", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277252, "uuid": "cae6332a-4d8b-4062-baf5-b1335446de23", "value": "3072:MiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:veAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277252, "uuid": "0c9cf5eb-fd0e-4a73-8ef7-229c7cb4ed2d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277252, "uuid": "58daa2a2-e84b-4cea-a36b-694295c490a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277252, "uuid": "8cf20a39-65d7-4c14-b333-49647778b79b", "value": "e3f1d29a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44d3d53-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302559, "uuid": "42368b1c-338a-4c99-aac1-0ed7365a961d", "comment": "Malware payload (Dridex)", "value": "41d135ac8215674ed3929e2038f68e7c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302559, "uuid": "a06050da-6a88-4b6a-8dc2-abc457a26220", "comment": "Malware payload (Dridex)", "value": "1f1c37624a4b5ee5a0c6887aa4b41113cb82033a555f2823546161b5dc227948", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302559, "uuid": "c900f860-075d-4bb8-a8d6-763f9494eff6", "comment": "Malware payload (Dridex)", "value": "261d99a10446e4f088116cb8a87df439452cdf9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302559, "uuid": "ebfa2207-7071-4f8a-a3cf-237687f63aeb", "comment": "Malware payload (Dridex)", "value": "00dcecc155a8a63c042d95afd8d538918e5a703bab678d59ec9639951470bd77e5e29ca45c0f033d7de3671431d0f7fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302559, "uuid": "dc246d7f-21c6-44cb-b44a-955f55eecf55", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302559, "uuid": "55caf0ad-8e3b-4d00-a1af-802a0a9f73dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302559, "uuid": "1bd32d22-5c68-413c-aac3-c3d2403675ca", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302559, "uuid": "4c90cb2d-6752-4e69-bc2c-0de8579c6eb8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302559, "uuid": "876a0377-0981-4b96-9e54-abfb90f80bae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302559, "uuid": "2af9f659-fc17-4700-be8c-9ed8a33833c3", "value": "41d135ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a2d677-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273731, "uuid": "0751d37e-32fe-4888-98d1-6a0682f889a7", "comment": "Malware payload (Dridex)", "value": "eaf20fa26a17ef5bdce1287f66d21bed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273731, "uuid": "099612ca-0723-47fb-9006-d4b800a7c4f5", "comment": "Malware payload (Dridex)", "value": "1f3a54568845d61027c53047c2ea1f5d042ceb97bdf18fd45322fd37e4b1efab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273731, "uuid": "b7659868-3b08-4b19-b721-698dcfe7cd1f", "comment": "Malware payload (Dridex)", "value": "3bedc43439d0c8a0b44a0491b312a0ab64b85d29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273731, "uuid": "b137b26a-0848-420b-8181-a435a505b80d", "comment": "Malware payload (Dridex)", "value": "7c091add87855817b6b1947d5029a1baadcaf24c7dbfd342984f9f2260447a98f2afe832065bf6f6ab7c9dacacb55910", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273731, "uuid": "58885202-c344-426c-b7c6-604442a0d551", "value": "D3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273731, "uuid": "86ff70e3-aaf6-4748-be0e-d76866cf46f8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273731, "uuid": "733ef0c8-a8a4-42f0-b42c-1b3d68a37c9d", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273731, "uuid": "f22fcebe-a83b-4968-8447-0c8aed082a75", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273731, "uuid": "98bd0adf-f4b4-47ee-a61b-c9d8696efc61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273731, "uuid": "77299422-09a9-4f0b-8737-2e6d62a3fe7c", "value": "eaf20fa2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c455d066-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620285728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285728, "uuid": "6723023d-60cf-4457-a7be-e17b2e4622ee", "comment": "Malware payload (SnakeKeylogger)", "value": "dd2b93ff4d44967b3fb030f94e43a162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285728, "uuid": "3bfa311b-c92b-476d-ae4e-9ff8889ddbb5", "comment": "Malware payload (SnakeKeylogger)", "value": "1f5c0afbaf2ae4a24c61aa1303ab84d0e10846ff7015033f09114904a681d0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285728, "uuid": "9f1b8c75-e4fa-46cd-a4ca-57d773398d17", "comment": "Malware payload (SnakeKeylogger)", "value": "95e4fbee9f6e1b0004a1fe84c7ac52364d5c0253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285728, "uuid": "cc6ca8bc-8a05-40b2-94c7-754870fd6125", "comment": "Malware payload (SnakeKeylogger)", "value": "74332c450a204435c8f8311cc31b8d00face3e8a4684db0f0b3aaa7af7570e73c6b86dbfaaed2359985ef5b899c39aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285728, "uuid": "3fd65035-b7cc-4e7d-818b-edd571d405d6", "value": "E835AEA192988920ED7B17344072C93983F77E46E636E75CADD87C9B7B732C19627203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285728, "uuid": "a754e8e5-20db-4334-818e-d13d28f7eb81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285728, "uuid": "005d22e5-88ac-49b5-a6c6-56a99f3a4553", "value": "12288:Cp2uuCdnoRzIgHl76xmWPCLFrrvAV3RgTjTMnq:C3uXzH2xm+Cpr7eyja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285728, "uuid": "72f60283-16f0-49f3-8948-95b768206bba", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285728, "uuid": "0bd2e786-9b4d-4dd5-85c8-5c4bdb32933c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285728, "uuid": "8c4e52a9-8d8d-44af-a727-73ba5b45ae67", "value": "Order-102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba7c50a-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285284, "uuid": "97bf083f-ad4e-43b8-8c55-cda05810f139", "comment": "Malware payload (AgentTesla)", "value": "ce168ce4435f8c20048bf3be0b9dfd74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285284, "uuid": "9fef6324-a80b-4621-83ea-285d7680952e", "comment": "Malware payload (AgentTesla)", "value": "1f5ed20237447700ae9e58aef2702451ddfebaa47968ca4e9c97304888990d7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285284, "uuid": "9306c25b-20c3-4210-9531-189ba461e42b", "comment": "Malware payload (AgentTesla)", "value": "314ab61f766191c35ee248fb86ef89f9653df5a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285284, "uuid": "c1360b9b-5d5a-4027-be51-dc69dcd4f2fa", "comment": "Malware payload (AgentTesla)", "value": "6a01d2ed08ca2a768423a825e35d366fc4573ecf3a9d84a411794a2289a54c16a9c12b23ec8e9b3a3bb9da098b13a9ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285284, "uuid": "6c855464-cc7c-4ec6-bfab-28906b7c22fd", "value": "4235AD2252989924E17B23748062C13943F67E03E276C75DB9E87DDB3F736C19A6B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285284, "uuid": "b4dc2705-4d1f-4881-bf9e-f8313ab69cd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285284, "uuid": "8f5cf3a3-3962-4e34-94de-d42dc800fac8", "value": "12288:zp2sTJVnoS46OOcJxeXrK772mBDhyDrqtLXlbPH5SM:zBTe6OOrrK72DutLlb/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285284, "uuid": "ec20bfdc-abba-49fa-8de2-29108cc72236", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285284, "uuid": "254951eb-8286-4a52-b1f1-a5c3efdcd919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285284, "uuid": "bb7b2656-4e70-4daa-99ad-d6b7bc6862f6", "value": "PO-NO#1086089 Order xlsx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f024c48-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324105, "uuid": "d898e41b-d30e-4b57-8d39-4875c97270c4", "comment": "Malware payload (Dridex)", "value": "c5ae270febd032d08a14b98067fefa15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324105, "uuid": "525e922e-12c8-4f8a-8060-9e9a3d711a43", "comment": "Malware payload (Dridex)", "value": "1fa82d3c8f90edbde2785766fa55052611d31bc5bb066e7aab23ddf034565b1f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324105, "uuid": "5b9bb188-e209-4774-9afb-5079b2980ab8", "comment": "Malware payload (Dridex)", "value": "6444374e7765c41b080308fa08fcf6fb518ebac7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324105, "uuid": "cc852db2-ca13-4845-8f7a-0a1df70734b0", "comment": "Malware payload (Dridex)", "value": "5758c9639d065fa98f8984c5e47d28992483878504050faa449a57091c255170e134a856bde55d49f898b1b6b344a3bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324105, "uuid": "e9a687e0-e709-401f-89ee-25d5842c36e6", "value": "64F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324105, "uuid": "97efc141-4ccd-4b98-9565-d61e6b0e15b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324105, "uuid": "4d31c294-257d-473e-a807-33ebae97205b", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324105, "uuid": "e960c19b-7ed3-4a3f-b2ac-fe71e037a430", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324105, "uuid": "aaabd65f-9bbc-440f-8ef2-96f2dddee7d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324105, "uuid": "670d3ddb-e720-4678-9c2d-ac5c9cfc908d", "value": "c5ae270f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc6df27-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280942, "uuid": "5aa5e32d-1509-4e0c-8f24-773150c53ca1", "comment": "Malware payload (Dridex)", "value": "b4eb6dceed0eab883dac5b091e05b290", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280942, "uuid": "967f4023-6fc1-4e06-bc22-e81bbc5e70c6", "comment": "Malware payload (Dridex)", "value": "1fe2ac1b11c9862312f82c1c5ad07aa41765ec6be681076f19380c590e4c298a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280942, "uuid": "9d32bd95-0733-4045-bc85-2cb3b4ccfbe2", "comment": "Malware payload (Dridex)", "value": "084c0fd2d05655931cd17a589b4f336dfcefb6a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280942, "uuid": "d2e6783f-5727-48f6-b1d8-22adcbac63bd", "comment": "Malware payload (Dridex)", "value": "cbff848bde45fa24fea6e2685d4b2d254eef951a0cd6bcb7dc76c3c084fb2b1c785e80181b61cad131e1ef3a2bbfcbf9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280942, "uuid": "1de39408-e039-430f-aba0-10a45f7514be", "value": "03F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280942, "uuid": "360303ce-9318-4fd2-82a7-310617b8afcf", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280942, "uuid": "c7a335e7-6cb3-46e3-9945-6dde67b4ec6b", "value": "3072:TB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:24KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280942, "uuid": "45a83db9-eda7-4b56-a744-53c331b28d4e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280942, "uuid": "47c85b72-c2ef-4d23-b79a-d4e3d7b33d3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280942, "uuid": "3a4d96c9-4d6c-4320-9b7e-40827a1dc618", "value": "b4eb6dce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8fd2da-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339186, "uuid": "ce202291-5339-42b8-8f1a-fe18ca66def6", "comment": "Malware payload", "value": "b86229d2d6e374777be4d3cd77ee5911", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339186, "uuid": "bd112ca2-c741-4110-ba95-96c7c44c84f1", "comment": "Malware payload", "value": "1ffd42e8e4267b176a2a262e54f5f3d2c4fd3c48b5c081a7497a6519cc5261bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339186, "uuid": "55a33cd9-2cbe-4bb8-83ed-8920678a0b6a", "comment": "Malware payload", "value": "09d046016447c03feeab2aa4c30ea15be1ae8138", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339186, "uuid": "86e23c88-44b4-4505-8e61-2ca04f73610d", "comment": "Malware payload", "value": "d35aa9589cb4597951e2f8be301ec008816f15242c381468cba7a8d485d8aa4f807dc58f0b17d652b2bdeb1c90afdfee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339186, "uuid": "f698ae73-2d1d-4c1e-ba36-ff1290756c49", "value": "7FF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339186, "uuid": "656773c9-2b7d-4cd3-be32-7fc4d38726cb", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339186, "uuid": "0b7444d6-d3a8-422b-9900-7a4ae6121d71", "value": "3072:UOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:0ERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339186, "uuid": "3a6aad52-4b1e-4eac-9085-c035e8d4a03a", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339186, "uuid": "76ccaabd-ec75-4a28-b839-580b08926e09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339186, "uuid": "44d7b5de-c3ca-4ee0-93c8-39c7bbd9b0b3", "value": "b86229d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68fa35e-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338614, "uuid": "fc2abc6f-ae6b-4b15-ba40-c9d06e959675", "comment": "Malware payload", "value": "ed1dfb818c3d67c8250062d5b72980de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338614, "uuid": "6a21f9b2-e891-445f-8f17-4933c2539ede", "comment": "Malware payload", "value": "206437a9333e51cdea9436c9c1b0c30ce55f4dac254e02afcabad8789a5241a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338614, "uuid": "040a497a-3593-46b6-b32e-1e760d6d897e", "comment": "Malware payload", "value": "b03d41d5818b347ecf8c7018f5c4cc4770ced14c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338614, "uuid": "0686eb60-92a8-43a3-a3fb-1799d170dfc5", "comment": "Malware payload", "value": "e8197091c895b76de802e9ae34299e2a64b02e8225da8c1a8aeab02aaf957e85ddd74a51ceb64583fb13a7aa688009e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338614, "uuid": "77d494fb-1263-41f0-a10e-e7430bc03d64", "value": "E0F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338614, "uuid": "b5518058-c1a6-4132-b516-1e784a5d0a6e", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338614, "uuid": "54dcbc51-b1e3-403b-a1b2-b7565bd42c01", "value": "3072:ijG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:BERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338614, "uuid": "506d68ec-9d71-4ea6-ae3a-f2311274f6c1", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338614, "uuid": "df3156a3-4172-4ef6-9a29-245f9408bb03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338614, "uuid": "5303a5b2-c4af-40c3-bd82-54f5c8de82ad", "value": "ed1dfb81_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a013896-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620288073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288073, "uuid": "02a9bc4e-d83b-44c0-87d3-d8a43985243c", "comment": "Malware payload (AgentTesla)", "value": "62d79c8b2b3243b3c0a8da490783dd67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288073, "uuid": "376cd38d-8dc9-4f11-9ce3-5d551ee9657a", "comment": "Malware payload (AgentTesla)", "value": "20a554b34cc20d65f2461af3cb5b5d5fa033825f0876f80d12b300542df38a9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288073, "uuid": "7772d505-051d-4735-ad4f-dc2d0724cece", "comment": "Malware payload (AgentTesla)", "value": "d9e0e4a43756135a1f2a03aa4088090d5604711e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288073, "uuid": "4f47704d-a3d9-4b99-80ec-6e166f762459", "comment": "Malware payload (AgentTesla)", "value": "f16fb170c553f1e285d8f35b1e003160aa58d3161003866b9f3521764563bd2f5ca3d853d40ca3128c17097cbaee44b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288073, "uuid": "748527a2-3313-4bba-9f13-8e661267a786", "value": "A515023E75087E11D43E1F3FD9A5C9A15279FC12A663D62E2DE035BF9AF27A80600217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288073, "uuid": "97aa67e5-75fd-49ee-86c0-699667d2e272", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288073, "uuid": "49d5d966-a283-4fca-bf08-8e05bea15f03", "value": "12288:QoxUGuvqwoA2S/htOG4fgk1T8kP2h9ptoamfdjFLKtEEUtSzr0wNMjuQf9a9Ag7r:t6qwhp6ff/IzPpmfLtSz3Wba9B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288073, "uuid": "dedac1ee-7689-43e7-ad6a-baf4f8a3e6c6", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288073, "uuid": "ca2a31b6-11ee-458d-a6e7-69c92286aa84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288073, "uuid": "8fa4930f-1220-43f7-87a6-c5770ecd20cf", "value": "62d79c8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a5792d-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620310022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310022, "uuid": "31551dd0-4bd5-493f-a47c-b454dcb5d34d", "comment": "Malware payload (TrickBot)", "value": "21eb9b5b1d887bb389530811600fa9a3", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310022, "uuid": "b7e2eb71-2b0d-4946-b48e-10bda3cf4bd3", "comment": "Malware payload (TrickBot)", "value": "21382e955d23c9c2ff9aa617070f33f898745d568b82338c9a4c1a1652ae5a12", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310022, "uuid": "f84a8f84-f062-47f1-be3b-305d5c24c4a4", "comment": "Malware payload (TrickBot)", "value": "da5f52ca735f10b98b1d6aca7dd86a1cde04fbbd", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310022, "uuid": "0d09abe9-fd11-4309-bb25-7ed1f4fe2deb", "comment": "Malware payload (TrickBot)", "value": "d0f10b93a9e7b5dbb14b0969a0665f894d532c2bab71a2cde8d5f4afac5f3a7b2e09659b8e5b547657dff3cf0b2607f6", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310022, "uuid": "5634e10f-599c-4cc4-9d63-260496d79bd1", "value": "1FE4D013BBD0D436E6F641344FE2BB297AB9F9A08B7566C333D00A4C4D71AC1993A716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310022, "uuid": "341eb393-1934-444e-bec0-76f053b3f704", "value": "45ac993c4456effdce556743d114901e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310022, "uuid": "ecf1c218-af2b-4eac-8cae-94f1be11c757", "value": "12288:NCVB2/feE++T9u39PgcqWwqLgY279f0/H8kJsw:Nb/fR++T9A8qLgY27O0Ysw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310022, "uuid": "cb36c3af-4e59-493b-a920-45c19b509764", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310022, "uuid": "d351084b-b3a9-46e8-9a75-ec89c045522d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310022, "uuid": "146d51ee-27e9-4d05-b941-bf9f09fce1dd", "value": "redbutton.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a44068-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320521, "uuid": "6425d383-50a0-4569-9cf2-aeaf14cb845d", "comment": "Malware payload (Dridex)", "value": "8e344cc4e6cfd11e03af6582211ba489", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320521, "uuid": "eba4c0d4-ed4f-4b1a-909c-2ed2953b8eac", "comment": "Malware payload (Dridex)", "value": "21a4fdb053e3fa8e7feacdca1f439ff8cb980977cddfa7d8816887060aa49c68", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320521, "uuid": "0cfe23b0-4f38-40a6-97b1-5ff2ba1affa1", "comment": "Malware payload (Dridex)", "value": "1f9b882d0c2f755bd262674c0fcde5021581923b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320521, "uuid": "637f150b-1ace-4c2d-acc3-fc18526ea2e9", "comment": "Malware payload (Dridex)", "value": "97aa13a752af83999c0677255145eb0cbaa8ba0483822388ef8b7f8ae6e5cdd69986b3ff7a7cbc32e66f4d32719d0533", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320521, "uuid": "7b8e7a02-73f4-461a-9d91-ab4d22f7a58d", "value": "F2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320521, "uuid": "dc65490c-c783-45d0-8c2c-f271ed45054b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320521, "uuid": "c40d28c3-d946-4f45-a700-f8426b51cc53", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320521, "uuid": "a7b8ff1e-bab6-4eb6-ab89-952e2cd31c0c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320521, "uuid": "9e3846ae-42e0-4c00-a1b7-ed9bf4e8a843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320521, "uuid": "e00b4ad3-effb-43e4-a962-183fc65ce921", "value": "8e344cc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2883d1-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309714, "uuid": "a495c730-b290-44a5-a0cf-2041293e821f", "comment": "Malware payload (Dridex)", "value": "d1ea1ccc08268df009da6670732d6362", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309714, "uuid": "404a879e-0c45-4d08-b3f2-f8da174a65a9", "comment": "Malware payload (Dridex)", "value": "21b3363d20dc56e07325581022831e959b3e6ec1370715b03dd6a4da8d90c7bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309714, "uuid": "423c1b27-7214-488c-a9b3-82108a449da5", "comment": "Malware payload (Dridex)", "value": "11e0b9d74799379bf83fcd1def26161d3920562b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309714, "uuid": "42e3fe65-f19f-42a6-8822-ae1e914a0632", "comment": "Malware payload (Dridex)", "value": "19f2b72a803294960c2aad01e286b51bcb1520878dff3c009eed94d1c4ae75266f46e7f4af7fb69417d97443abe9af44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309714, "uuid": "820ebd60-4e16-47d1-803a-e808531b6bba", "value": "83F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309714, "uuid": "4dd719c8-fa19-4bb8-a0c6-47d35d1e0afa", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309714, "uuid": "3a79e634-48c3-4aa1-b097-3483b75d047b", "value": "3072:vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309714, "uuid": "5b821232-e76f-479a-b240-7c121fab8ef3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309714, "uuid": "0f120811-2ba2-4504-ab94-1b0ab9d94e9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309714, "uuid": "dd799aa5-83bb-4e9f-a3b7-c2cc595aac59", "value": "d1ea1ccc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8701a19-ae50-11eb-abe1-42010a9c0039", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1620294781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294781, "uuid": "617243eb-bb6a-44f6-9e39-01d653ce60fc", "comment": "Malware payload (ParallaxRAT)", "value": "ec40f3c3dccb6e762d5271aac454a133", "object_relation": "md5", "Tag": [ { "name": "IQ Trade ApS", "colour": "#D5E792", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294781, "uuid": "285a92d6-b2e1-4423-a660-27ed9abdbda6", "comment": "Malware payload (ParallaxRAT)", "value": "222c327eef40050baf9e05f80d39f53bf7955bd84bf212887405a665060c369f", "object_relation": "sha256", "Tag": [ { "name": "IQ Trade ApS", "colour": "#D5E792", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294781, "uuid": "36a3626c-4427-4a33-b150-682613f77ebd", "comment": "Malware payload (ParallaxRAT)", "value": "aa2f67289004be38332ae651d80b6865ff1261e0", "object_relation": "sha1", "Tag": [ { "name": "IQ Trade ApS", "colour": "#D5E792", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294781, "uuid": "4ea712b4-888a-400f-9245-ec0536677f17", "comment": "Malware payload (ParallaxRAT)", "value": "d2cebb766ea67c87440261bae140fc2183f5e809df82fd2879fcc2c3ab4924403a117cf092b494083da17204288a40dc", "object_relation": "sha3-384", "Tag": [ { "name": "IQ Trade ApS", "colour": "#D5E792", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294781, "uuid": "b6a5458e-aa75-48bb-84d6-5c228f849dff", "value": "A1F58EF0B941446ADA233331CA1AF278F2AD64738737F2C7AA5C561D2D7D1934A2816F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294781, "uuid": "59ce7944-35d9-43a7-8c30-3687ed9eda71", "value": "0ab133939b1aac0018176dad636a9f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294781, "uuid": "9d91a6c5-9d67-47f2-96df-9773d72d05d4", "value": "98304:Bg8We8xMKAJElIoFB+6TuzU/hym48IQeAeME0J:BRo6JpeIQeAC0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620294781, "uuid": "cbe06dc0-0066-42dc-ad45-ce8f62b75e43", "value": 3434944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620294781, "uuid": "4f148996-f724-4936-be61-6b537e17a329", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294781, "uuid": "536adac0-b7ed-4c02-9b39-636c19758b0b", "value": "222c327eef40050baf9e05f80d39f53bf7955bd84bf212887405a665060c369f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da625d2-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313473, "uuid": "b6ef9840-751e-41ad-875d-baaf4057142a", "comment": "Malware payload (Dridex)", "value": "cab66be9e01fc44063ecc52e90b7aa29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313473, "uuid": "5feb7d30-d02c-4f7f-a205-10dc277e62bd", "comment": "Malware payload (Dridex)", "value": "22cc6c61c0ec6a66da3e77f8a5bddb5896cef70b0af169309f3fe3931acc0b60", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313473, "uuid": "7e879915-d187-41d8-b4e0-6f61d6d44d21", "comment": "Malware payload (Dridex)", "value": "f30163631a6a7aa906fb6c6f178fa2a0265a6b1c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313473, "uuid": "44f09ddc-bb96-4926-b483-f68a139f1bf0", "comment": "Malware payload (Dridex)", "value": "64e10a04aa2bd4664cea369d38783cff45037e26c70480934d9048b9508b0ea6f0d5ceb7489e5e553722d41a5bb1220d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313473, "uuid": "2f8167b6-0dd7-47d3-b561-1c8a6f1b1cc9", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313473, "uuid": "79a8eca4-c920-40ca-91ec-a9025d54aae3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313473, "uuid": "0551aeb6-8638-44de-b1de-e67e213ff737", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313473, "uuid": "50e186ac-8557-448d-9531-51d82f8e89b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313473, "uuid": "08b22a01-cc3e-4020-a58a-565b51afdda3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313473, "uuid": "725460b2-d5c3-4402-a2b4-ca10d93175a6", "value": "cab66be9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4160634-ae7b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313296, "uuid": "d785d52c-ddf6-4bdc-b75e-0aad7ba050a2", "comment": "Malware payload (Dridex)", "value": "b529b2fcdea39db3ff05e726172665a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313296, "uuid": "1910ba67-8805-4cbf-922a-1b414badca11", "comment": "Malware payload (Dridex)", "value": "231fb96295c92552741b79d20b9836d6467e6976eeeaa0df687f7ef2ee6107c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313296, "uuid": "f42cfd33-3c93-417c-b8c5-cd0344f2215f", "comment": "Malware payload (Dridex)", "value": "f972409a51add95e2635fbf70c5bbe0c7a4f1c8a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313296, "uuid": "6ede93b7-e908-4386-a7fa-7dd569035b86", "comment": "Malware payload (Dridex)", "value": "ddf150785e616ce2dc77ce9df9158536ba607b774729c904a58fd8b25356a90e57d7c45375a152a131ea33bafbee7f91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313296, "uuid": "dce9279f-e549-4150-91e0-773752ea10ec", "value": "D8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313296, "uuid": "8d845463-5bac-4827-92c6-11af50dc2cdb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313296, "uuid": "d4dbe268-7472-4a28-94e1-39d222c07f62", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313296, "uuid": "26c8ff61-03c8-4970-9144-3383793b13ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313296, "uuid": "f0233362-f653-4669-aa4f-9b0843a192f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313296, "uuid": "540cf3f8-dc80-4055-9e5f-d44defd1c41f", "value": "b529b2fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a719eab7-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273653, "uuid": "0729384f-47ef-4174-9952-6f4aa95e2b25", "comment": "Malware payload (Dridex)", "value": "8a10328000cb64b882b4d3967ffa4701", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273653, "uuid": "becc11b3-c38b-4a58-886c-8f65f8678e4d", "comment": "Malware payload (Dridex)", "value": "232761d70cddf7a7242b8a732e6850cabd07d2809c6a8111535b2788f1e4b695", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273653, "uuid": "40133f20-ced4-4402-857b-5f70880c0dab", "comment": "Malware payload (Dridex)", "value": "703f330f199222235d4534ecd8d56e4a04d0b6a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273653, "uuid": "1664b21b-1efc-4f21-b0b0-016353116ee8", "comment": "Malware payload (Dridex)", "value": "44181d5e5071f9cca0e7b86913c62d807bc720f4ae2b0687244d3a0accefb8323b0b643749652ea5754f33906df7228c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273653, "uuid": "873049ed-5177-4787-93a4-446b2c52bf34", "value": "5AF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273653, "uuid": "f619c3ad-d5a8-4b2c-8ec2-f594ecbfa07c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273653, "uuid": "b4f67694-2d79-4b8f-a7b3-95e0f1bf2033", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273653, "uuid": "9a14cffe-70a8-4f11-a998-be9aeffb0ed1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273653, "uuid": "eb81e765-d81e-45b5-8419-58f18387ec76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273653, "uuid": "51208d87-b0e7-42fc-b806-668fea3c991d", "value": "8a103280_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f130cf26-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320593, "uuid": "837728b9-001a-4897-8763-a6ea8ef48dc0", "comment": "Malware payload (Dridex)", "value": "5209abf40ec7ffc0661f591ab7629006", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320593, "uuid": "a2d98218-1514-4b62-9c01-0e5ec79a1bc9", "comment": "Malware payload (Dridex)", "value": "232bc84db437089caf4da6b6941fefb9aa943a9245f4669183d1ea5d1e2fcfb7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320593, "uuid": "9ca53b90-d434-4599-a795-aaacb5d653ed", "comment": "Malware payload (Dridex)", "value": "3e70c12c145ae3c37a8a9d55a567f37d90e51a69", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320593, "uuid": "4929425e-7c13-4c61-98fb-12b756fd68dc", "comment": "Malware payload (Dridex)", "value": "0e16cf72c4eb2098a3f5d5aac1efa3f0af54488fa0acf2946771cae51f920c2d2be947235ce0c8d80f6b9ee0529766f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320593, "uuid": "c3d10263-8061-4fd7-87b8-4fe955d40d8b", "value": "B4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320593, "uuid": "bcb74099-db66-4d2a-8913-993b99b48569", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320593, "uuid": "0c35de3b-b48b-4964-b48d-05527ebf81af", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320593, "uuid": "3db6d650-c151-473c-9c23-b7671f464590", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320593, "uuid": "98635c5c-d08a-4bef-b32c-0250a85b785d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320593, "uuid": "4bb274bd-1665-463a-9439-3dda0ffae2e1", "value": "5209abf4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99db5d0-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320607, "uuid": "cfac26e2-9efe-43aa-a3cb-ed44dd9bfb81", "comment": "Malware payload (Dridex)", "value": "29b297ecc08ff6dc0333dadd35be5126", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320607, "uuid": "6f399fc7-9c04-4a7d-8e43-76b265a9f328", "comment": "Malware payload (Dridex)", "value": "23bb286e5fa4ec92ff15762b75936eacb06f28cc232f68f02377358c01572cc3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320607, "uuid": "dc19342b-bc7e-497e-bbe7-1a83d8503040", "comment": "Malware payload (Dridex)", "value": "db27a2e02d9c5e765d4054319341a2b94eefa9c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320607, "uuid": "6d65aa18-9f6a-4ac3-bd05-4f1a193bb1ab", "comment": "Malware payload (Dridex)", "value": "e97cd35a48643fe92b25af722cd666dfed40fca4a728ed4b6fed7ce9274062c60d5a868cd5ba1d4fab43c4e29b5fb085", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320607, "uuid": "3a426887-c16c-439d-bf57-f003417399da", "value": "B2F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320607, "uuid": "f0d8cad8-a2f5-4212-ac82-781d69fb7fd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320607, "uuid": "ad9f2be2-9090-46da-ba75-c0fcfaa3fb11", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320607, "uuid": "7b8b4592-b91b-4fc0-b58e-dd30d3b94d78", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320607, "uuid": "2d961e3b-5c97-4b55-ad69-bccfa2f7aabf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320607, "uuid": "8ff2283c-c660-4716-aa69-0e4f3a7119ba", "value": "29b297ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9026cd7e-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338898, "uuid": "3560e8d3-3a77-49db-a457-b0204ff2d4b8", "comment": "Malware payload", "value": "bcda8c5fa252611be7a484cac0146a11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338898, "uuid": "9b6a1eb7-7ffc-43f6-86f2-8d9acb2d0b91", "comment": "Malware payload", "value": "23d5cefd807b72a6d8e755aa5531cc87e9832232c6fd72aab07a6ca7eba1791a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338898, "uuid": "e7fd8d57-3d41-4716-aaa4-cabbb6b5b87c", "comment": "Malware payload", "value": "687d7888e722d7d88560ab1d133113561ba59095", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338898, "uuid": "6671e8ac-e0e5-4e5f-aece-21af64e6390a", "comment": "Malware payload", "value": "2cc3eba9482dcd81226b928048d597e18afe0bd874dde7a1b6ff0be5580ccc5d215b92b964094cc0f9a667f7ba520cad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338898, "uuid": "c03a2900-4a25-49ad-a466-a196b6cde0b8", "value": "2DF3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338898, "uuid": "6c1b1e0d-b978-4ef4-80af-c0bb3f26b4aa", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338898, "uuid": "d9719f79-8aeb-4924-a055-1697c9316546", "value": "3072:qkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:UERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338898, "uuid": "c3bc6902-1d59-463d-828d-ca6116884fb8", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338898, "uuid": "5e26c9fd-90e9-40a1-9bcb-5c668b125b56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338898, "uuid": "b01bcfae-4182-4186-8e03-ac1d584145ce", "value": "bcda8c5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b411c4d-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324099, "uuid": "cc00e69d-e723-4a4e-bb9d-9ffc2afb8e4a", "comment": "Malware payload (Dridex)", "value": "d6a6f1d3e4179295d98f13fa7ce1bdcf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324099, "uuid": "39cf9ca1-907a-4157-a608-410e4f4d844b", "comment": "Malware payload (Dridex)", "value": "23ed21d77db12f7eb604ba2a5af6ae4cff25503f3ee5959793704b43f679a5ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324099, "uuid": "a5c9aabb-6075-4c70-935e-cc1efc222fbd", "comment": "Malware payload (Dridex)", "value": "547b95e0eac21fdfd6d08894100f02a990de4466", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324099, "uuid": "e8f3ce85-da6c-4940-a0dc-190d406f2f4f", "comment": "Malware payload (Dridex)", "value": "1bef83530ce70beb18a8bdcfe1a743bb91b5e16bc85bda63c439de6fdf4552e6f9c504b8062600023997a164ecf7fc88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324099, "uuid": "307d7732-4d64-4382-a75d-56df3af0fc5f", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324099, "uuid": "5a43ed96-fe70-44d4-8f12-2af6e01c3abd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324099, "uuid": "83ca6da6-3628-427d-89d0-4689e8e4d3b1", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324099, "uuid": "2d2e5d34-3fbb-4f92-8586-baeb3143a91e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324099, "uuid": "e442acd4-d28f-49c3-b80d-c1c59c067288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324099, "uuid": "e4796a0a-4e06-4334-94f0-b6338a245cb5", "value": "d6a6f1d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ab83f0-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316889, "uuid": "0de6cef5-8033-4418-883d-6026611ad8fd", "comment": "Malware payload (Dridex)", "value": "ad7ed54a007ac68e636ae2728e44cc73", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316889, "uuid": "be0947c6-5c60-4328-8ea6-54204d2fbccd", "comment": "Malware payload (Dridex)", "value": "24194f5eb38249589fe4db07d1f423ec50dedf26b07b6d2f203d6b833d711c37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316889, "uuid": "dbfa6638-b2ef-4683-893a-ff54ea4100ed", "comment": "Malware payload (Dridex)", "value": "62ba6e7133279f578673d6fea2d791927157f993", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316889, "uuid": "998f7273-f04f-4f25-95a9-941126cec85d", "comment": "Malware payload (Dridex)", "value": "279f0998f705c1dc360088133a166e1334ab0af018de6527073464d6796785218e01634855d32d2c9f345ceac0c4cf56", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316889, "uuid": "adcc76fe-c91f-4e14-9d68-af12783805e9", "value": "C5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316889, "uuid": "86131045-ad6e-4940-a22a-23365434ac83", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316889, "uuid": "4753789c-938f-4526-aec3-cae622532a11", "value": "3072:llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316889, "uuid": "e3c986c3-6040-4acc-bc80-443b70e5161f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316889, "uuid": "99e64b51-a414-4cc6-b848-9c2019ebf666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316889, "uuid": "1a1e2d1c-a978-4e88-82b0-a57aeba43954", "value": "ad7ed54a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefefb60-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338520, "uuid": "48f2cdda-9962-49b0-bb7b-b6de10150bf1", "comment": "Malware payload", "value": "2aa22d6243f571a36e115b0c1c88687c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338520, "uuid": "c0a8690d-5750-4d67-b387-235de9a24c7f", "comment": "Malware payload", "value": "242b65edec00ed64d7c10c168a11bb09fc7c74cdd963600d0ce3daf62d4da88d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338520, "uuid": "503287d4-7875-4479-b62a-4159b1225e39", "comment": "Malware payload", "value": "1ba8b43af2cc8ef0757b57397e3eb40ba2ef2da5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338520, "uuid": "491c2289-2532-4d8e-bf29-3e8d24a54cab", "comment": "Malware payload", "value": "43c8f0431165b611b73405359552d1d49e7a57ab6bbcc7a88cfcd66532b7d86eb22b8d3a54937f15e19031eb396d1f1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338520, "uuid": "75cc5838-69e8-4197-a989-95cbde18b750", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338520, "uuid": "df5eda39-e32e-4b8e-b805-621f3e3e49d2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338520, "uuid": "fcda592e-a0f5-4bf2-8c64-7333f9c39a82", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338520, "uuid": "6214fdb9-17ff-4df7-9488-e98efd7b4ffd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338520, "uuid": "79afdf64-e6e0-4444-a012-80e4feca6338", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338520, "uuid": "26a3d744-26b0-400b-831d-a6920b3d01eb", "value": "2aa22d62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970aa6bc-ae8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620320012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320012, "uuid": "bd26bf0d-40a6-4ca1-b3da-18f8ce7b08c2", "comment": "Malware payload (RaccoonStealer)", "value": "d16d0ebaf018aaf61e381b12ab8a8096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320012, "uuid": "5c5df9af-a054-4bb8-bf0c-06a97fe8bb1f", "comment": "Malware payload (RaccoonStealer)", "value": "24499fbfd8a2b2663899841f3cf424b60d60c26351b5d491fd475adf9e301256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320012, "uuid": "824d81b0-ace0-49f2-a68c-4eef06761826", "comment": "Malware payload (RaccoonStealer)", "value": "80d3102cf9c1739f548c1da3e25ea412f5bc2012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320012, "uuid": "e12eed42-d7f1-4796-9ed7-8bc58ff927c9", "comment": "Malware payload (RaccoonStealer)", "value": "88bb3b7aee9eb3fbc81b51632050f90f34d0207e6ad8fdfb74bf3f67a9a202115fcadc65de23f9738d501a4f13608fe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320012, "uuid": "82970984-36b0-4f21-b970-84b40c85a47d", "value": "DDD4F112F180C075EC6714B68D15EBB18E6AB823562116BF2BDC3AF9DF38691772530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320012, "uuid": "814c82d6-5b18-436f-a589-9ab27a2fd2ca", "value": "f7ec5170de034aa3644c4457a2b957d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320012, "uuid": "50071936-29bb-482c-b8ed-d5cd40e66486", "value": "12288:tHFV+0Trr+Edes5eo5RskmTJU2hc1JYOb2tn4+4Gqmzmr:tlVLnhcs1k1JPsYph4JGJzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320012, "uuid": "44b00bcc-e65a-486a-98ba-0c3bd8c50b57", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320012, "uuid": "d72e8390-010d-4a03-8ca0-d506fb30e3d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320012, "uuid": "9966ba92-28ae-4a8d-9f2e-80cabdff887e", "value": "d16d0ebaf018aaf61e381b12ab8a8096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90c5b00-ae5d-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620300366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300366, "uuid": "46085e8a-48f0-469b-a0f1-36dc72cd0473", "comment": "Malware payload (OskiStealer)", "value": "b0926a6e4c1887f81024b17df73199c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300366, "uuid": "0e22f977-974e-4b59-96e3-dbe9960209b5", "comment": "Malware payload (OskiStealer)", "value": "244cc88debf6465b93584d1f63c592c52bd029deec2f24fc4a3328725838d239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300366, "uuid": "c407e761-90c3-4b4f-a244-186f15ea451d", "comment": "Malware payload (OskiStealer)", "value": "3fcdd6ff8323713c8cf3e11edca6c5e195dd4139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300366, "uuid": "70810399-1142-4a35-8661-fda357c0bd42", "comment": "Malware payload (OskiStealer)", "value": "759726d6a13756c2da13f1f178aab1fdd5eb0ab7e33c44ac805788c49c736cda04e1a9769501150d62805bb9b6f4093c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300366, "uuid": "f2151ec0-8c8e-4db4-9e86-b6d11b792f90", "value": "DA64F1D7F6D0D9E3D554A9301D36F13DA6764A5492841FA2CE80FFAC7812222153F8AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300366, "uuid": "94d948b0-6b3d-4479-8421-5bf4f3dced75", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300366, "uuid": "d7d643bd-9988-458d-847d-fb9740a1cfb9", "value": "6144:r9X0G1ssJABzz0J6DZ49XrOwDgBHiU/liJNatZ7Vael:F0mfABzz0qq8wDCiUMy7Vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620300366, "uuid": "c43baca9-971d-46dd-9f31-a4231dc6e858", "value": 314076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620300366, "uuid": "df00d377-a222-42b6-9a32-7883d2fe1645", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300366, "uuid": "a4ca835b-19e8-4119-91a9-077fb975ca05", "value": "PO5621.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31c1273-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620309724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309724, "uuid": "6726a178-8029-4480-bbe7-71521dc7d3ac", "comment": "Malware payload", "value": "0c69a7ab4a9263c4074bae95fecfea77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309724, "uuid": "9c6a2b26-07f7-4af2-9272-c71780ccb630", "comment": "Malware payload", "value": "24d0d19cfa859abbd1403071aefcf581d104f575973a5a6dbb14123c8e2e453b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309724, "uuid": "65585fb1-d373-444e-9dc9-b9efa588b90e", "comment": "Malware payload", "value": "ed38d924f1db513b4d2dcc39e4214a9893846b40", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309724, "uuid": "b4e6fac6-b89c-4e94-a01e-1ed57518c376", "comment": "Malware payload", "value": "ff98f5bdbf6c3bcdf2f5d722fc5631212f0fd566206ce3c8d088a0da5d2b03ffe8377ef9ead31f6e374cabffb765ce8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309724, "uuid": "6e1e2787-4675-42c4-afaa-0d9577ec8a91", "value": "93B38C07CC098AC7C16D93FA6D075DF96E0E5719D8D62FEF40321F8A3A251631E4B1AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309724, "uuid": "62a391bf-6f28-40ec-853f-18c6ff45c709", "value": "3072:cWQvKINbjvw548LMb/oqKO8NnS8+60KcY5CCFTjy:c8AbT648LM7D98Np+ET5rHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309724, "uuid": "18e84c80-cb10-4bdf-b1bd-95189dc2d587", "value": 113004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309724, "uuid": "2e631a00-1771-4f81-b31e-1f12155e87fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309724, "uuid": "27be7a78-a7be-43d2-9626-4fefcbafc17f", "value": "0c69a7ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4598eb-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284485, "uuid": "5d347cb8-1ca2-4153-994b-b5cff30ca83b", "comment": "Malware payload (Dridex)", "value": "7412d856c38b3c59b471a3641341629b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284485, "uuid": "fead1f3b-6268-4fca-aeaf-66c4ae740700", "comment": "Malware payload (Dridex)", "value": "25adbf012dfb414307b13424694f6c7f5051ac0d73a04e279e09817966ec26ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284485, "uuid": "c5176755-0654-4584-ab6c-5cd039441097", "comment": "Malware payload (Dridex)", "value": "fc4fec6eb588cb96efc4bb64a0d3bc3ceed73c2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284485, "uuid": "8b96b675-efca-425f-be39-552a091c7a37", "comment": "Malware payload (Dridex)", "value": "0c523a8c32bcd840b598bb88f7f25a7fff8b53a5d18821cbf6110fa5993b8d31e605e844794a4f26a4947a010919b314", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284485, "uuid": "085e4c88-ae74-4e83-9107-3763b15d7527", "value": "78F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284485, "uuid": "b1fdf0b5-0a79-4037-8b7a-237e8f41c528", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284485, "uuid": "97acda07-8df6-4707-b3a2-d15e6426fce6", "value": "3072:4B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:R4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284485, "uuid": "41ed45b6-369e-4e25-a92b-1b71a7dec9d2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284485, "uuid": "841d6c09-b45b-4542-94be-cdef5a3c9631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284485, "uuid": "9a06c4fd-f88b-4d35-9990-193e3aea1fee", "value": "7412d856_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedec0ac-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339030, "uuid": "5be10fdd-5315-43a0-9cd5-517f10f071cd", "comment": "Malware payload", "value": "e4b1566edc602f63779eb631c8911ab5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339030, "uuid": "b7068d17-cec9-46f1-bdd4-03a6b7a8e71b", "comment": "Malware payload", "value": "25eaafab28d420762afa77acc6d01298d06e6fa4d8c0a8cccfd7c49389190077", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339030, "uuid": "9d6323ec-192b-4721-924b-da311c6ee3b7", "comment": "Malware payload", "value": "67b59ba57007cfe5b7ec002bceaffac201aa8849", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339030, "uuid": "45d30da3-c2cc-4f0c-a03c-bdb0cdb75da5", "comment": "Malware payload", "value": "f2ca2307831d37c86ff4aaeec0cf3b9a6e4deeed3109f2c472708828ace7a445c74aebcd08b29b8669762884ea69f74c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339030, "uuid": "96e67521-9235-4a10-9957-0646518e3a04", "value": "EDF3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339030, "uuid": "2ce6b5c9-4d53-4e40-9deb-041b0f192725", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339030, "uuid": "439ddc57-7b65-4e58-a2ed-600f131bfcdb", "value": "3072:6LG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:xERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339030, "uuid": "844c5c36-affe-4f55-8e35-955756fa760c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339030, "uuid": "3281b1b7-6d68-4a65-8f25-b910afd8bc9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339030, "uuid": "b6181866-13d9-4fb2-bb5c-177e8a59ca21", "value": "e4b1566e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02e3c8f-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338979, "uuid": "7373ae9f-a038-4c82-af15-b7296832c96f", "comment": "Malware payload", "value": "bf1df2b407773fd4389e26c821723b37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338979, "uuid": "c75ff456-73e4-4034-85f7-2f0e4bc594f5", "comment": "Malware payload", "value": "25ff60f45a6f07fbfeb61a937c6b1de43e14ed92b21c66e446c79abdca8de43b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338979, "uuid": "891529b6-cdb9-4d2b-8eb4-c6ef8e8fed60", "comment": "Malware payload", "value": "a15492e6f73a38a5fec55a0e11c6331b1bcbd034", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338979, "uuid": "740dd07d-210b-42a0-995e-c27f45a46197", "comment": "Malware payload", "value": "7a239fbf0c491d3957ac929943871c0bbbe0666be98de181f74f3eaeb546570fcfe4b604e23a15138c91b7ea55590197", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338979, "uuid": "15ea30cb-2347-46f9-a961-c8a1636697a9", "value": "92F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338979, "uuid": "12eef563-f35f-4627-ac0e-50da4ce0a2ed", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338979, "uuid": "9c29fabf-d760-423d-944f-25e8e1253b3e", "value": "3072:xkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:ZERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338979, "uuid": "824940e6-2770-445e-a7fc-297e159957d1", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338979, "uuid": "543c4d4e-c8a8-4d2f-b0c4-b37eb9091281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338979, "uuid": "91ebc734-fc2f-4be6-9b22-ef411fe32125", "value": "bf1df2b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae94002-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266465, "uuid": "8ac38dcb-e143-4d55-a21f-20dabac78dd2", "comment": "Malware payload (Dridex)", "value": "556e077668f3ad4dbb68db2c6815a691", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266465, "uuid": "8cf57019-08b1-491f-940e-bcb65246fc10", "comment": "Malware payload (Dridex)", "value": "2628d0bc8d40bce8568ed319f5bf92e2217570e3195f8c27cab27b265dc1f2ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266465, "uuid": "f137f9ab-62b1-4956-b7e7-ebdc297a6ea0", "comment": "Malware payload (Dridex)", "value": "ac9e226fd4a6dc77f8301d70349ea3fcb49b9b1e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266465, "uuid": "3fe16356-cf27-40c5-b00d-8711ade73351", "comment": "Malware payload (Dridex)", "value": "fccc8da8220248496baa9abd5af972f53d5a3737ac5e7df4a2f2fe832493402095b280d945e2f82ac1e145dbb18a5600", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266465, "uuid": "3c49d1af-5fb2-4c6c-87b6-38aac88679f2", "value": "24F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266465, "uuid": "dfe526e6-33bd-4687-8fc9-5d34f16640ac", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266465, "uuid": "2d52b169-bc15-48d7-bfca-247ab76d2b7a", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266465, "uuid": "2113a4ed-0650-441c-b80e-42f43d822d9e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266465, "uuid": "20efad76-300e-4193-8469-7e7f9efec4db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266465, "uuid": "b9ea30ae-beff-4c5a-a9a0-4270d38d1034", "value": "556e0776_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9762b1-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331322, "uuid": "c9ae7a8f-a8a7-4bd2-a8b9-a9c99173b711", "comment": "Malware payload (Dridex)", "value": "164a247723c44c5ab95d3af11a95a244", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331322, "uuid": "c2a6483c-23be-4944-8930-b63cac50ac14", "comment": "Malware payload (Dridex)", "value": "263b5112e8dec1ff130c5cbece35a925b5aa1cdd136d4be8bd51ca6ba472a6e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331322, "uuid": "d9b2c49c-a0b4-4164-adc8-d27614a47f6b", "comment": "Malware payload (Dridex)", "value": "1fac3d543b984c86faec84e49f8b5dc9d9868ee9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331322, "uuid": "51b953d1-0e43-4e03-af76-5947bd020366", "comment": "Malware payload (Dridex)", "value": "85aeb17d0c544ce731327740bebd93f2eab1c0e9ac8150b1f6faa8fbc6258fc4cf96353a5ba834d2f46c9835374caee6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331322, "uuid": "1d2caa97-d175-41b6-bf21-ff8965033cb6", "value": "F4F3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331322, "uuid": "531e9dba-a98c-4f66-b55d-563dc7c779d6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331322, "uuid": "a98dbb0a-9af0-4c05-b8b6-f0d92f54b394", "value": "3072:/e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:m4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331322, "uuid": "617f11b8-1f95-4030-9100-e50d22cfada9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331322, "uuid": "8e183ecc-2bc2-4a55-b281-0ec322b91156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331322, "uuid": "592572d3-d7a5-4804-b15c-45b49e25a81a", "value": "164a2477_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3116b425-ae59-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620298366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298366, "uuid": "4d851ed4-8abe-41aa-a4d9-bc919120e570", "comment": "Malware payload", "value": "0b4aec6dfe0e914d7400fdf23b7c5507", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298366, "uuid": "dc52013f-8c86-44d6-a8ae-aadb107dc340", "comment": "Malware payload", "value": "266bf3acffa3cc8a975a440d12eb2d12972cb4ca530aa1f3961ab2d68a44ca2f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298366, "uuid": "69298497-b9fc-4fda-a29e-d8797b6adf9f", "comment": "Malware payload", "value": "ce5e1b5b2b3e755d52049e81179cd98b092868c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298366, "uuid": "d930b209-55c1-49e1-b0d9-a80268e814b2", "comment": "Malware payload", "value": "4f3649320eb83fed6a4142a99fc31cb421b6e19866a5dc61ab92974aa98c339e499ee16044a583a827b7ba985f55e035", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298366, "uuid": "972a06fc-28ae-48f8-baaf-48f130a299b6", "value": "B3F312853DFB3EABD5080502477E0F8B6D29AB4F74DA582E81C40D069687ABECC55369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298366, "uuid": "9ba55c81-3e00-4b50-afa9-635d8c1051ec", "value": "3072:n+mEZi4BsubH1leUpUDdL37dsZiREoyaTRROnxjzEXR7xOq:+mEXbmDdL3ZsZdcTRRONEWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298366, "uuid": "cb9f61d7-cf69-47fa-9dd5-11895e81c849", "value": 164416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298366, "uuid": "ac84f769-2d4b-49db-ace3-78a33b5915cd", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298366, "uuid": "25ef532c-3303-43d3-8fec-c88c22c5c653", "value": "XL_HakUr106.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6cf330-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620327722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327722, "uuid": "fcf6c548-ef8b-47fa-b031-a5cb5268378e", "comment": "Malware payload", "value": "dbedb87ba150b3ceae4ac1036fe3c9bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327722, "uuid": "8da79c2a-7a06-4a2e-848c-90e19d9568d7", "comment": "Malware payload", "value": "26903fb6387161be921360f3803668c1d86a277dee246323bf1e11ed972641b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327722, "uuid": "f153a3fb-113c-4a20-ba32-cc1ce5cf9b3b", "comment": "Malware payload", "value": "711ebf4c3910d2d91a5a13024aec23a47bde7d97", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327722, "uuid": "6240388a-ce94-426a-b2f4-3109d1327670", "comment": "Malware payload", "value": "50a565e460786af0bd5d3dcf17d1c10cef9e0712db1ee3896e157dfff2c5fe320cd1fef3f6d4587cc4a221949c775fcc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327722, "uuid": "24d3a27a-384a-4f5c-85a4-fa44934509d8", "value": "0E8337219B2A9BC0ECCA79770255CAB1E7314FC0470377EBBE6C764D2B68D81492616F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327722, "uuid": "07c6e168-1be6-4573-a8dd-79f7c071d1e6", "value": "1536:FO3bWc00NWf1bTDkNnhipFnY5IE2vYjsRXdX+:FOrtNWN3DMInY54vYjsRXdX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327722, "uuid": "da16746f-b6cd-4344-a57f-719c36b46546", "value": 81051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327722, "uuid": "6a337750-2cc1-49be-872c-6a35f802108a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327722, "uuid": "cc40d54b-ff9f-4e5b-9b08-9557af385d94", "value": "dbedb87b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7932ec-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284455, "uuid": "2ad1fe2b-604c-4cb6-b8af-11397d5c8c7b", "comment": "Malware payload (Dridex)", "value": "98bbd13d8367044a2e55d8f024bd92c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284455, "uuid": "590cd901-36cb-4035-8a88-257845453fdb", "comment": "Malware payload (Dridex)", "value": "26c069349fc06fe27b863f0a839b1940804c9eb31b855ec76d22579d4acc16cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284455, "uuid": "78961c37-907f-4c35-a929-da1e4b96a2c8", "comment": "Malware payload (Dridex)", "value": "6950d04f4c261ac55a0133938df09567d34ca995", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284455, "uuid": "50f579b7-f7a5-406e-b8db-a3942f9e1a25", "comment": "Malware payload (Dridex)", "value": "fb77ab9b8acf580dfd3811a2a614a631380af9d07333b8abf5b24b21b823e66c5a69a6f53faccafb5723ee8084507f72", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284455, "uuid": "a78fb59f-9440-406e-9097-e87f5271e39c", "value": "C2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284455, "uuid": "e7ca6902-6607-4633-a8da-258f4c74cb25", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284455, "uuid": "05d7658a-d025-4255-a7e3-d87f2b220aac", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284455, "uuid": "c7d18be9-0205-4f5b-b071-4fec58d60e2c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284455, "uuid": "b5f6e668-c84e-4932-b429-498eb0233752", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284455, "uuid": "6c2d81ab-853f-4859-a320-d08c9e5f4b13", "value": "98bbd13d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc563e0f-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339402, "uuid": "1539a54a-324b-483b-96b8-8083e9f7aafc", "comment": "Malware payload", "value": "58e1a8c24c9f1ce710939a5eda00c611", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339402, "uuid": "3f831fed-7248-469c-84ec-7e9478b54dfb", "comment": "Malware payload", "value": "26e78d9bf0bd63705e8ba1bb96ab532f887cb1976f7f010823460d6436c0a2d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339402, "uuid": "9b351acd-1f6f-4ddc-87ca-5e88fef29b15", "comment": "Malware payload", "value": "3eeebfe5e943dcbd365c27dde68c91ca2c60af2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339402, "uuid": "36b55e6a-4480-4872-86df-960a19acda67", "comment": "Malware payload", "value": "18671254c5eddfbf3c8a835312de04c00f9de943862ba7d0fea79bd039e5480efe35a9c50ad1d668b67fc755a269e2d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339402, "uuid": "17836c15-ec8c-4895-9810-42ba8e43af8f", "value": "33F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339402, "uuid": "d4c4fb20-9dab-4350-badf-94cec1ae2a23", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339402, "uuid": "06993078-afa3-40d4-b32f-2cc75cb4913d", "value": "3072:meG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idDf:KERMVPG6+Y63HoG1QawL40Prx6KRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339402, "uuid": "1829a1e4-fe06-457c-aea2-412bab7608d6", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339402, "uuid": "37d3871d-57f9-4513-a938-79c9cfa99e35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339402, "uuid": "9652a713-2d00-4c7a-9566-4d908f8c5315", "value": "58e1a8c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6c938b-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277311, "uuid": "a1bb02f8-e0fa-4727-8da8-890c31fb57a5", "comment": "Malware payload (Dridex)", "value": "a60cb0b6bb7094a6afc4896534c78261", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277311, "uuid": "dc306f36-6635-490e-a112-cf9f069d6e1c", "comment": "Malware payload (Dridex)", "value": "270cd30372056acabef12d55fa674528b8f29e81c08d5fac009e6ee6cbca28f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277311, "uuid": "14e59d98-3bac-4e60-8e5b-96399e4c9877", "comment": "Malware payload (Dridex)", "value": "8dce407ab43a3e1fc1cb16ffe104de2e0eab374a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277311, "uuid": "0c0b1584-6049-41c1-b77a-13f41531b8dc", "comment": "Malware payload (Dridex)", "value": "394f17c53045385b2d5f80e2fbff265902e232e611889463a49348cf148196d612fae3f78286fc2981f66c20f71929d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277311, "uuid": "a26b1f08-c239-4738-b97b-9a69700ab40e", "value": "52F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277311, "uuid": "7ad22b8b-c7e6-4f29-8790-3220038f1168", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277311, "uuid": "5a164f18-b276-465f-a5e7-2e82afafa4e5", "value": "3072:NB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:A4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277311, "uuid": "52f53b8c-70cf-4c97-b734-6d480911584c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277311, "uuid": "22d4aff6-3f41-4c82-aa9b-aa89508cedb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277311, "uuid": "01bdba70-a283-4595-b832-9bc8f10c27c6", "value": "a60cb0b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdc8969-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620302520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302520, "uuid": "4ef72248-e198-423b-bbb1-220a0b46f854", "comment": "Malware payload (Formbook)", "value": "60b88477173379e55e2d5c678d2a32ff", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302520, "uuid": "85fad4e6-8b85-45f9-b59e-e2f4e15925dd", "comment": "Malware payload (Formbook)", "value": "27563e3971b4f2baf6bf551323b1538809038aa456d5e0c02dd5e6a902b8f0e6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302520, "uuid": "45b3cf63-d3e2-4495-a379-c01cc0602860", "comment": "Malware payload (Formbook)", "value": "8dcccf0321468fa7e9c51f5cac81ac6da43c0cb5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302520, "uuid": "1806957c-501f-4d2b-b6fe-2ae5e8fb45bf", "comment": "Malware payload (Formbook)", "value": "820767612ad4d902c0112b9092ea4e15e64a8264ab0800b24213a948f9d16e4b420e5c87977eea2cd7ac8a9dc6803ceb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302520, "uuid": "58b6af98-1930-42f3-9ec3-8b3eac15e443", "value": "B8D4B577194978CCCACAF8B174E74199BC02F922C4C4099B29C7DFA929D244BBCD716B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302520, "uuid": "d45ba119-1860-4979-ae31-f1dc39d59e0b", "value": "66b72cb050bf1788fdd2accdb893bb19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302520, "uuid": "9a9cec34-3206-4a17-95aa-4a80b46b7180", "value": "6144:P0iuS5WG1jOS7mzIzNVfvIPxi3LfeLnZaz4LL/t4bVDkS7+1akhuDUUqdVvI:PrMG1jOQrzN9glLnZaknOqzbh4cVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302520, "uuid": "629588db-480a-4ed4-8a69-434a194883ac", "value": 632519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302520, "uuid": "131c5aba-63a0-4bad-a3ec-549327281a97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302520, "uuid": "b9ae8f1b-966c-4cf7-937d-7a6494033a77", "value": "60b88477_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c183dfc1-ae31-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620281428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281428, "uuid": "6a4fedc7-bbf2-41a0-8031-568c02d455ef", "comment": "Malware payload (Stop)", "value": "5b6e0ad1b996da7f22e6c55d2338b53f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281428, "uuid": "7e53785f-2b4a-408d-a280-768fdc8bbf1d", "comment": "Malware payload (Stop)", "value": "27ac1959b9c2137b608a59a1cdfbad3d398941c92f590a1d92a9fbe004d27ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281428, "uuid": "06b985f8-6ca7-4fea-8f68-c794560e357d", "comment": "Malware payload (Stop)", "value": "85e19f4fe4f6372e945526106532daa1b9eddb63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281428, "uuid": "bbbd8905-7c48-4ce4-a282-bbb58597c455", "comment": "Malware payload (Stop)", "value": "e2b26b2ad07d5f2fc90954d64e1f7904285cd825e1802a1124e373b85c002cf424e48d81e63eb428a97ebd6738413afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281428, "uuid": "5b0d7adb-ce88-417b-b6d1-a1428c07996e", "value": "26051221F684C075DC9720768C65E2F04F9E7C610A621ABF3ADD79FAEF38691752130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281428, "uuid": "b44937f0-7b04-4d97-8136-ae4e2b4caae1", "value": "f82467823ad136f325b286fba7047ffc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281428, "uuid": "4df9129f-e423-48c9-9546-b4a6e72caac8", "value": "12288:JZZ3iU4xUu+Im2MO9DcsDwSo0YtYBJ/rPsHQ3eWT0BuFUowxZLgeBOGpzGzmr3:JZQ34a/iQwftCPsHj8lUowb5pzGzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281428, "uuid": "963935b1-0bec-4e54-bbac-27f4e7d101db", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281428, "uuid": "b47c8c36-cb25-4e0b-bd4c-90d887f3c834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281428, "uuid": "66f144fb-328f-4d7d-bc10-c042c1df13d7", "value": "5b6e0ad1b996da7f22e6c55d2338b53f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ec9560-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620339367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339367, "uuid": "d7ff0baf-c14e-4e95-a699-1102b3b33d00", "comment": "Malware payload (Dridex)", "value": "5b88c779c4bc7cc309387a6567e8a525", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339367, "uuid": "55b01a09-78b0-46ca-8806-438037f031e2", "comment": "Malware payload (Dridex)", "value": "27b58a781ded45bdcb0db5b517ed67c21fd8cd06f43c029cc7d8d395a2bbe1eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339367, "uuid": "29d1a839-855f-486e-a795-a5ac059a012e", "comment": "Malware payload (Dridex)", "value": "9853eb4e0923516506a9be4bd78520d7f0cd5587", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339367, "uuid": "542dd936-8fca-45d2-afa4-1d241b8422e4", "comment": "Malware payload (Dridex)", "value": "76c77ff91ce7af5a3199262fa3473e6bd0b4f6dadb1b31f32f98d75d155b7e3db080ee65004bf1463f38c4a8a784263e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339367, "uuid": "79145f12-b97b-4f68-bed5-e7601402bbbc", "value": "A9F3C004D167E6D6C51A583222EA3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339367, "uuid": "2fcdde24-b4d4-4ba9-9214-82745217fe60", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339367, "uuid": "06a9960e-ea87-46da-b52e-49944f8f7469", "value": "3072:wmG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idn8:YERMVPG6+Y63HoG1QawL40Prx6KZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339367, "uuid": "10798c14-0da6-4b32-819d-a6d18cab408e", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339367, "uuid": "f65d5192-9434-4500-a4f0-1b48ada890f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339367, "uuid": "3dfbb9b6-f92c-4b97-8e12-2a4786698d71", "value": "5b88c779_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275ee0b1-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277304, "uuid": "3fca61c8-8d2c-4688-801c-0538d5d56144", "comment": "Malware payload (Dridex)", "value": "82788d739d28eb0670bb86ec6e6fe9bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277304, "uuid": "2392b06c-bbd6-4058-85b8-c495d3ef9cab", "comment": "Malware payload (Dridex)", "value": "27ba252dcd87c65c8721546d217784e933d7c2f43a003b45dc45efc503514491", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277304, "uuid": "07168d8f-5c7e-4f56-b8b3-8b5b531c5c10", "comment": "Malware payload (Dridex)", "value": "ad5aab0f56c54cfaabadc03f0c908ee1776125df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277304, "uuid": "6348e034-5c44-4297-8eed-746f2b7512b7", "comment": "Malware payload (Dridex)", "value": "2331858407987ca19e1050d47bee73ac137e0c7e8b83eb6c1e053d0cfad29d0be6098d558c41b4ca290ff42096b35da0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277304, "uuid": "9ee3f803-473a-4c9a-83c8-ce52171aa2e0", "value": "53F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277304, "uuid": "b317d1d7-4364-4c64-8389-fb0670fbe3f3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277304, "uuid": "44240616-d38b-454e-bd1c-b0663968c543", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277304, "uuid": "a6c380f7-c3f5-4c37-8e46-e3b90b654478", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277304, "uuid": "4b0bef92-32e8-4811-aaa1-97c8306a6fee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277304, "uuid": "8cc9fc90-c84b-4f0e-b23a-d412d3364a56", "value": "82788d73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9e4010-ae5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620300858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300858, "uuid": "be7ac181-8ffe-477e-8226-017e47df04f0", "comment": "Malware payload (SnakeKeylogger)", "value": "1d4de26b85c95f82219504c5f62fa629", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300858, "uuid": "8c04aa64-1e0c-467c-86e5-9e912a3ef88c", "comment": "Malware payload (SnakeKeylogger)", "value": "2801fa00fb7333b8c2b8e0a7ad1a6dae593049cc0a313c86f71cdd08e69ee1a6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300858, "uuid": "fdb86ffe-3ea3-49f5-be3b-3e0462f37277", "comment": "Malware payload (SnakeKeylogger)", "value": "b2c0aa82f80afd655a17f433fa455cd88bb11de7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300858, "uuid": "a8200f01-56b9-45fa-9bf0-a0f9c5f91d79", "comment": "Malware payload (SnakeKeylogger)", "value": "2a93f234b19223079392ad687d697cddf4de108520af8e2a776bc5858bcf1d851238489c838c6b2eb067434176317059", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300858, "uuid": "aea80fb4-fab6-40f2-94fc-ed2dc07eb732", "value": "4DB433D9A73B6B2A73F1B66F716697E701890ED01A0FE211C662D39C4D606E42237FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300858, "uuid": "ce2f442e-39ad-4b46-b032-03e51b77b147", "value": "12288:65a2yQACta2xj2cN+pOqwKvvxhzEAJkHK3ndRoUy6n66ocwk:pqfNJEpiHK3dOUyvfcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620300858, "uuid": "b0dab88d-0824-4a47-a8e0-3cf6fdc68ce8", "value": 533073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620300858, "uuid": "11b8a278-bd94-4e14-a802-4aa5b5002cfa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300858, "uuid": "789a547e-53a7-4dfb-874f-de37b2c1ca15", "value": "Bank payment return x.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ce6a73-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280951, "uuid": "4b847db6-3f9b-424c-9ca1-fee3fd127928", "comment": "Malware payload (Dridex)", "value": "471080ea60e22183f12f5a3cbb259e29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280951, "uuid": "fa2e6b02-8904-4821-ba20-8125e4fa6470", "comment": "Malware payload (Dridex)", "value": "281deaff81984e186610770a18946bbc47096d2a8682f69bd051bfac971030f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280951, "uuid": "1ee06b82-7e08-4083-991a-46f79081c11e", "comment": "Malware payload (Dridex)", "value": "1b59ce7f1856d9f0175c9cabe91c8ebf8974e6b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280951, "uuid": "5cca1e7a-bdbc-46a7-b754-67a4d08bb56e", "comment": "Malware payload (Dridex)", "value": "26e86070c2729dd64e43f612aa793adc6f6ba78f2ee48344ae565652d39f85de968f8f85372edded73b65d6a57718e66", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280951, "uuid": "228b48a2-4e75-40a5-b068-49d792cda6bf", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280951, "uuid": "8e5d72af-bebf-4f48-89ad-d472ec76f4c8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280951, "uuid": "908c7713-517c-457a-98d0-0b87a1e4b064", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280951, "uuid": "83eeddd9-aa32-4b63-aeba-c7984f4621bf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280951, "uuid": "d16ff119-9061-477f-93bb-fd2ed0a95cb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280951, "uuid": "5f33ee29-75ca-4b60-9976-59af5ab17bdc", "value": "471080ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384b08f0-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1620334885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334885, "uuid": "bc00d362-3126-4265-b818-66469cc9d7c4", "comment": "Malware payload (SilentBuilder)", "value": "389033e6344dfd187f5e11eb84879faf", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334885, "uuid": "26da26ed-3eb4-42e4-8c55-084d73bbe9dd", "comment": "Malware payload (SilentBuilder)", "value": "28aa0371eff399c03d0ba976b8ecd3eb2c191fccd52775c669e37bdfa5eef0bd", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334885, "uuid": "aabfad26-fb73-4c0f-a749-6f72d6a224bf", "comment": "Malware payload (SilentBuilder)", "value": "49e245741d6f4529e729da82573f950e91716e8e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334885, "uuid": "0229ed4a-8262-484b-802d-eebce2a40fda", "comment": "Malware payload (SilentBuilder)", "value": "1bc2e3d2430c38661058f9014016d553e93e3377c0a07b7c15ae1e44ed06af0a04640f9144f355e8523169e5d4276f95", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334885, "uuid": "7c70c09b-e46c-4c8b-bac0-8e40d97bfaf6", "value": "7A547192A602B0ECE1147A35D82D41EF46A7EEA92F58B2C72C0473B37F761E12FC1559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334885, "uuid": "495eca23-69d6-48ea-ab8f-5d7d426b7ffa", "value": "6144:WcPiTQAVW/89BQnmlcGvgZ7rDjo8UOMXJK++P29d:Hmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334885, "uuid": "aef8af28-0b72-4e55-a26e-91608bf1bc86", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334885, "uuid": "d69b95cd-fe2c-43f5-baac-59ff3c27ce76", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334885, "uuid": "540b81a0-c386-4e64-af65-451cb8e333a2", "value": "389033e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc334208-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331268, "uuid": "390a8769-e870-4a77-bf03-f1d26b061595", "comment": "Malware payload (Dridex)", "value": "f6283ac6605932d9ecbde1fb1c7bdca1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331268, "uuid": "a227f5e8-fb05-4a65-8c58-6e4abd5e9779", "comment": "Malware payload (Dridex)", "value": "28c8c8b53722341cd3baff33b9ae73c7fb8a7bd092e207573efb41e2f62b9dd8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331268, "uuid": "5e68af3e-6e2e-4dbf-abaf-9b3a7883835a", "comment": "Malware payload (Dridex)", "value": "8a9cc31a0a93898db8f9ffd6e332d915447d8e4c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331268, "uuid": "c5b08006-9119-4b66-b567-c9742627be96", "comment": "Malware payload (Dridex)", "value": "0b97108f5eb052158be1e348c427b2e1357eae168c0e70bece0f5262a07e2b9c2a395e66697beaa9fc69bf137127c73d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331268, "uuid": "810fcd93-41be-4072-9d2d-c189e07fa4d4", "value": "45F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331268, "uuid": "6b754eff-8729-41f5-b4c5-e7ed928c9333", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331268, "uuid": "61f4329a-feaa-4221-967e-65145cc777c9", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331268, "uuid": "e017477e-1d2f-49f6-a299-4847243afa0b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331268, "uuid": "cda426c5-833a-47fb-8e9e-42b67d739bf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331268, "uuid": "db4079fb-16fa-4e87-bcd3-5e05ddec5714", "value": "f6283ac6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e1d43a-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327714, "uuid": "a6f31467-99c5-415a-8dae-ff6f60bef651", "comment": "Malware payload (Dridex)", "value": "ede136d3bbb99d19eadcb0d80d59b74e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327714, "uuid": "5b726392-b3d3-40d2-8f15-35c80eedd8b0", "comment": "Malware payload (Dridex)", "value": "28ee57cd6bcb15e46eccaf8aa7d8c92b097e0b3c8d100e3f3c233608fe845321", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327714, "uuid": "1d6c0a01-56a6-4eba-9ec2-59104fb01d05", "comment": "Malware payload (Dridex)", "value": "63180248c201c4a0390fb15ac11bc7bbefca5047", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327714, "uuid": "2c20757f-90a8-4b64-bce6-af79a8ad3197", "comment": "Malware payload (Dridex)", "value": "452a4853e99e7e4708df12a9e033093217af9b5fabd0325adfcffbe9e72548c1ddd2b4e40f18f640d0692187cd564f46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327714, "uuid": "4aa4162a-1ced-4633-b7d9-5a28fcb1decc", "value": "08F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327714, "uuid": "f991e5f5-9b26-4121-a4d3-0dfc05d12a87", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327714, "uuid": "406bfc06-2dbb-4028-b907-4dda5a1dfaa1", "value": "3072:oWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:o42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327714, "uuid": "27e69a8f-d3e4-49e6-b5c5-9af518cc03ae", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327714, "uuid": "3aecdaec-12f2-4e79-9ade-6d578dde5cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327714, "uuid": "616dc51d-49c5-4817-819b-5d6145288e68", "value": "ede136d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2b1a59-ae2a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620278146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278146, "uuid": "dba3931c-624b-4752-abad-0a3fa9856228", "comment": "Malware payload", "value": "34e03669773d47d0d8f01be78ae484e4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278146, "uuid": "9c63df57-794b-4414-8a03-6df89cff9450", "comment": "Malware payload", "value": "2919b157d8d2161bf56a17af0efc171d8e2c3c233284cf116e8c968dd9704572", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278146, "uuid": "910af0ff-88b1-4f3f-8977-07ea73ccde50", "comment": "Malware payload", "value": "4b0a7e2af2c28ae191737ba07632ed354d35c978", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278146, "uuid": "37718b97-0415-4d90-a4f9-1e7d6dbe1dc4", "comment": "Malware payload", "value": "92ab11087cca168c94007733b670b029c1a538f8b5300acaefb85fb963ff7b82855cefa9618b3b8e56a32bfd8df3ff5c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278146, "uuid": "36a60151-e6be-4b3f-a8d6-cb7ec04f845f", "value": "32A4AF23B592D0F5E01458B11E27B37267D9BD704D369D02B7D83EAE6A720C0A73AB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278146, "uuid": "25a0ab00-9dcb-493d-9061-4677af16d647", "value": "0dc55f64d9578dafbcec0f9ac57346c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278146, "uuid": "0d1b396d-85a0-4303-bc4a-a5fe2d343974", "value": "6144:ZvZ2iKiZ/QAKVfiROzkViZwc0W/1vNuMqTp/CelAaWjSZ/nnnKCXP7:J7wVfiRuqPW/dgMqIHdjSFnnKCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278146, "uuid": "bd7bd70f-b9ae-4d60-9f03-b4b3192d3755", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278146, "uuid": "0ffee970-2eef-4e41-9766-87b85a7e5ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278146, "uuid": "610b4d30-5277-4d1c-8a37-e9c1866a08a0", "value": "images.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e306f7-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620310418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310418, "uuid": "71e2338f-e322-427a-9bf5-38e4765b63ed", "comment": "Malware payload (OskiStealer)", "value": "716e89179126809cc5a4b476a03dda11", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310418, "uuid": "76c91273-79e0-48f4-bbba-bd032527b768", "comment": "Malware payload (OskiStealer)", "value": "2976262aeed56001f874b183072c03360a1dbcdde67bfdcc982078d3bc246857", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310418, "uuid": "94969bd4-8b1a-4e8e-a5bc-427b364996b7", "comment": "Malware payload (OskiStealer)", "value": "29bfe1170a118c56776938fb44289884da261294", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310418, "uuid": "a697b0ab-43fd-4fcc-bc6a-9d02defec090", "comment": "Malware payload (OskiStealer)", "value": "b58dc7db7cc9c2ce592db3567a3a3e5f138569f76ff5d77e7fa1ba8a3b67c59e5a4ff49fdaaaff9ee80b6c30eca7eef5", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310418, "uuid": "79a251dc-139a-4f79-9f90-55ad52885dd5", "value": "BD24F1026B98D211DAE239795DB6F3108A70AD00F932D5DB98E4F31FDA30B55C568366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310418, "uuid": "b665ef0d-5c27-45e2-a6be-bbc08d4c5408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310418, "uuid": "728312f1-01ec-428f-9f45-c42a97d12f6d", "value": "6144:bGZ5xItfUeAIQHuA36cd+69ergkKsd83:8ceeAItC66+69evD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310418, "uuid": "45bbc4ec-b81a-44dd-ad09-9f80cfc14024", "value": 227640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310418, "uuid": "3f5edd73-a9d2-47b3-8daf-e690921fecac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310418, "uuid": "fb5d5410-b99c-465c-a94e-7c63be7168af", "value": "IMG_0501_765_013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c3b868-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327742, "uuid": "a544cb0b-3111-446d-8ba0-b40d9e35b3a6", "comment": "Malware payload (Dridex)", "value": "8a5f4a1a2d16306201680fee35d897f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327742, "uuid": "1a7b0b00-e401-45ed-9d90-61b549458c41", "comment": "Malware payload (Dridex)", "value": "29ad9009a6030904fd54f97f6fa67b14aaacdba0a729029adce734d1578ac3a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327742, "uuid": "ef596867-7131-49b2-8eac-757668b12a04", "comment": "Malware payload (Dridex)", "value": "0befbf5ba0cab28aa53531d2043d025aca445c0b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327742, "uuid": "1f0eddbf-8795-41a1-9d32-3feda567891e", "comment": "Malware payload (Dridex)", "value": "24fd3dff70af61754679e091e320af14111b92b77db1a792f8589973ebd7e46d5df9e69efb160acbd1f7d1ad6bc38f70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327742, "uuid": "505dd35c-13f6-4b8c-9918-6365c2c033c8", "value": "73F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327742, "uuid": "a185bfd3-fbfb-45c2-ac25-72e0215d1e17", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327742, "uuid": "6089c20f-4b7f-432e-8ad9-3ad93b38c4cc", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327742, "uuid": "66e0ed01-7d82-4bbf-9ba8-f1c378f57d44", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327742, "uuid": "a2e3a040-2ee5-4b15-8feb-85b609bfb8d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327742, "uuid": "b7fac088-767b-4eba-b086-f0697f261d68", "value": "8a5f4a1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbafdd7d-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309765, "uuid": "7acdd24f-6d61-4e77-973e-39160bbd8c8b", "comment": "Malware payload (Dridex)", "value": "953e309b84d078c8fee27ed912b43ddd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309765, "uuid": "4a509497-5a08-4f5d-a535-9dfae272b10b", "comment": "Malware payload (Dridex)", "value": "29def8e3fe44cf96d533c18bb4b60c23fdd4b827a7142b5808dee0c182193a76", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309765, "uuid": "098d02cf-b5b8-44c1-b059-fa9429acfc6d", "comment": "Malware payload (Dridex)", "value": "96a60c5814e3dfd1140e9da0ea15636365872208", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309765, "uuid": "342c138c-9005-418b-a901-45978d67b90a", "comment": "Malware payload (Dridex)", "value": "7a292dd8a3d7a811d0046cfebde4eb7543989cd41ae1654bb54ba165c7d37aba10712ccc2841a94a61f168a0f71d42b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309765, "uuid": "028e2278-f8b2-4f2c-a7b9-197943c4a0e9", "value": "3CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309765, "uuid": "feefab65-143a-40ac-8446-ba82950d1a27", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309765, "uuid": "b80d5878-bb0a-4a12-89e9-19013a0f2962", "value": "3072:oiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:zeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309765, "uuid": "c85a682f-992d-40d5-b16a-e424543fd6c1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309765, "uuid": "496346c3-3b09-48ee-b353-07a9b4b38f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309765, "uuid": "959c33e3-8350-46b2-94ac-a6d8139a35f9", "value": "953e309b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e2f7a2-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280974, "uuid": "8d032b73-012f-46fc-a55d-3779586d421b", "comment": "Malware payload (Dridex)", "value": "55c5ce77c8dfd97bdda1306557b46fef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280974, "uuid": "803f924b-58b9-47d2-8114-672a078e3221", "comment": "Malware payload (Dridex)", "value": "29f93856c0b187799a57ceedb3f4f6b259cda2f4dadfca69151b7b69e274c82a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280974, "uuid": "46943ded-e2e5-43b7-b7bb-8bacd65883b8", "comment": "Malware payload (Dridex)", "value": "5bd61944c8eefb655b4891b3227dad14fedbc512", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280974, "uuid": "a2a1fb0f-8048-401e-b5e2-b2b1ad932720", "comment": "Malware payload (Dridex)", "value": "9f9483ef16c0aa8d2069ee7f70de6c983b3f6cb8114406e36c67c719a0a6a84b10bf8b8a263109cd859bab8b5b109341", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280974, "uuid": "a02b1297-815e-49c0-84e9-96fde599d869", "value": "ABF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280974, "uuid": "818d5b7c-bc53-417d-a860-e7b3440e56a0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280974, "uuid": "969181e9-9e00-4c92-b4f1-a65c68d25c91", "value": "3072:8A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:83J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280974, "uuid": "6d97c5d8-fa86-4987-a546-780876000889", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280974, "uuid": "c5ec4276-bb2b-4e51-83fc-efbe19bac95e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280974, "uuid": "660ecbed-23e6-4ecf-b6d3-40a6b93d5a26", "value": "55c5ce77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b771ba41-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620310188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310188, "uuid": "f3f7758d-36ee-4cb3-9562-ebab7f1f63e3", "comment": "Malware payload", "value": "773cefd4d9ec88ca7dee9d9f58b89688", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310188, "uuid": "681a71c9-627a-4d61-b729-2916e16aeec4", "comment": "Malware payload", "value": "2a07a267504200452790e7c1f70c31dbf23f20dadd8fca4bc47be501f0fc6ee8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310188, "uuid": "f4111c13-7695-4996-a5a1-5e5ca653cc3d", "comment": "Malware payload", "value": "5fc357db30ec757fd4d046c34b14cc5b6604bc26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310188, "uuid": "54c039f8-28e6-4ec9-9dea-984747d867ca", "comment": "Malware payload", "value": "a8dad6534acb1d8adc6b4e5bfcbc4cd53ff588a37ba31236231a6a52eedb1fa28726c271bd4610789c5b7e9c604b9c5b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310188, "uuid": "9610b770-5d10-46c9-b499-3d1f218c94b3", "value": "FC523A06A7E6877BCBBD1F778873A5500ABAC704A55BBF3D8CD810660EA33444773661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310188, "uuid": "413c0381-d253-474b-a5f0-f14333a7115a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310188, "uuid": "70fcd7c3-e8fa-466d-aff5-82536540876f", "value": "192:ETZxH3NCFmtcDDQXWy1ypy5xKGIclp46Ip1GKsJ9oZjlAfz0DMMgvuOjOn:ETZzSIc/QXWyoFclpJKkkjyrBNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310188, "uuid": "3ba72034-5c7a-489a-9732-0db0a02a2401", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310188, "uuid": "48ef0807-4600-4b6f-b6e3-93ea0e51c43f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310188, "uuid": "ae5971be-28f0-4fdd-957b-e75a8c390255", "value": "bitcoin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d1d273-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338527, "uuid": "626b4614-ef2f-468b-a6fe-ebf61d301aae", "comment": "Malware payload", "value": "f27e4d08a7dc687fc6d7b2c451f57082", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338527, "uuid": "3e11867b-26ee-47d5-a464-266001d9dcf9", "comment": "Malware payload", "value": "2a0ccc02e9a142454acbca330dc38beaffef6ce5c2a1f4a3a9e9ca6afee4b541", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338527, "uuid": "f8a66369-a9ca-4201-98e3-e098f6961dc1", "comment": "Malware payload", "value": "d066cfc413a666651b45a13d7f0e8c55eb5d6c7c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338527, "uuid": "ef99e35d-b6ea-4563-ae6c-7713dce8d47c", "comment": "Malware payload", "value": "11cba60580eece6bf42c0780f34d409e9f4c0f024b61b247b23379252301fe5b83bd2af68e25914e8b5b3fdd3aba24da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338527, "uuid": "4a49a154-7087-432d-a140-e40065d6e31d", "value": "DDF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338527, "uuid": "76db182e-f910-4fc2-b1f0-ca667b6f9682", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338527, "uuid": "f58e5d4d-e277-4445-aeb7-91838ad2b556", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338527, "uuid": "7c9d84a7-3a52-472d-9dcc-411f7ae3c949", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338527, "uuid": "22f4b231-a7d8-4866-83fa-29c6fdfcb5dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338527, "uuid": "5310ef9a-0c4b-4f6f-9c3c-ad57f27567b1", "value": "f27e4d08_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3046f9b7-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259280, "uuid": "c6939713-617d-417e-9df7-8940b64049d7", "comment": "Malware payload (Dridex)", "value": "08a9be91a20867536f373d7b1bfd9e1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259280, "uuid": "c3dbaefb-234d-4906-bf26-06a021bc05d8", "comment": "Malware payload (Dridex)", "value": "2a4d48bff66e69707208c530271c9fea3f900d5803d2bfac2db54d353b718419", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259280, "uuid": "895c0c00-0788-440f-9c6c-16d1513a9668", "comment": "Malware payload (Dridex)", "value": "d7669dda6b65f52a72000ce8324de848ef34152b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259280, "uuid": "c1734672-2e55-469a-ad39-a285b6fe4d18", "comment": "Malware payload (Dridex)", "value": "13b98d44fe0de9320dd3a0cfdada7555626f912674a3b4ce53f39f1121895a21f782e52d2667568a96958de02d7cc0eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259280, "uuid": "b10198ae-3631-489a-8ec0-a6f6cfae8113", "value": "BCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259280, "uuid": "20b01e59-6e3d-4a6b-8f50-00bc3eccd5db", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259280, "uuid": "28089f88-2e1b-4afd-8d09-924fc401c6b8", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259280, "uuid": "893dcd6b-7da8-4910-95a3-d3132c84f000", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259280, "uuid": "9ff02b74-e00c-48f3-af78-368fa6ae0546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259280, "uuid": "9d2b3d48-c129-45b7-a10b-df6efde07bef", "value": "08a9be91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dafe6fb-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339243, "uuid": "2018e81e-41ac-4270-b6a2-6e9598c52d56", "comment": "Malware payload", "value": "ba8439cd225584ccedc83585806402ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339243, "uuid": "fffede2e-0879-4851-a586-2a4e5fbe7a4f", "comment": "Malware payload", "value": "2a7154a7d76bfb2609aa4248206fd06e137ff1c2c4ae6a33bdab0a1d122a6ed1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339243, "uuid": "5f5aa126-bae8-4c3d-85f5-73605a946da1", "comment": "Malware payload", "value": "52ef1f76fe3185ec6d2a6ecfa416d60e50066c16", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339243, "uuid": "d0076c40-5cf1-4623-aff8-b61c607b6a82", "comment": "Malware payload", "value": "16f418a3fa549be6c56ab19ff3db3c805e4c78192c771609c75ca41bfee43c2bf9e4cf7c2805b72a010dd2c166714de4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339243, "uuid": "3f2d20a1-aaf5-4b64-9623-7c32f991f850", "value": "FBF3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339243, "uuid": "9ec4d20e-627f-499d-ba49-f084e2d9c6aa", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339243, "uuid": "ffdede1a-1151-47d6-b3ca-65a8313fa7f3", "value": "3072:+VG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:7ERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339243, "uuid": "7b4592ef-51d2-46b0-b401-d808a233aa2c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339243, "uuid": "51abc906-6daf-43e8-aa72-40b303aa0d67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339243, "uuid": "e5d13495-069e-4c1e-a012-52c96720a56a", "value": "ba8439cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e6a121-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259313, "uuid": "6167041e-ec30-4674-85e4-4784a489614e", "comment": "Malware payload (Dridex)", "value": "126f0a9b2a45d831fe27ec9cbde14b33", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259313, "uuid": "1415936a-1662-49d0-88d2-3ed95bd18455", "comment": "Malware payload (Dridex)", "value": "2ac724d091af4fc0ca5737cf121fbea864c1696b1e4546d722b8a5dcb1de7bbb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259313, "uuid": "19b99022-40a4-45fc-91b3-8d03f65e2245", "comment": "Malware payload (Dridex)", "value": "25dac3f0776f59e5a9b0e4132a5679b41b3e0c15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259313, "uuid": "910de60f-1181-484b-b2c2-8aa32ef7c646", "comment": "Malware payload (Dridex)", "value": "e25053e6659ebc927defe36fed810714b7decb4436865db4fc73aeaf02ac40c31e26037129beffafe09a40f936c00e14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259313, "uuid": "5668597d-e608-407c-8945-eea6768c7dc0", "value": "7BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259313, "uuid": "48191046-fed5-490a-8123-f71f8ac7df87", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259313, "uuid": "62c3e349-9d76-4f13-9f5b-67c15ff8c100", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259313, "uuid": "35aafff3-2de5-4296-9261-b5f01358fad7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259313, "uuid": "355fcec0-230e-4926-936c-44c0989b6dd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259313, "uuid": "5dc70c07-a272-41ce-92df-0aa585a7431c", "value": "126f0a9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887825ae-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316981, "uuid": "f68b089b-c7ce-4616-bf8a-dc3ba12cb0f1", "comment": "Malware payload (Dridex)", "value": "ba573e66a8965910422a37dbd5543f1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316981, "uuid": "8d2e8725-5f2b-4fd1-a34d-0cfa61e47e83", "comment": "Malware payload (Dridex)", "value": "2acf6e3b18b5596475ef7329130322eb70b43546641f929babd02f47eaf74dc8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316981, "uuid": "a72ee03a-587d-4ac2-8cbe-b0ab17ddee91", "comment": "Malware payload (Dridex)", "value": "d4bf5168bdd085f5f799be3a90cb203052bb7167", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316981, "uuid": "98cea8d8-54ef-46d1-9620-e17c7596da6f", "comment": "Malware payload (Dridex)", "value": "cc8b7310e12ac3b9e81bbde1233766b851376aad5de9bfd4521332873a7aee58b210cd93c1bd3f27e9dc8de848a1171a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316981, "uuid": "a6341fe7-92b1-4a0d-bd31-f2221c8d8ae6", "value": "8CF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316981, "uuid": "d8dd5993-457a-4477-9638-aaa93ff3fff1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316981, "uuid": "1c9aa0b9-c7d1-4049-8240-ae744ab83d1c", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316981, "uuid": "5f44e20b-e2ea-4cd0-96a0-524b7dcd1dcd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316981, "uuid": "68755895-b914-4eaa-a88f-901354f07c66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316981, "uuid": "a21b6ec4-7fc8-49c6-8721-75b5122f336c", "value": "ba573e66_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862366af-ae98-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620325567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325567, "uuid": "65d965e9-0fc9-4523-91d5-9749be3f423b", "comment": "Malware payload (IcedID)", "value": "6aa51c55e5540eae3008a465edb5b38a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325567, "uuid": "5fad00f6-cd98-4c61-b79e-9cb7787f1ed2", "comment": "Malware payload (IcedID)", "value": "2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba0246f164f0f2eccc952", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325567, "uuid": "770e357c-c3ae-4fbc-ad02-598477b4acf5", "comment": "Malware payload (IcedID)", "value": "e2802f3e9a832f3c208cef0a62b965d7ac6da557", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325567, "uuid": "8dce0a95-83c4-47fa-b68d-a23d68c4ba7c", "comment": "Malware payload (IcedID)", "value": "42824e7a974b467b931627988e90783cd7add8a3a331639120b6d812aba937c798ffef9dcc6d11cd5490f35152e7c4d0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325567, "uuid": "687cb067-24a3-4ce8-9aa7-256b5f94f9e2", "value": "43346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325567, "uuid": "c84fdb9e-2733-4fab-be9e-f0635e77599e", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325567, "uuid": "ca33c0fb-2b51-4528-abaa-3d006c21f580", "value": "6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888IR:dJJLaU1mUGduNzGSijExi3oomlnG9PSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620325567, "uuid": "5934540b-8c72-4e78-af3a-fde58bd436de", "value": 244232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620325567, "uuid": "85150cb3-b38e-40e3-b2be-d99aefd953c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325567, "uuid": "c57914f4-938c-47d7-84a7-a6bd8aac49a3", "value": "2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae98e3d-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338513, "uuid": "63e8e6f9-9569-4610-b55a-d4be1e1c2ece", "comment": "Malware payload", "value": "60f74a48f4eec6c57397c89c24befad5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338513, "uuid": "24937dcd-3830-4a00-ac60-1c5b2eaafedf", "comment": "Malware payload", "value": "2b07195ada5a341acacce6a15c4d5091db5487b38bf91ef1ffdb728ba4f2fe0a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338513, "uuid": "0de5c310-52d5-4141-82e8-6a0b2e18363c", "comment": "Malware payload", "value": "5f0bff25fa419ee0b72628e8f9c5a26adc3a869e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338513, "uuid": "5203243c-63cd-44de-ae73-1e3d81f66ee2", "comment": "Malware payload", "value": "dd6292c9597bd58f98c2019005948df6da9c515c3986eb33ce440bccd510ce585cc6f57c05d7185b36ead7bd7738d89d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338513, "uuid": "4cab86fb-4df1-459d-a6cd-d87699834dac", "value": "67F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338513, "uuid": "8833db85-8364-46ea-9244-071fdea2703d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338513, "uuid": "ba1a533f-b242-4cfc-9357-8d2932961140", "value": "3072:5lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:5lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338513, "uuid": "be576928-6e87-4201-bea1-97fac321e699", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338513, "uuid": "b29c3829-55be-49c9-835b-e591c514f1b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338513, "uuid": "06ed8d36-b134-4b4d-bcb0-423f2f66c5d3", "value": "60f74a48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68e2f68-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302563, "uuid": "fbe4e446-25c2-4e60-adb4-c44401b30cd3", "comment": "Malware payload (Dridex)", "value": "54ff5a3052f37321b7fcdfd9f8ca1366", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302563, "uuid": "e2f5971d-ffeb-4de1-a155-03efdd5a246b", "comment": "Malware payload (Dridex)", "value": "2b4c1e9f908a4c880e7b70a4b3cb8ac2e19e75ae99a4201d5c1b45a7dc8f6c40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302563, "uuid": "9b22a086-7b96-465e-afc6-36e2310f4c3d", "comment": "Malware payload (Dridex)", "value": "ebdc8d353a654cdb7515e7c3bfd26a070656bb52", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302563, "uuid": "1d28d94c-db0a-4540-96df-a069555192ab", "comment": "Malware payload (Dridex)", "value": "0522dd5ba50b138e07c8694b428d3dcb8ad4bf1ed0d59799cf5c73950b75d5f7e23cb963dccb7b8510dba4b62a10ec88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302563, "uuid": "8bc42d2e-38e7-48cf-af67-ccd1e0d8b89a", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302563, "uuid": "f9458a87-6228-4e87-8b27-a7347d7ce791", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302563, "uuid": "8ac61d27-495f-4133-9ef7-a34a974a2207", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302563, "uuid": "9456afbb-da29-43cd-abce-aba75154a2bc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302563, "uuid": "a9acbd6f-f9de-4fc5-9c22-41f83fa2a9af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302563, "uuid": "22788b98-3e70-4cd0-adc7-99146feaeb4e", "value": "54ff5a30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9899e2-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327730, "uuid": "4ab16797-6c9e-4930-ae7c-c6da6dc5bfc5", "comment": "Malware payload (Dridex)", "value": "5a22d4fc57e9fc09e822ec4f770cd37c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327730, "uuid": "d7233dfc-cb1e-4237-b0ac-7c01c782c1ce", "comment": "Malware payload (Dridex)", "value": "2b611a5c61e9f52cc500d4e471c99a75970ca21d8ab76fb3da006939e6fdf06c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327730, "uuid": "6d4ad0a0-9157-4da7-8b61-a914258b7c69", "comment": "Malware payload (Dridex)", "value": "ea7de758f7951e0583fddc856e6aa4bd84d15ab5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327730, "uuid": "1eaea403-af38-4e41-a11a-25770c61f55c", "comment": "Malware payload (Dridex)", "value": "e8fcc9c6b2ec0557c3f369ed0f0fe5164fe8e6ea626fbda4ea7200c444ba52897a2e26e58918bb5f09d79d4c1764ca3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327730, "uuid": "5f78b5c6-3cf7-475c-a374-44891b4ca8f3", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327730, "uuid": "0cc90321-dfbe-4bbb-98fd-6f1136e413df", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327730, "uuid": "2ab809eb-8a91-4c88-8209-72e8a9c6e5af", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327730, "uuid": "d3ea017a-cf80-464f-9845-e0510e81be81", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327730, "uuid": "43cfcc89-74d9-4459-b60b-9b33f49d7faf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327730, "uuid": "45b2062d-f683-49bf-bde1-440c82e244fc", "value": "5a22d4fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e4bf3f-ae56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620297384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297384, "uuid": "91c778eb-a902-454f-a08b-394ef5d6f2c0", "comment": "Malware payload (Stop)", "value": "b61223f5063b9290cb7177e0915be648", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297384, "uuid": "ef9c042e-293b-49a7-b855-031290048994", "comment": "Malware payload (Stop)", "value": "2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297384, "uuid": "d81ef3ff-64ed-496f-b67b-bbe675085eb8", "comment": "Malware payload (Stop)", "value": "041b2958f50c016f1d2525848b2e0b3cefad1dc3", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297384, "uuid": "77579197-7637-4ae2-9d04-c1f65e38261b", "comment": "Malware payload (Stop)", "value": "8739a6227a66485984ca87684a8d0cbbe6a929ff4bcc14818c2a2dd0c71aa021c9052d90071741236ea6f4245570fc30", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297384, "uuid": "247908f2-ee12-44e2-afb9-6a4423bc3f6c", "value": "65150212B080C476EC5B14318C66DAB54E5DBC6246625ABF2BDC3AF7EF28690763530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297384, "uuid": "f660c18d-9255-49cb-a04a-125bbf10e0d3", "value": "ef8bfa67cab8f52c3f5ca31f772f6178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297384, "uuid": "02b0c80f-675b-4775-b263-9294c2514c5b", "value": "24576:hQxvS/h/e8PZD/PrhkNcW2S4+f8nalYsefFzy:Ovch/pPZ7PrpFJagz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620297384, "uuid": "acb5ab0c-ee49-46b3-8750-b1c1eb99f7a0", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620297384, "uuid": "aabb2b39-df02-4830-b1fd-f6d9d4f72491", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297384, "uuid": "79db7d9e-e2c3-48e2-944d-2ab29f2d5944", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea7d1e6-ae25-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620276082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276082, "uuid": "d3cc0a00-fc25-49c3-9029-30a7c50a34e4", "comment": "Malware payload", "value": "1873fc42b4fae3f8eb4b3f5dfd3f91cf", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276082, "uuid": "da24e64a-3673-42d2-a755-c0eae276bf4d", "comment": "Malware payload", "value": "2ba20ec5f212af3fdabd231ad0d6d124a1a6440ff3780a5b2401856ba38075ca", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276082, "uuid": "5874dabc-a43a-4496-8ce0-ebbb184a4094", "comment": "Malware payload", "value": "9664b9496e31eac9e122bf709839185fe190a16e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276082, "uuid": "290a37a0-1f6e-406c-8ccb-4f2e2a9e9a4f", "comment": "Malware payload", "value": "8f037482f4aa51a7eaaa135378ed2d667ddf7e8048347e3491d0d61b392129c28907f1f14c2bbc34e1c0621934434264", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276082, "uuid": "675b90f5-ada4-4f43-8a05-f2338e094dd3", "value": "D461B61AFC47D15C6BB5231BED978A62FF1B401B5DA3101875DCC2451F20809A7ACF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276082, "uuid": "b9c1c939-d435-44e2-9502-1ffe8a438912", "value": "48:Ax0JckjOjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQdr+:tHWChrffoypvK0elkEYZaM8zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620276082, "uuid": "f431379a-c24e-4f67-9738-fd73a0150a8a", "value": 3209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620276082, "uuid": "4596acfe-0885-4975-9c3a-6e579cb014c1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276082, "uuid": "2f5ac751-5ffa-445a-888e-ed376fb9830d", "value": "tFVq3UKA.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d799b6-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324115, "uuid": "a77f04a0-2cb0-479e-bce9-f3e99aace726", "comment": "Malware payload (Dridex)", "value": "76928ad9eabceba48c43b6813f4c2ad1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324115, "uuid": "d2eb0549-8840-47ca-90f4-a73b258d968d", "comment": "Malware payload (Dridex)", "value": "2bb2ff1918fcb4e6898a8f8f4311dfca4559c1991285aa6b24dd440f166d7d0b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324115, "uuid": "2ecc7271-49c5-4b1a-9adb-034a12d4a715", "comment": "Malware payload (Dridex)", "value": "a721828ad073058c2c8ac4a04599ca63e3e7be05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324115, "uuid": "c4bfd551-2c56-4b03-8858-c76b776680cd", "comment": "Malware payload (Dridex)", "value": "e80653bf4caa28a1eac12e5306371591c63f08ab1d2e16bc4ac8ec31ef04f580083154301c9364cfc92fa4ae8f7ed1d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324115, "uuid": "96a59415-bd04-436c-96a9-5e797fcdfcc2", "value": "7DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324115, "uuid": "fe88f458-4127-4a82-bfda-dfe40aa95b67", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324115, "uuid": "d2fd18d8-baff-48f9-8e61-2b677c7b8deb", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324115, "uuid": "62060717-1616-474d-8a7d-aa3d760c6209", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324115, "uuid": "e0cf5d3b-31e4-4bd7-9cff-893c4066ddfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324115, "uuid": "524b5420-6440-472d-b29f-547d5ccd1a45", "value": "76928ad9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51e9062-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620320599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320599, "uuid": "e30f6582-b2e7-486b-969b-fb8e904eeaee", "comment": "Malware payload", "value": "f5dc0d49f06e5c0bd28e1ea873938b32", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320599, "uuid": "5e9ea3c4-8d29-41bb-a59c-97ef59157ab9", "comment": "Malware payload", "value": "2be5d2504cee536278881d42a59b920aba62960bf9b1277289c1d5067b0bec63", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320599, "uuid": "0c727093-25e8-475b-861b-7c5e261781be", "comment": "Malware payload", "value": "cda43f3c5713fbadbbfb8cd90a7664c234b9f969", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320599, "uuid": "33e96971-3287-4bb6-83b1-8848b1e8c5c7", "comment": "Malware payload", "value": "b7446bf80b4c8e54fbb0899f2cd21510d06e52fd98f5676dd97e038bc0f3182ed1de77c6f3bff67490cec520f3cfd72a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320599, "uuid": "071182f1-9179-43f6-b943-f5682461d3e4", "value": "B2F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320599, "uuid": "0823e23e-344e-47d0-b338-e2af2dcf6955", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320599, "uuid": "6ec86db8-da3f-4920-937b-e3421d7259b1", "value": "3072:EIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320599, "uuid": "72fdcb67-72fa-41d1-b35a-298547d55ff6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320599, "uuid": "49f342b4-3b61-4541-bf83-80493d51af83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320599, "uuid": "3069f22a-a031-40b9-85c8-169fca700de9", "value": "f5dc0d49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f0054f-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266507, "uuid": "f31a4404-3727-451c-916c-85a68b870ef2", "comment": "Malware payload (Dridex)", "value": "32b2a8739406a7963bb6437672435028", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266507, "uuid": "842ccda4-e2f7-436a-a740-7e93f639e564", "comment": "Malware payload (Dridex)", "value": "2c380ab0288eb3d731c3683e329e0a7bde7de4e8f82ab74ae8805c4a2b2c1d6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266507, "uuid": "c3413ee1-0c12-40ee-81bc-3437f9a38951", "comment": "Malware payload (Dridex)", "value": "1dd327d37bd5b6c27d1c8f8b8c49aa44e2d2b3d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266507, "uuid": "cbdf2a89-60e0-4715-8057-b1e3c5bde268", "comment": "Malware payload (Dridex)", "value": "d07c6b06bca4e534a2b25ece5a9b25343f2a89ce6b82239dc99aa8dfbb4adf77094cfd693e9b0976e3a57edb219e6e8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266507, "uuid": "9b9a8e32-dc54-415b-a75e-91bb1e818670", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266507, "uuid": "d33c2a98-d600-43ef-bf1d-3e8da1bfcbee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266507, "uuid": "b96c163c-6dfc-400b-803c-4e7a2fcd8f34", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266507, "uuid": "434e7279-300f-4014-a490-9c8d16636110", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266507, "uuid": "b9f66986-aaf4-445c-b5b0-b07c91a70d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266507, "uuid": "d2a45a65-a0a8-470b-a21e-732d9b6f90bd", "value": "32b2a873_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cff57b2-ae23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620275166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275166, "uuid": "a4cb9256-0078-419f-a0ff-719251dfa769", "comment": "Malware payload (Loki)", "value": "a9fd9c601af6e30f91cc12d6c6d0831b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275166, "uuid": "71c712d2-cd57-40dc-b596-d88e3b4b60fa", "comment": "Malware payload (Loki)", "value": "2c3cbc680c780cafc1f14b8050cd345cdb4e593813ed059f294046c288c4514b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275166, "uuid": "b6faa986-dc64-445e-b728-4e9f5351b02f", "comment": "Malware payload (Loki)", "value": "defbf0391a749612570834b6a834178eec57f800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275166, "uuid": "f9297070-d8aa-4296-995a-51a7c80711b3", "comment": "Malware payload (Loki)", "value": "966c318bc349d6758eb98aa601b49242faeb1c618edf5ae937c8510c09440622ff7d28c5b3df15dc0809a918265b3822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275166, "uuid": "c97306bf-d75d-49a6-8432-98868ff91040", "value": "6E058D04B7A45BE7C2CF43BAE199271193F5D416B28EBB8B6948FAF53C5339189001E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275166, "uuid": "43206cf4-5159-4568-8ea9-42311c034fa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275166, "uuid": "677f64aa-6060-46fc-973b-0482c7ed80b0", "value": "12288:xcN1fxhwL8mLAHefRIZtbVqrTwqEZI2wxrcuxR9yXACaMuYvKZ:eZyJAH/ZtxqEZdwxouxR9Qvs3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620275166, "uuid": "74da846b-46be-43b3-82d1-20e131f63fe0", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620275166, "uuid": "9edbaa07-dea6-4a5e-bf6e-941b2c0475b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275166, "uuid": "74563006-bda1-4a4f-9892-d8d3ba365352", "value": "USD500,360.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73708ada-ae53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620295900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295900, "uuid": "f2e2477b-070b-48e9-bfa9-e94c993b42e2", "comment": "Malware payload", "value": "1b35fe4218120ff90d6ca89cbdadbcf2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295900, "uuid": "48a2a9b2-34d2-4b62-92a3-b6a0d409a80d", "comment": "Malware payload", "value": "2cb7c7e26b7ffdddba8ac8a7647a1eaacf01ddc2a09784540a1cbcf6f7c7378f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295900, "uuid": "dc012bef-e868-4a2b-9dad-f674d126c407", "comment": "Malware payload", "value": "d0f346e3c66f6802726a4daf676c6370d1c21070", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295900, "uuid": "661f0e96-8166-482f-bf15-534d87383c3f", "comment": "Malware payload", "value": "1400e2b1f919268a2a789d8116f0a98f4ab81346541b58358e7aa09ec1a4cd68f02476b3b00c4d52b032c7d135067a19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295900, "uuid": "b161c762-7793-4ecc-b46b-934b26e511eb", "value": "BE23E036D6C239CEF422AA306CB2B91DA40AF49764ED4E5634EF8A07C706F589D17347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295900, "uuid": "6b73bfcd-dbf6-4df2-90b7-624a8aefbbfe", "value": "768:y4IlLVip6+0iDgSMKkolTRQF1ihNWOYQbJJfJtEXv/b+op4pUA0yg/e3rIvrl5k+:0rZ1noBRUQbJFIrrryuebQk9f6TRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295900, "uuid": "74fc1f88-f602-40a3-8e41-96f664e95319", "value": 49660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295900, "uuid": "ba8cf93e-8fb1-4c42-aeeb-48023d8b5929", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295900, "uuid": "c0932deb-b432-4d2c-b537-0ee3ce7f365c", "value": "PO2000122059.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293224a8-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259268, "uuid": "ed8a6858-454f-445e-b9ba-ca5334110312", "comment": "Malware payload (Dridex)", "value": "c017638e9410fb2fd14420756eafe452", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259268, "uuid": "9397e7bd-9d8d-4ce7-aa7d-4520db3a0389", "comment": "Malware payload (Dridex)", "value": "2ce894194875f08f5779aa74089ee5fc1f7819e243ded7c0ecf62ce98ed284ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259268, "uuid": "f05d0d39-bde9-449e-8284-05c0a3b841ef", "comment": "Malware payload (Dridex)", "value": "a9ccc610556f370437e3f2c0fb198cf1b1e0ca8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259268, "uuid": "ff12dac7-6349-4a7b-917f-7906631149f3", "comment": "Malware payload (Dridex)", "value": "e6a822f24c4f3d1e40c05346c0480bb80813323e93950b9346b20337c17f77e5966d1a52ec533c7fb52d60923e9b48d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259268, "uuid": "eec6f3b0-49d3-4660-a123-c5b180e5ced2", "value": "05F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259268, "uuid": "d010ab6b-b685-4931-b443-96d3b84bee5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259268, "uuid": "577b6df8-7764-44f6-8597-7b016e98300f", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259268, "uuid": "2abd102c-7ac0-4fd6-adce-88080cc02e37", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259268, "uuid": "7b162a81-4bea-4bd7-851d-921472a271ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259268, "uuid": "3e64234e-704e-4047-b097-6bef8cc17534", "value": "c017638e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc164e5-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285237, "uuid": "83ad197e-9c9b-4ca7-bb8e-9e3d54261678", "comment": "Malware payload (AgentTesla)", "value": "493ad1f8ca789369fba7e830b4b467eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285237, "uuid": "974def09-a8f6-4357-a163-7b3f5dfad72b", "comment": "Malware payload (AgentTesla)", "value": "2d1092a7b695bbb591bda40dc73fcde878da770e6eda6a9686bc01e6207d5566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285237, "uuid": "4b255b72-bfbd-4527-8773-fc7ce14dd61e", "comment": "Malware payload (AgentTesla)", "value": "4c1bc6ded0ebd96e5ede3868e9d19c4446947977", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285237, "uuid": "52dd8321-5754-4d6d-8995-ade893fadeac", "comment": "Malware payload (AgentTesla)", "value": "cf56d45ecf6dc627cc9b5a0229b2d0470b5f7c0fe40702a640b1409d82d9fe0ad0b592cb87ec0d946f605d74d467991f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285237, "uuid": "bca70e86-087d-4abe-a464-468e0f568b24", "value": "4D554B91A154C8A9E87B07B1AC2BD43015E37E5DD5B4C10C6AE97E5B3BB3381609FE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285237, "uuid": "a0bbe054-8f4a-431a-9588-c9f17922f71d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285237, "uuid": "525502a3-2e36-4fbf-a849-d823f329dede", "value": "12288:0/YDVHqTno4M4EZuMJLgnjenvIJNXgQq0pEAnSivfu3U:0OsVEZjJuuAXgQrEAnSz3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285237, "uuid": "bb5e03b7-17f9-4998-bca0-535c9ff6a307", "value": 1386496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285237, "uuid": "1abd7555-c15b-4db9-9fa8-b3b4634335a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285237, "uuid": "6bec264a-a12e-4873-bb78-3d1fee0e4c07", "value": "KUTIPAN REVISI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bbe833-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339176, "uuid": "00748a74-5190-4895-87a7-71a4fbec21b4", "comment": "Malware payload", "value": "9b50f5321fd2069c344dafd2ae6b2943", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339176, "uuid": "e9a3585e-b6e5-4f61-ae62-65b55d79b563", "comment": "Malware payload", "value": "2d151fc8757e31b3a644c7a274d8c27550f02e7420b4496c8c00f2416c513092", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339176, "uuid": "b5826442-1b46-42ca-ab48-0b470232d897", "comment": "Malware payload", "value": "96c93ab465058f94dbb289ddf2dd47cfe81628c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339176, "uuid": "d08e0cca-31ae-45fc-b758-802a7348ed4a", "comment": "Malware payload", "value": "9e2449edbdb538d7a5ce824ea813a3928966d4105f88171328d48c2dad857ceb298f9dbf66c96897421d6e524f8af755", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339176, "uuid": "7d3bf0fd-9621-4684-b560-2c567881611d", "value": "35F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339176, "uuid": "3acb0d8c-4f31-4079-87f0-a8e79da57c77", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339176, "uuid": "2c591f12-2c88-4668-9586-f94c3cb9d171", "value": "3072:6jG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:5ERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339176, "uuid": "c1c1fde8-1354-46f5-9f4b-26e5f6758870", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339176, "uuid": "e713b5bd-eca0-4e5a-9703-c74c92231c90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339176, "uuid": "5c27b6c3-e15e-41a9-a8ee-7ba03cd94109", "value": "9b50f532_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e423a2-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620310457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310457, "uuid": "ac22469e-488e-449e-a8ea-2fdf690d2092", "comment": "Malware payload", "value": "8752f1267fbf42b834713064e6eeaeae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310457, "uuid": "ac441ab8-8b0f-424b-927e-af0d484052cd", "comment": "Malware payload", "value": "2d32186b5ec439a90d1259818dffbe2a7e0fed992145661ad32302bcde1a8834", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310457, "uuid": "5f11f411-2474-40b3-8dce-e531dd6a3a83", "comment": "Malware payload", "value": "dc8d6298105c4e3050e7bb8c943dc9769dcc07e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310457, "uuid": "81dde6d4-e5d4-4c99-a025-563fff1e0879", "comment": "Malware payload", "value": "7e8991862931c6a3ed150bbb6ff4fa194d1a95656f13e2d3f1cda5ccf59c375a3417519e33c3c008cf3ea1999e79e0b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310457, "uuid": "4a75f102-9a95-463f-ad7f-45ecdfffe866", "value": "3164239581442D44DF6068740CE7FFF63749DDE1A2AAC66DB16F3624AC4015DEB0B2BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310457, "uuid": "22e4b4d0-bb3d-4b57-98e2-2ce35d7a4fd3", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310457, "uuid": "dfdd8903-c12f-47b0-85d8-bcc59c88fde9", "value": "6144:itKiJled1PH9pXcBPNWEZL8v5RCGEUqlnYJ4Uk+F9bmNX8Yq5pw+8z/KmPaqig/C:wKiJled1PXXcBPNWERuwxUqlYJ4U2N/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310457, "uuid": "83dccc99-d615-4ee2-aca5-b05f71d397cd", "value": 312417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310457, "uuid": "84c1eae1-ee77-4fad-9610-cd29f8a5cab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310457, "uuid": "b6e1052d-5b46-498b-9775-f40fd8fc1f5d", "value": "oleaut32.dll (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cd62aa-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339141, "uuid": "458845c0-cbe5-4872-b407-09b978771acc", "comment": "Malware payload", "value": "00c1ea39794a1770002c1e1b23092769", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339141, "uuid": "9a5a9812-e89b-4211-aeae-bafef594ae03", "comment": "Malware payload", "value": "2d534a15de7f25a581b462634426f12ef62e77b294d549a19e65091ba84236db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339141, "uuid": "a46fc81c-2781-4e7d-a402-8579d8e8698d", "comment": "Malware payload", "value": "2295bb281bf1d6b8bf7e00560f614f6281b8466f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339141, "uuid": "4586e4af-4a7b-4e1e-a490-afcf1558b823", "comment": "Malware payload", "value": "cd7d71db4bb6f6e1c293fc6b9800393e2aedfe52ef45d6141264403eb93e44b20483fdc4417315a7bfe8336d8c8fd33a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339141, "uuid": "0771f8f9-80da-4344-8fab-df2b3785f02c", "value": "B0F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339141, "uuid": "71666270-2bb7-4e71-bc00-31bd3345eb07", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339141, "uuid": "8ead4556-8453-45d2-b7c7-0297e433877b", "value": "3072:7iG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:VERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339141, "uuid": "64e9dce8-1e21-44f1-8a83-9516524cad4e", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339141, "uuid": "b3eda033-9a93-4e7b-816d-646b923ab419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339141, "uuid": "a4d8f6d2-44eb-417a-a691-bb74233cf7d9", "value": "00c1ea39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a59b2c-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309722, "uuid": "66805e28-e5dc-439c-a3aa-4b6421d26195", "comment": "Malware payload (Dridex)", "value": "c76dd99e975663f8eebbabf9ba4a757e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309722, "uuid": "c67e3992-2fe1-4aa8-96bd-473525827d70", "comment": "Malware payload (Dridex)", "value": "2d54f14da878c6bde7b7d78c942f169ca3647fa519343c076ec6322ffa5d091f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309722, "uuid": "63e6ff7f-325b-4029-be8c-957c8f681c93", "comment": "Malware payload (Dridex)", "value": "05e255e8e00d7cc76644f8b25ff6cc291e429651", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309722, "uuid": "0b125f77-d933-4718-aae0-c161aae84937", "comment": "Malware payload (Dridex)", "value": "ca118c1cef5c7fc5f5c8a16f3927240f62ac6268e51e82863579662224fee8d8f4b43ddb27f35fc633d1dc5a77f6d3d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309722, "uuid": "1e483254-e3b4-48fa-8398-5e3f3be636a8", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309722, "uuid": "e051a213-50e1-46c5-a60f-4a97e2c0e923", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309722, "uuid": "eb56dc6c-0a21-4cfe-a4e1-40fc73cf484e", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309722, "uuid": "da4a381f-810b-4f0f-a345-3ad360170a8a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309722, "uuid": "57f18883-a315-4ccb-a054-a09485804a8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309722, "uuid": "96f3bc0c-ed92-4e08-a60c-3487080bec60", "value": "c76dd99e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f432ce90-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285379, "uuid": "385bc6c1-4419-4916-b924-e1a4014be328", "comment": "Malware payload (AgentTesla)", "value": "c109e365a642ab74f5f67129f0624063", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285379, "uuid": "2f3b09ec-f004-41d0-a10a-feca39d01027", "comment": "Malware payload (AgentTesla)", "value": "2dab934c2c214e33eee6cb85c86571b0979000ac43fc25d81034e543e4202150", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285379, "uuid": "f326a541-9bb8-49cd-ada8-b009de468bc8", "comment": "Malware payload (AgentTesla)", "value": "ebec417b096605b2f0f571da7fca0ac1d044df1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285379, "uuid": "f1c11d40-95c7-44b7-bb3d-96a8a617ac6f", "comment": "Malware payload (AgentTesla)", "value": "63645e03dc7c97206716174bf31a33fd7dc66fdf4b238a2f9b77da4cd028df1cfcef422519915cae1cb073f2c51ac266", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285379, "uuid": "030d6089-2630-44ff-be2a-689db52978a5", "value": "47559D41E2489560D83E67309532C93843B37E6AEA75D61C39ED3DAB3FB72C29527213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285379, "uuid": "23e5ebd8-beea-488f-8a00-60465552df42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285379, "uuid": "ca0a7097-1c1b-41a3-ba90-c41679722948", "value": "24576:PonqdU/EG3Ptj7gAhQIP4rEsmTV59rj1q:q/bf1grKNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285379, "uuid": "5f87f6e8-791a-498b-86c7-31fd30afe0ca", "value": 1313792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285379, "uuid": "b202864e-7777-4a90-81d8-73b5baae11c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285379, "uuid": "378c8725-68ca-4314-87e5-2ea0b65e806a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830eb66c-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316972, "uuid": "019eb136-600a-4786-8925-b3b36640442d", "comment": "Malware payload (Dridex)", "value": "0dc689dba8777b4ca6c5c260d17f892a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316972, "uuid": "ab79f3d7-31e5-4109-885a-a7358ed5ca16", "comment": "Malware payload (Dridex)", "value": "2dd22fa17bf633e01e06e7d4feb4c6a6bc31823b67508ec796c0d38598d6a55e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316972, "uuid": "9c798e23-c6b6-4c6d-b1c2-4a03ba5b8562", "comment": "Malware payload (Dridex)", "value": "47ee85bbeaf6d339f572baa56f056eaea89c8ae0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316972, "uuid": "5c7ce1cf-3038-4faa-91a9-ce5f36230a44", "comment": "Malware payload (Dridex)", "value": "a8a994528b26e8748e432eaa500371285902ad4718cbeef1e120b58571b3ebbcd4c1298563f23f342a0caf3b9facfac9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316972, "uuid": "c741859c-9e62-4344-9c33-b699bb91b287", "value": "62F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316972, "uuid": "3aee0a55-9623-42b1-8575-49c347468d20", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316972, "uuid": "28d378ca-76c6-4f28-a88c-a182373dbc83", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316972, "uuid": "5d3046e2-8958-4ad1-8922-38698f75d367", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316972, "uuid": "1c5c5eb3-1d3c-488d-8a38-5dad249eec0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316972, "uuid": "9b386b05-726e-46dd-ae77-a70a54f664f6", "value": "0dc689db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c6cf7a-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339470, "uuid": "07272e24-5521-4ed8-b3e9-ff03eb3cbdb8", "comment": "Malware payload", "value": "b8d9804eef15961a27448bd3ef62acea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339470, "uuid": "2a934a90-cafc-4323-be63-a4275164f88a", "comment": "Malware payload", "value": "2e2898561fde656624dab3467ce1377ad69a9d667d80dbec6d0bd89b496448c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339470, "uuid": "d58f76da-9500-4195-b429-b5d265675501", "comment": "Malware payload", "value": "c71db51dbf8a2b762812a82b48e929affcdb3662", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339470, "uuid": "f9b226a8-4e87-4169-a967-c03a454874d6", "comment": "Malware payload", "value": "1dbacf4c02110cbbc8e6627a3cb4e363d38a81f36b1a78cbf040c8c8a1a696f6289a94c0152374d290eb932578732751", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339470, "uuid": "56c5a2cf-e95f-4a73-a04e-6d3caf897af2", "value": "51F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339470, "uuid": "2c640e3e-21ff-4d6b-8512-8e76e911ad65", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339470, "uuid": "0ccd4385-cb05-4032-aed7-2d1f8cf701a1", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339470, "uuid": "4294fe0f-68f7-4374-bf85-de32c263898a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339470, "uuid": "13034d81-bf33-467a-8887-20b6212819dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339470, "uuid": "de6a2756-c6e9-4f9d-8ffa-cf3097b31ff3", "value": "b8d9804e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2966543-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620320568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320568, "uuid": "bd9e6ef3-5504-451b-8dbf-2caeb3e62a78", "comment": "Malware payload", "value": "f9596999b9e95d8e82cf6dc9726f9f87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320568, "uuid": "2fd8b877-586c-4ddf-8fb0-4980bfb01eb4", "comment": "Malware payload", "value": "2e8af953e42b2f44cf143d0270286aba2756237b85285fb78b4de0d857420739", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320568, "uuid": "f3bf8293-fcc6-4448-aace-f0cab63b9cd5", "comment": "Malware payload", "value": "7f4057b31c63f33fca34a711824179eb1d41815c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320568, "uuid": "c8931b77-0f7d-45c7-8305-b6302d94d2f6", "comment": "Malware payload", "value": "490b14615a901fd762c700ccd42e6b956883aa9092f658fe16d98c3def6d11f1a00cc0181ebcb68a8bcdb211f4ee1ecb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320568, "uuid": "62c7a895-54a5-4a7f-916f-fbab33202f49", "value": "8DF3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320568, "uuid": "c6137ac6-80f1-4caa-8453-b1f5467f41e8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320568, "uuid": "7c358b6f-7ffb-4c43-911c-b63e62a71a73", "value": "3072:CIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320568, "uuid": "cb165a2e-d7f5-4619-8866-6b5a887ab55f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320568, "uuid": "7f9d5d2e-e0ea-4f26-8bd2-f304b412cf0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320568, "uuid": "d5a137bd-656f-455d-a344-4bcdb51b206c", "value": "f9596999_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cec088-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620334926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334926, "uuid": "83228c46-bafe-4c91-a03a-9b93ecf9903e", "comment": "Malware payload (Dridex)", "value": "a3d225bd17b38a0db0a98070c7a913b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334926, "uuid": "5412394f-3c22-4c3b-9d90-79db0f883bb7", "comment": "Malware payload (Dridex)", "value": "2ea7ac33cf482987b0052b039cab2725475bfbdaa9bf3def338d580223e58e35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334926, "uuid": "5f197640-ef37-4a4f-add8-ab5df08dd8b0", "comment": "Malware payload (Dridex)", "value": "311b0841e8f042f5054ae0781a0817cab6122a54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334926, "uuid": "3fb68b03-3b5f-4d3f-8acb-fb70bcd54bb2", "comment": "Malware payload (Dridex)", "value": "4a9bc896bde4785d50b7770bc2a4fcdf8c19f2a97120e632b5a8640e6ed70913d0fde1d0cd799c52afce5add33e78ea9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334926, "uuid": "1e9ab0c2-cd82-4079-a8bb-9bbc3f033bc8", "value": "21F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334926, "uuid": "9147dbcc-bb70-45d6-8995-f42651d4e613", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334926, "uuid": "bd14914e-473e-4786-974f-55e9b0db9652", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334926, "uuid": "756dac98-4c9a-4a4a-96f0-b9a817366e84", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334926, "uuid": "735940a3-303f-41eb-862a-bfca6703364f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334926, "uuid": "6eeecf1f-a14a-41b3-acb9-28a99c8ea86c", "value": "a3d225bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3e6a52-ae3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (TeamBot)", "timestamp": 1620286062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286062, "uuid": "ac5ce890-84cd-4bef-a566-f022e06e5320", "comment": "Malware payload (TeamBot)", "value": "3557fbeeb85b5ea87eb518d2f3106a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286062, "uuid": "fcc88bef-64cc-434c-a4a5-d937403414d0", "comment": "Malware payload (TeamBot)", "value": "2edaa364594d0abb1ed74bf9ef76616c483c7cb77482c1189730f2da8cb3084e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286062, "uuid": "718b1a75-e6da-43c8-a40f-2cd0f61f913d", "comment": "Malware payload (TeamBot)", "value": "de07a991568def904d5e998d46885ec464ca63b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286062, "uuid": "bf00c89d-3f03-4d4e-9bd6-88078aaece31", "comment": "Malware payload (TeamBot)", "value": "b01dc88d71cf5d04326601ef805682f5dfdde170643ef9a03e677925f86ba65896f7077cf8629fcc7f557c377b06faed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286062, "uuid": "68d6fb2a-5a43-4818-8f47-83b1aed54b3f", "value": "64150112B2C0C075ED2324358D54EBB05E9DB826566109BF6EDC36FAFB286D1B23534E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286062, "uuid": "bea01e44-5f26-4712-bfa2-9db86524d6ce", "value": "229d85caa4a32f0682bca8d22f161759", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286062, "uuid": "20e146a5-307f-452b-8394-073652bb1b60", "value": "24576:7oa8TZbiSLHgjNP8LFylLabRZEnm3xtB1gpzIexozy:nMVLHhL5Pkm3jB1Yaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286062, "uuid": "18491043-02f3-484b-869e-9ced66fba989", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286062, "uuid": "cfab862d-020f-4c95-a11e-dbab8897a47c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286062, "uuid": "81162c75-aef1-45b4-8c88-2e65f5decc94", "value": "3557fbeeb85b5ea87eb518d2f3106a37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1febfa5-aea1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620329479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329479, "uuid": "0a2d5968-284d-4989-b73b-571caee29da2", "comment": "Malware payload (AsyncRAT)", "value": "8d74e2ef18e68405319a1090d20a0674", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329479, "uuid": "86b2d968-9b26-4de2-a699-fc1acc407c29", "comment": "Malware payload (AsyncRAT)", "value": "2edc93f84e6911e5b86040964715868c82eb28c2b48cdbb2c72dee60cfe2f792", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329479, "uuid": "69cbcd51-c3d4-41ca-b877-7d51de659e4d", "comment": "Malware payload (AsyncRAT)", "value": "363c4e86dbf7f6ab65dcc79cedb07aa52ea12ed9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329479, "uuid": "61fb1b67-e420-4f24-a3c1-922f63b285a8", "comment": "Malware payload (AsyncRAT)", "value": "cb4ba7672a3ae17baca4d3488e842067738f3cba1ed22b216814ffe70fa5ca97c35839aa0f050fbb0472e37e71d7c9ce", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329479, "uuid": "67915be4-a51c-480d-8c1d-e3395da1d7fb", "value": "3F44D05674C0D0D2E8B149360E5946B0F74B7E6277089A1B33C0BB6E7B71296897BBC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329479, "uuid": "cb80ee8c-52ea-4e50-a50d-7ad1913e4728", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329479, "uuid": "dc0b393e-3113-4413-9ad2-e2cbc83e8456", "value": "6144:IPX0iQ2+saX3CWCb7qWjBcqsLUShvj2VR:JihTaHCWeF9wLUSgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620329479, "uuid": "bd9312df-b4bd-475e-928f-099c660c3aab", "value": 271079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620329479, "uuid": "b5b9a566-5653-4250-81f7-f9947b3942b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329479, "uuid": "9ba41da4-1d4e-4427-a88e-d1b416f9026a", "value": "8D74E2EF18E68405319A1090D20A0674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe0ee24-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320530, "uuid": "688c5ff0-d9da-448b-a5ec-5d9a5333faf2", "comment": "Malware payload (Dridex)", "value": "cb38210c11f49ceeeeb0eb45b46477c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320530, "uuid": "c822e8c0-bf30-4b4e-8963-31b7e8fbbd5d", "comment": "Malware payload (Dridex)", "value": "2f0fc7078a773fcc92a3eb2d55d74fb552babbaab1c66a23738c09de6b31db00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320530, "uuid": "82b3ef35-b39f-4657-a585-b01615e27939", "comment": "Malware payload (Dridex)", "value": "464ca941c9da48db244c7e0af8571f26f0baced8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320530, "uuid": "dd1f6b41-0022-4aa9-af63-a486cc9175b8", "comment": "Malware payload (Dridex)", "value": "b106f2c2fbbedfc0f98bc01b2d9ace688fb45e2134fc542e759c7c800e188e0786c5948500aa882fe20cc2d8b7ad9152", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320530, "uuid": "0c541848-ca92-48ae-8fcc-5fac6dd11122", "value": "5AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320530, "uuid": "4ddc12f3-a621-4e30-90a0-f26bcb719116", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320530, "uuid": "0cbce5d3-dc1e-429c-a6d0-6ef5125fe0ee", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320530, "uuid": "133a5027-181e-4c7a-bea4-06e8bbf12fd7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320530, "uuid": "dbf8e2fa-c817-486e-aebd-320752afb084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320530, "uuid": "6bc471b5-2388-4cdc-b886-509942b44a38", "value": "cb38210c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf58b40-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280988, "uuid": "ae44d7a3-dc47-4ace-adce-b79cd70e92b6", "comment": "Malware payload (Dridex)", "value": "b997731029a9dae309fb0610e9add3a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280988, "uuid": "7c95717e-0af8-49d7-a156-6087899f9585", "comment": "Malware payload (Dridex)", "value": "2f25b60b71992684d83df87bbbc9ccac3243cd40ae9217e6cbeca7408a7d764e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280988, "uuid": "4339dd6c-8fcc-41b2-a3c1-5ea3f8b5c65c", "comment": "Malware payload (Dridex)", "value": "b11988eca8f5c884ee917224d726a6c00440244f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280988, "uuid": "2e0a9d8b-a959-47d8-8b9d-609bbde777c1", "comment": "Malware payload (Dridex)", "value": "85bcb1b8a6b11c97d159f17fab857c5cea9fb57f77d87249d3d7c5502925ee072122618299e836f49620ad9479874d54", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280988, "uuid": "ccb2a6fe-445a-4371-b4e1-c0af7d27ded9", "value": "75F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280988, "uuid": "b142095a-6c56-4808-857f-a8bcacd14cda", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280988, "uuid": "f5de4cb7-b2be-424d-ac8b-d3d2fddae9c3", "value": "3072:aWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:a42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280988, "uuid": "cc88cd09-1f82-4d6e-af84-101733e5847c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280988, "uuid": "e07d1c17-e942-4e1a-a75f-bcf5e330df01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280988, "uuid": "e3424368-e640-4e99-af66-6186add88b43", "value": "b9977310_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9f480c-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259306, "uuid": "cc316c44-fe94-48e2-98db-1901a13f2d47", "comment": "Malware payload (Dridex)", "value": "366fbe969f5c57a13f94c8746af254eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259306, "uuid": "8cb5b7bf-fd90-43f6-a4fb-a89d9c6eb19f", "comment": "Malware payload (Dridex)", "value": "2f306aec723b8d00b29a75a9523e548db931ced58bf08df9a10db98ff3eb58b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259306, "uuid": "2dd82690-5077-4b6c-abdd-6315f22bf14d", "comment": "Malware payload (Dridex)", "value": "0a70de4499c66222464bb598dd163dd12fbe820b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259306, "uuid": "87cd704b-0dc1-41cf-9bdb-5c3d16cf3c26", "comment": "Malware payload (Dridex)", "value": "439df5d30b2322042cbabfeb87576932b45d80b108b1c36f8da77a5a63da9f0a469b7757e62e3ee4ca8e88ea0385d660", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259306, "uuid": "eb76d0ea-4fc0-47a5-b2d3-6249350f43c2", "value": "8AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259306, "uuid": "c1fb1a12-7349-4218-8830-96b642d260fe", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259306, "uuid": "16d1cf45-2d40-496c-8135-77e592f9f3da", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259306, "uuid": "c103e09b-2b1e-49fc-924c-64fc5e6e4663", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259306, "uuid": "a4b2ea35-e086-4b4b-a3da-e4f659b5879b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259306, "uuid": "0728c080-514a-4d13-b539-69ebe1344818", "value": "366fbe96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11babcd7-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313346, "uuid": "a9b9e7bb-4da6-4d31-a898-0b6783d2df81", "comment": "Malware payload (Dridex)", "value": "d4c5a7cea12ff450863ba0b6651acb43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313346, "uuid": "61a28548-2dd2-4e6e-9193-e1cce16d2a6e", "comment": "Malware payload (Dridex)", "value": "2f37eaefae70a8121cefaa5d9f1c735cdb81616d6910db2936f9ef983bdc8b59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313346, "uuid": "f83676e2-7a53-4f4f-a98e-3374819a7104", "comment": "Malware payload (Dridex)", "value": "c680e33690b2a92ee33f58b7a266eedc4df11e5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313346, "uuid": "4cf160f1-92df-4c4b-a816-2c4bba177788", "comment": "Malware payload (Dridex)", "value": "986dbd1cc3efacc9baf2f61d4be64b715ee91c95a682f83ae185d50ead1e7dc72c5d4caafa0335454aa73023b983e835", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313346, "uuid": "249b9282-805f-43f8-881c-c6941b193de0", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313346, "uuid": "0698aab7-32b2-4da0-9562-acd3ff232d5b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313346, "uuid": "20bcb4d6-8491-4687-a3d9-e9e12b51b2c9", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313346, "uuid": "a44765eb-6198-457b-b64e-e72e969104fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313346, "uuid": "b8951b8e-e411-4d0f-bdf5-db1d8a8382e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313346, "uuid": "015c5f03-d22f-45f3-8e8b-8a6cbec049a8", "value": "d4c5a7ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd1352a-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331324, "uuid": "1ee30755-ea25-411c-9718-0be856cccfcf", "comment": "Malware payload", "value": "337056e8bba835916858b0372d348ccc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331324, "uuid": "e7329d12-9e51-462b-bdd3-72f3ef69b9cc", "comment": "Malware payload", "value": "2f4b8bd1f9e7ae6c7ca52cb92c540a9d3d5a4f2a61c014fe6a0a3deaf3620e4b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331324, "uuid": "2cd7dd95-f6bb-452a-94f3-58ca27e1ce33", "comment": "Malware payload", "value": "8f39a8456738129a1584bb543361b8fea29ee47f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331324, "uuid": "9b62f8ce-a8f9-46ec-b7d0-7164993f6a3f", "comment": "Malware payload", "value": "4a105136422be463cb5f0d04c3d1bd3ce200db8115eb01039f0dff0f5c8e10928296dfc226c7117cdf46f86593bea2a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331324, "uuid": "337e5ada-ed40-49df-830f-54c93f23e21e", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331324, "uuid": "4d3ec4ef-ff42-4ce8-a08e-a32fc70baf68", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331324, "uuid": "a77b7939-a420-4cad-be4b-476ee91ec6d8", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331324, "uuid": "d1a9fa99-1b01-40ef-bcd1-5a3c37b30100", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331324, "uuid": "b4ea2716-31bb-4fc6-be8a-b7fe36591ef9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331324, "uuid": "021c88f8-eae5-4fcd-9bff-be6e4051abde", "value": "337056e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85970405-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338880, "uuid": "b3295481-eb4e-4257-ada6-e26d6b36106a", "comment": "Malware payload", "value": "6865401cf5ffa723e1baaf61807366d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338880, "uuid": "7fab1c6a-0de6-4a06-8956-259ac6387164", "comment": "Malware payload", "value": "2f671701b822bba4bb6839726dc26e1d0e8e3383781a4767a967e8f3f3c8e4e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338880, "uuid": "d67d78ee-ac37-4662-88c6-298b05481877", "comment": "Malware payload", "value": "73dbaace91f78bb556650a1c25afca92d6a2d29b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338880, "uuid": "08ece51b-0561-4379-8669-d90dddfafd32", "comment": "Malware payload", "value": "faaf6d67ac8b8b48a9c61473c7da16faac5aa56019ffecd3423a0a0a04f93fec682397704a56c46c653c41fcac0c4cb0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338880, "uuid": "8cc82574-8c92-40b3-9989-7b5eb5b4fb2b", "value": "8DF3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338880, "uuid": "c770f2c1-f9ef-4886-aa61-ba57452c67d2", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338880, "uuid": "831c8722-552e-49eb-afff-376b65c3093d", "value": "3072:OLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:VERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338880, "uuid": "54b14941-31ee-4a1e-9f7e-03f2b71097e1", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338880, "uuid": "90266313-4af0-4339-b6df-acd9a92cda4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338880, "uuid": "d72e3897-3b72-4b13-bfb0-f360928f8909", "value": "6865401c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051e9078-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331363, "uuid": "1be9ad18-4585-4f85-b729-2a4813b99f8f", "comment": "Malware payload", "value": "2af6b6b901862093cdf707a832115b72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331363, "uuid": "1158e0f8-1875-469f-86e7-706045d992a7", "comment": "Malware payload", "value": "2f9e9440b06df5d643091f510d2b35d9d860ddc15e8b1327a4776f2b11aef9ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331363, "uuid": "babdc5bd-19fe-44c9-ae70-21a8fb54d567", "comment": "Malware payload", "value": "d693b6324d59e9b62fd9b39f8915b98fc3ddee2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331363, "uuid": "9ed4a4fa-1ff8-4c21-864e-28fbb76bbb2a", "comment": "Malware payload", "value": "5e1cfd5b73a0401217fcd1bf7fd688d14dadf228028be83020a34b5e8eac4115f765b19970f3141b6426f4fc43f3a788", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331363, "uuid": "247c2dd1-e7d3-4ce4-be1a-771dd7b27194", "value": "02F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331363, "uuid": "312ecf15-68dd-437b-9859-bcea1da4c965", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331363, "uuid": "be8ee3f0-460f-47f5-81b2-bc19d4737b9f", "value": "3072:zUG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idzT:vERMVPG6+Y63HoG1QawL40Prx6KNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331363, "uuid": "0129b293-cbba-47bb-a013-31e674b94e3c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331363, "uuid": "bf8c9c61-a681-4f97-bccb-eb02bf0fc237", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331363, "uuid": "e034ce8a-cbc0-427f-b27e-ec08060b4297", "value": "2af6b6b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649ad05b-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280843, "uuid": "289c33fd-9112-44d0-bd58-bbde9724db8e", "comment": "Malware payload (Dridex)", "value": "6e8beafeba2a12880a7ee842dbf9837d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280843, "uuid": "9cc84266-cf89-4986-819a-c455f63a7927", "comment": "Malware payload (Dridex)", "value": "2fd1e268c1319104c40cee873b7b628567c328f38d9fc593c42a8692f1184775", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280843, "uuid": "7ac86bce-9974-4bfc-84ec-fe27bbdd815b", "comment": "Malware payload (Dridex)", "value": "4d2455bf86bc8ac1b9c0a2d2a4180d79dbaee560", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280843, "uuid": "b97fa139-0e48-46ef-beb0-34aef1312df3", "comment": "Malware payload (Dridex)", "value": "172484e36871f258fa329d21892148c8e7a72ba244f090f7967e06b7dd09a0e0e49fa347943510ee11dbcf8e0e991543", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280843, "uuid": "83319f26-6c24-4e72-913d-8a6c9fa17ca8", "value": "36F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280843, "uuid": "9e9c1a55-eb30-4b37-894a-7bd51b5a2efb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280843, "uuid": "172d679c-741a-461e-bd32-6dcbad144f58", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280843, "uuid": "b42d41d7-10db-4cbb-9da8-8e72f2eae4a2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280843, "uuid": "2a3a9664-19cb-4806-87d3-68006658b3c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280843, "uuid": "aa31993f-a6c0-4ef3-a301-e1ab3611c91d", "value": "6e8beafe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b2e38c-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288332, "uuid": "f9944baf-d98c-480d-a01b-3f96531c2c82", "comment": "Malware payload (Dridex)", "value": "cc3b07bc090a14195897d07977626e86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288332, "uuid": "2a1c1b4f-4fd8-4f49-bc8b-d84129f2a9e9", "comment": "Malware payload (Dridex)", "value": "2ff50b35309a14c32fcbbf159d992e206bec0e96cb53dbb53126fc95d7df7d26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288332, "uuid": "0135aa7a-6c35-455d-b83d-26829470aca1", "comment": "Malware payload (Dridex)", "value": "2a35724b3f94c24169b16dafa9bc3c8d36fe5b36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288332, "uuid": "64f3fcef-b117-48db-a1cb-435cb24eecf8", "comment": "Malware payload (Dridex)", "value": "1378dae1e0cffd0f164e3ea60052f12561b90508827de20381df38c05df615e69dec38f3876e8db160a40d98046b4bff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288332, "uuid": "6d513220-f828-4208-ae4a-56d9b303af3f", "value": "D9F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288332, "uuid": "3f67a665-cc59-4a71-b232-bb0227d8dc38", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288332, "uuid": "e47018e2-cd70-4193-9477-38dd40ecc7a6", "value": "3072:fWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:f42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288332, "uuid": "2c91f86b-d356-4d44-8270-07492c461239", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288332, "uuid": "41d9d4fb-dc31-45ca-9fa1-9bcc6a7648cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288332, "uuid": "aa23c360-aca8-4d54-a929-b055601232f2", "value": "cc3b07bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f6d442-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334935, "uuid": "8f8d4aa4-14ac-41ea-adc6-68ed396adeeb", "comment": "Malware payload", "value": "b69466cd12cc899652ec0c71aebc2b65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334935, "uuid": "afae53c0-4a69-4596-9caf-9a5a23e00a72", "comment": "Malware payload", "value": "301d0b4bda7d40796239ad94781db1f3eb50d4f7d512b038f81d99811719614b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334935, "uuid": "469ea23c-a217-4205-8cf9-31207299eaa5", "comment": "Malware payload", "value": "74053f33305db10e5739835199fd67157babcad6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334935, "uuid": "61bbe80e-c155-445f-ac1e-e17770da2573", "comment": "Malware payload", "value": "295f9f45842512d29bb49695e61757806ccf972b6f8cdbfb076a41a6ae74c9afc493e56a5736c693481e6c618ece7c7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334935, "uuid": "9665b1e9-9f40-434e-bbe3-ba1dd616ed21", "value": "F7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334935, "uuid": "a11e2de5-2c73-4f35-9eb3-f96b96e02fea", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334935, "uuid": "9d259cb4-8ece-46bd-bdc8-6f3ec1b901ab", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334935, "uuid": "4f9ee196-3407-4c50-a045-75cdf3596573", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334935, "uuid": "de975a19-85b9-447f-9908-d36c187eee40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334935, "uuid": "c49f5066-f2d5-4b69-a4c2-0f5bcb7397e4", "value": "b69466cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d21dc7-ae7a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620312685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312685, "uuid": "cdb5cd89-7426-4c4a-868a-3f7fe83eeb17", "comment": "Malware payload (NanoCore)", "value": "927df1358f7343fe0e62f09edbd2a44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312685, "uuid": "368382f4-7ad4-4dd4-b18f-024260985c13", "comment": "Malware payload (NanoCore)", "value": "305bf6557bcc3df14cf33993d14e03fa84a6bd7611a990402fae4522ff098454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312685, "uuid": "bd316edf-7fa1-4673-ae9a-3e48052ba1fb", "comment": "Malware payload (NanoCore)", "value": "3dfadc072e55af6a96a252c2e90b8338f70fd570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312685, "uuid": "2734a49e-eec9-40a0-96b8-b8a869825c8f", "comment": "Malware payload (NanoCore)", "value": "74ef0f5821a2d9297e7b6d02f29cf4b557b9e2616ba608d2909b0821745eeb0f0a80d105a08c5ae65112da35d192b9da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312685, "uuid": "fd1e077d-9cdd-4d64-aba6-c03ec37e80d9", "value": "8FF2C658BF898277CC6D8F7821A14251073BFAB7A8739A1FB9AC0409DF972875D13750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312685, "uuid": "dbd21671-039f-43b4-879b-2e0ee1463701", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312685, "uuid": "5984e40d-98de-44a8-bd6c-d7c43e0a9d5e", "value": "192:VnCrY8q+BcZz29NIkYAygsHw7P+zwTZOjAGZM:VnCk/OcZzkNIkCLW+zwTZOjAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620312685, "uuid": "1a456c00-e98a-4f84-9017-a7a77323439e", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620312685, "uuid": "9ad04b27-69e2-48fc-984a-335cb8629474", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312685, "uuid": "79e15593-5370-478c-91ca-b6254b93b439", "value": "Orden de compra 65843,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325a0a19-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338741, "uuid": "d4600d5e-6258-43ca-bf5a-b4cc6b3b8656", "comment": "Malware payload", "value": "843dcd0aa53b1cc3301bbfa8613b2adf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338741, "uuid": "0777e45b-2586-46d4-849a-a9ebf581edbe", "comment": "Malware payload", "value": "3062bcc94d6b8c2fc0342521a7af8d457f10bb0e63a2ea222652130788118d8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338741, "uuid": "5aac057a-3d95-475d-a3f3-b9cce2661785", "comment": "Malware payload", "value": "7f6b906850392924a1b46b0c985f47444654b1e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338741, "uuid": "dbc43c26-cb3f-46a5-b9aa-7acdca35dff9", "comment": "Malware payload", "value": "1ece3327c9cdad3c9a86b8e384aa439320f7f5d5d8a47331362b7f7e253fd4e5c961f6c34ee75bf4aa1993d01e9e54dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338741, "uuid": "2e19d7cb-ac44-404f-affa-6e5595e372bb", "value": "C4F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338741, "uuid": "63e29bd4-33ba-4ec9-b60a-f896a749d286", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338741, "uuid": "0d87d9c7-08f9-4886-97ab-b9060f1ec598", "value": "3072:NOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:LERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338741, "uuid": "3a9cf93c-8907-4130-a4c0-52a428b2937d", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338741, "uuid": "9b0d11d9-53bf-4cf2-a530-0b433c4cc05f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338741, "uuid": "f088e93a-d88a-4bb0-857e-4fb917519969", "value": "843dcd0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc5176e-ae7b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313312, "uuid": "cfa0cf0e-32c5-4607-bed3-e30ac40570d8", "comment": "Malware payload (Dridex)", "value": "28b61f9ed9ab54caa08256d31fe6fe06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313312, "uuid": "3e4e3836-ceda-4a06-93bc-25fe44019859", "comment": "Malware payload (Dridex)", "value": "3071a830a68b46de711a0558ee681994496a0ae200401465c3333d61e2e82c93", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313312, "uuid": "f13963b9-0e84-4328-977b-db6fae3df0ef", "comment": "Malware payload (Dridex)", "value": "877f662c9da4278c68265439a0aa9d1423f38184", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313312, "uuid": "e942ffb6-7164-4c25-8944-398f0d465209", "comment": "Malware payload (Dridex)", "value": "b851acdac63e7b0c0e7a513dd496044867580221f835cc13cd1261939a79e928a87e902770c6728755418af5a8d0ca2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313312, "uuid": "e884f1c3-5fc2-4232-9f9f-756fa41a1318", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313312, "uuid": "99e1f595-11fe-4638-9000-c7ca4fbc9078", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313312, "uuid": "57e886a0-4ba9-487a-8bd4-13de1ab2353d", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313312, "uuid": "92455473-49da-476b-81bb-e3179219fa16", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313312, "uuid": "a55c2270-922b-4eb4-b2cc-f3eedfcdcdfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313312, "uuid": "e2e1c07c-6961-4be4-a675-c28a49a15400", "value": "28b61f9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bcf6b1-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620273374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273374, "uuid": "1613aabc-ce88-466e-be2c-87bee79d9ed5", "comment": "Malware payload (Loki)", "value": "bbf4c34356944d4f9f0195c2c3872afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273374, "uuid": "ee528d22-f4ac-4815-aa59-f7cce881badf", "comment": "Malware payload (Loki)", "value": "307233f2067af5d4e4f99e5db2ac6937824c3592778ddaee5d6e1590d0769d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273374, "uuid": "576fd9c6-21f4-4317-88ab-8afb9ade8f7e", "comment": "Malware payload (Loki)", "value": "106d404bd84fe0c5a1ab9b90e03c298574d71120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273374, "uuid": "f12b7996-597f-42e9-909a-f5d04efcfb58", "comment": "Malware payload (Loki)", "value": "9295d384c0dabaf9078f1c579bf5bb0dbcd05a5622f23f56b5d3057bbc6e046bae4f0cbe299a8f5abfbb01c6706b8336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273374, "uuid": "ce8f82b3-de9a-44df-8654-8bd5afbf13f9", "value": "08258C2252D895A4D13B13744962E03843F67E02E676CB1DAEE87C9B3F33681967721F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273374, "uuid": "6bc7b6ac-3f43-4ddd-a0a7-857a89aef93e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273374, "uuid": "f86ba4a1-a57a-4c05-8173-2b322cd598bf", "value": "6144:4MDFED6DeUY9ioomrPnoMZQVRN1ftv8xC42XX+3Ib7l+1hUCLe4C0gew2EmWe2RB:4MDHe5QUDnoyQSxwXX+4X4ejne2dirM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273374, "uuid": "ca2600ae-8bdb-494d-98e5-c66c23bbab4f", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273374, "uuid": "d24c72e2-a4fe-4ff0-b7fd-410356fcdc78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273374, "uuid": "cf025e95-c167-4da7-b5e0-647f600aca1e", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07884461-ae9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620327072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327072, "uuid": "34ca634d-e651-4a6a-b35c-6f87bcdc8fba", "comment": "Malware payload (njrat)", "value": "89a4c7b8dab99fe791ebae52524536b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327072, "uuid": "cbb776f4-8c2b-489b-b8ab-99bae26caa6c", "comment": "Malware payload (njrat)", "value": "309def552c446ea54ce932da7546242ccf13b5878c44a9b7f7b23237ff5d1edb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327072, "uuid": "f5205b16-508a-4696-8461-65ae16c41dca", "comment": "Malware payload (njrat)", "value": "d74c7184a92603ff8197ccb1b3140488f8acebbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327072, "uuid": "83bbe667-064b-4a06-a346-49cbea79c40a", "comment": "Malware payload (njrat)", "value": "c98be418ed5ff466d4d23ac471d7682102e1703c3c82d227a3c58b85866292b95542e5fa58b9320c61c67c410e095b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327072, "uuid": "7c152113-9431-4e5a-a404-35ddde41b3c8", "value": "02E21AADFBFA4465D2BD0AB50571950113B4E003E523E77E4ECA24A62B6B3D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327072, "uuid": "af9d5bce-5c13-40d6-87e3-a5da7a090bb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327072, "uuid": "99dcc228-d69e-4c37-8123-5915176a4aec", "value": "768:jYmqnf1Ll58zx36DLergHX5VvYFQmIDUu0tiofj:cB9q/ePAQVkjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327072, "uuid": "8c48b1ca-5e9a-4983-9b75-df6e142f9311", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327072, "uuid": "3431d881-2914-454d-bcef-ac0cda7f2994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327072, "uuid": "eb6dda9d-60c8-4daf-bf55-01895af6f746", "value": "89a4c7b8dab99fe791ebae52524536b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e935b9f-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620262848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262848, "uuid": "abb832f4-1f8f-43aa-bc71-a7e5b8588f5b", "comment": "Malware payload (Loki)", "value": "64d2a84ee308baeb97c39ca92c679b65", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262848, "uuid": "9d6da4ac-98d2-4de1-95bc-d275bb9ec0ce", "comment": "Malware payload (Loki)", "value": "30febfb441ee26277f7f12b775fe699e7a8135665c72d6a663b055b9dcf352c2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262848, "uuid": "76c35bab-5668-4736-8641-b8ff006c7d03", "comment": "Malware payload (Loki)", "value": "ab5c32982366a307ba2edf7ca7c4fb00cc6748c5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262848, "uuid": "63dad3c4-ff2c-4580-aaef-e4b20b7c7ae3", "comment": "Malware payload (Loki)", "value": "31748ef3d290988dbfff808247ac76d77eeaadd81486620004320ad1fce0cd39715575d44f81b901011012f0709c5e29", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262848, "uuid": "83322ead-892a-4e1b-a037-24e0cfdfe696", "value": "86E3012B23B0F0FBCBB227314DB15A51AFD2C426259A6B4763646FBE34554C2D90F1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262848, "uuid": "a9ed7c3c-8dd0-4d73-b492-509797eb594c", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262848, "uuid": "6854c8ed-8f3d-4b9e-922d-898efbc5470b", "value": "3072:lEre7GjyCaFvcGbW02eBkpBMHapieQsE7sUc5AtpOm/198cIQgQPyjb:lPXZuFieQsELUAf/IcIIyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262848, "uuid": "360eff4d-a342-4835-9096-6c2eaf47d5e5", "value": 153117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262848, "uuid": "3de9c502-fa97-4b67-aed4-93b085f8eb44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262848, "uuid": "e9db0f45-dc45-4868-b332-0ee1d8c6bd47", "value": "64d2a84e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5929899-ae3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620287502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620287502, "uuid": "6a5429b2-e696-4f89-8c02-2b57179f1738", "comment": "Malware payload (RemcosRAT)", "value": "4831c6d14c3a2135226c3e581bb4013f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620287502, "uuid": "83392fdc-ee63-4826-b9ea-283f8cd672a3", "comment": "Malware payload (RemcosRAT)", "value": "311e25c8370ed1c16a72cf163c48090f3e73495bc5fbc3a824635e9cc62f70e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620287502, "uuid": "f635b7c1-3924-40b6-8c7a-b341022af9f6", "comment": "Malware payload (RemcosRAT)", "value": "44a2ce6196d4467b6ae78a625d346f9008935630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620287502, "uuid": "3b317d68-e8dc-4ccc-9833-23bcf1f81a4b", "comment": "Malware payload (RemcosRAT)", "value": "4e0a3573bf2f8d82972aec30061cf334f345a89d3e868fd205d0a83d60837f28c57453d36d217862bca5d9927362c9f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620287502, "uuid": "28597fc0-d255-45f1-860f-0988e9e292e8", "value": "891528EC721075EEC65BCC22DBCE1C1596202176972B9607972303BD9E0EE57AF388D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620287502, "uuid": "1ed3fcf5-d050-4edf-bef9-b1b24f80673e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620287502, "uuid": "a92fe675-b5b5-4c4b-b589-62e7d2b0f85c", "value": "12288:Q6XIe7NwIoLLoS60/K7yh0X8zKdeRyUh7SdX5yhYfR9HdmIfhWx4AK/mKjOHTsZy:DI2BoLAMzwe5s8YfJmes2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620287502, "uuid": "c843fbd2-1d0f-46ae-a767-d05a7d6dfdaa", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620287502, "uuid": "39d4e3fa-be84-4268-874a-101356904c73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620287502, "uuid": "438e0125-ff4d-4d2d-8416-44e07fc33dcb", "value": "ad94b98e49e2c5f974483313942e5968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ade287-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620339448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339448, "uuid": "751e36cf-8c10-42fb-881e-8051489db456", "comment": "Malware payload (Dridex)", "value": "2a460a20f3a13a0e21dce180989e54c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339448, "uuid": "26267bd7-5dfd-4e33-b3d0-7e71d5b1dfd6", "comment": "Malware payload (Dridex)", "value": "311e288e28ef0bc53f79c54f7f0e49a84bb09fa8791a54ed8e9b74b7978308dc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339448, "uuid": "21b58b04-cc28-4f3d-b439-d27f62c7e714", "comment": "Malware payload (Dridex)", "value": "67c9617ca1dbbe99c7bb55fe41d56cc05bbfbc11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339448, "uuid": "b1f4ae90-bbc4-4390-924c-d56250ee84da", "comment": "Malware payload (Dridex)", "value": "4fc53a98e84180e6a5f80eae016ab333168a6879183301fdef71dd30ea2da84a7b6a6c1116fefd2b20144af85b3798f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339448, "uuid": "8e457edf-0fc4-4431-be62-195e93422a45", "value": "0DF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339448, "uuid": "a2f8e0c6-572a-44fe-a77a-b896dcdfdfda", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339448, "uuid": "5c90ad2b-0ff8-4787-b2ce-7a53162dfaa5", "value": "3072:xiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:TERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339448, "uuid": "f5bf3320-c08c-421b-befc-3b63d3332756", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339448, "uuid": "3a662dc7-633d-4e35-ad72-74f399d3b32e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339448, "uuid": "55933068-301e-4871-a843-81cefdb536bc", "value": "2a460a20_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a69ab9f-ae23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620275135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275135, "uuid": "7406a14a-6878-48d4-889b-badebf684e15", "comment": "Malware payload (Loki)", "value": "73f7f5997f2d36f33da0563021e42f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275135, "uuid": "b6dc8cbb-9fb9-45f7-9cd0-8d50986f3606", "comment": "Malware payload (Loki)", "value": "312148dcc6a95e0f52319990b3a3a7bcc7276420a2d79dd693a207c4708179a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275135, "uuid": "2743ae02-c86f-4224-93c3-877875919b9c", "comment": "Malware payload (Loki)", "value": "4637ebf6b1b62c22ca5dda2e7de70bb25fdcb086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275135, "uuid": "3c79bce2-b85c-4fd5-a993-f48371322d10", "comment": "Malware payload (Loki)", "value": "c94e8714aff85df52524b16cf8793239f0cb373fecf0f35f1e65b3b00ba7430149bb69c1e06260701456cb39d2ddf54a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275135, "uuid": "59b71a19-9eee-4a56-8c02-a0209a50df5a", "value": "8E553C91A154C8A5E87B07B1AC3AD53011E37E5DD5B4C20C6AD97E5B3BB3382609FE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275135, "uuid": "9c2e9245-cdfd-4559-a4f6-72d8237a195e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275135, "uuid": "1f5ad3a1-f028-475e-9dce-70a0248fecce", "value": "12288:uEya8f2jnoqMi1Aem6tz12mpg7MR4k0yisUXjfzJ0ueBr24G5K:ut+ooz12mpg7MRR0yiPjbiuw9G5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620275135, "uuid": "e802c27a-c05c-42fd-817c-840f426531b0", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620275135, "uuid": "f6e69bff-4708-4f64-909e-a7067a4edecf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275135, "uuid": "76d40a48-6f3a-45c2-b1e2-4778320f358d", "value": "USD ?? 10,305.42 ?? ?? --- ? 2 ? + ?? ???? 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0e5768-aea1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620329311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329311, "uuid": "18b68797-4ddb-4eb8-8a28-85497dd94729", "comment": "Malware payload", "value": "1500f4e9efa31170ffe28f42d8c46f72", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329311, "uuid": "64476f0d-1b74-4055-b28f-12c8b032d44a", "comment": "Malware payload", "value": "3154bdae601223ddab39cd8e4b08adebf51f924baa96118498bbc845795fefd1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329311, "uuid": "b97c5cc5-fa97-4eee-8d22-bf893fb94c27", "comment": "Malware payload", "value": "2d0b8d30c774ea66327fd5362da4698a2ece2958", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329311, "uuid": "d1b93436-7335-445d-9786-aca797e138fe", "comment": "Malware payload", "value": "45c9a7953ef3471908218fe2ee471c88d30793980ae42aa9c94359ff3e4257f59cd434fa6d6eb658149856e96d450422", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329311, "uuid": "6b1f3987-d277-452a-920e-4272fba08304", "value": "17139D1AA9CA81FAFC04DDFCF428450E9E288711051DA0EBE4785FC3DDA6506799F1AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329311, "uuid": "8c76c408-e8a0-45e4-a25c-815c6a232fb2", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329311, "uuid": "0d5a1263-06a0-4306-9296-b1337715a84b", "value": "768:GGS/PPJ69K2c5r8OsDBZpAYqRHAZorOs1gxuqkB1chYsNbp6SGu4nQvxVH2oOBI:yPRESOn+YC1ZB1chYsNl6SWn+LcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620329311, "uuid": "46a5a867-c903-4891-b870-1ceae1f7ed3e", "value": 42121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620329311, "uuid": "5df82360-3df7-4a06-93fe-802a614632cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329311, "uuid": "f06e5952-b281-476f-b5ef-c7c79aa31b8d", "value": "tableClass.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b7d7e1-ae8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620319852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319852, "uuid": "e2683052-5beb-403d-bdc6-fb7e1730fec7", "comment": "Malware payload (AgentTesla)", "value": "5f1de1b48258ba6f813ceda56967aa7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319852, "uuid": "7a3136e0-6bbd-4b18-ba2f-bb68b6c6eebd", "comment": "Malware payload (AgentTesla)", "value": "31ad90e0b83c3bf244b444db9d598914719a78734a7eacad39624709392660c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319852, "uuid": "0b7f26b6-a94f-4ad2-a15a-0d4bd3656aa2", "comment": "Malware payload (AgentTesla)", "value": "2abcace81040aec403ad0374e39f3809403ca28d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319852, "uuid": "c2166258-3121-4986-ba37-ff2c436e8d2d", "comment": "Malware payload (AgentTesla)", "value": "0de81dd5ae97d96e064db4b12da250223b8eb148953ccbf0db294b9a7dcf4e3d3e6441e698768f0153f4e147042d6ce4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319852, "uuid": "d853ba90-b0ff-4b1a-b0ac-58f9d92784b2", "value": "22F5F37482BD84A2A128F1E2A33977D58DE701BEB43798D60710274BD7D1D4A8DCB3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319852, "uuid": "31cad3fb-025d-424d-b2c5-43b7de1e0dae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319852, "uuid": "854397b2-d1ab-446e-bb12-e367f0dd38c8", "value": "768:oTehk2CmTlnHglPBPfMkFblKDgSlcEIESwmQBOk+StG62a8xfTaupYfJg2EABjyQ:oTZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620319852, "uuid": "d9158577-b35c-441e-8808-2930d4b0039c", "value": 3359232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620319852, "uuid": "3d1c9b2c-522e-4509-b98e-c331d3e3e0fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319852, "uuid": "94bf6c4e-ce92-42aa-8d71-79013fb62ac9", "value": "5f1de1b48258ba6f813ceda56967aa7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0ef374-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273687, "uuid": "65bfa891-0a31-4592-b4d4-6a13c6629901", "comment": "Malware payload (Dridex)", "value": "8ece8fb5523981012e017a7ff04771f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273687, "uuid": "5cff676a-d2fb-4239-b129-a8b2396d4e21", "comment": "Malware payload (Dridex)", "value": "3202f91a9a6c9a0e357fc9afdc24b24396a312f914ffe2d016325ab7a7d6ab08", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273687, "uuid": "2378ec34-fdcd-4865-a342-606c894208f3", "comment": "Malware payload (Dridex)", "value": "a53e3a5aa6d935901df6ed85b049d5618d7841a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273687, "uuid": "c0ee873e-e422-41ac-9641-7c2a05b16161", "comment": "Malware payload (Dridex)", "value": "203732c20e6617f88d98fdd56a29c554beddaee76a3ecdfd92bb06b29a7f7979d72f3ab403cf1f7978d70c611c8311ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273687, "uuid": "51f4d717-6d7b-41b8-a0a7-9ecdaf437d0e", "value": "0BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273687, "uuid": "4f85d239-c29d-4d38-ad35-99c5f77063e8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273687, "uuid": "b645bc13-2005-44d1-ba3e-de66d6743b5f", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273687, "uuid": "e73e66ba-9b7b-4df0-a573-04fff5c92646", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273687, "uuid": "abfc43cc-02a0-47b0-92cb-785ee3a5fd0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273687, "uuid": "591652f1-48da-4ed8-b353-ea1f213366bd", "value": "8ece8fb5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c76420e-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316934, "uuid": "7466f941-acef-4474-adec-25d290b837a2", "comment": "Malware payload (Dridex)", "value": "1900e1b06082b95ec9602438132fd65d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316934, "uuid": "3004268f-52fc-4815-9c6d-cb5d7aa4e751", "comment": "Malware payload (Dridex)", "value": "3221c110c0cc071c70cb84583de8720cc08e1f630ab54834feefd5637efc3d35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316934, "uuid": "6d64ab29-dc72-45a5-b2b8-91df1272822b", "comment": "Malware payload (Dridex)", "value": "e545dfea285589607c576e0f531702925197d673", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316934, "uuid": "7c5f710a-47c9-4116-a944-4af6e808da51", "comment": "Malware payload (Dridex)", "value": "a4b450c9df1736dc1a5c889f95a97084e0183728ade0c77fb13f1b69da12ccea0e9b4ad6e9008001ac20ddbf04691ad2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316934, "uuid": "ae4f9b7c-21ff-4f9a-8716-0f48d6902880", "value": "E0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316934, "uuid": "6483cba8-3249-4f32-b7c9-363f5c53b391", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316934, "uuid": "1de6a245-5d41-4e39-862d-9a3da00084be", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316934, "uuid": "cee20791-481c-4da7-825e-cf5e7bb8aabc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316934, "uuid": "f962027c-e3dd-4d4e-a607-8a5085b9ba36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316934, "uuid": "469ec7ec-ad2b-439a-a237-0d5cb1a6c5e7", "value": "1900e1b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20ec9da-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302528, "uuid": "1093156b-3adb-4994-8d1d-839fc3959864", "comment": "Malware payload (Dridex)", "value": "4bc3e1239d37da5afd9205b9d274af30", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302528, "uuid": "c38558e0-21a1-4e79-8e59-e777352d3ce3", "comment": "Malware payload (Dridex)", "value": "322bd2823911d00d81c862cd93493deb5342dc50e1095840a120fdf54c504cfd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302528, "uuid": "d1571020-d767-426b-8eb7-7db16fbb5109", "comment": "Malware payload (Dridex)", "value": "11e6444dc0e726825230e163d4e8ddef5076bc92", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302528, "uuid": "6eaa6924-28b6-45f4-859d-2db419db71e3", "comment": "Malware payload (Dridex)", "value": "8ee117744c2db36c78010a713f4f5bf3791862e9075c1cae223640dea829049d3409f478516a9504bab60bddfc654a6f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302528, "uuid": "75c9ac94-e2c1-4e8b-a61f-0dd3991e5f7e", "value": "EDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302528, "uuid": "40237f02-8f44-485b-a57f-d66898a7cbfc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302528, "uuid": "a1d161e3-b228-4795-b769-24272349027f", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302528, "uuid": "3a98efcc-da3f-4be2-aa8e-2602db77aa2b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302528, "uuid": "6c1c1b31-6cdd-45cf-a597-4708369ad271", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302528, "uuid": "a9baa6ad-d417-4c06-8883-7aa4f36c5a4f", "value": "4bc3e123_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a456151c-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620339361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339361, "uuid": "1359f52a-ad05-4058-860c-6e6aec9baaec", "comment": "Malware payload (Dridex)", "value": "0e8057c7ea8df01c610f024ee630f6b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339361, "uuid": "f7afdc6b-1623-4905-ae1c-97c72c929b10", "comment": "Malware payload (Dridex)", "value": "324dcd4b8481fb650ead457440eab5d67e8dc83b16097f9ab40feadd51e5b528", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339361, "uuid": "5b09f073-1feb-4357-a3c1-6110f9f97cbe", "comment": "Malware payload (Dridex)", "value": "ad3af4a3eb4406cd91f57cca8723c344982e4e51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339361, "uuid": "7e8900fc-c5cb-4e95-bc4f-3969bc4fc22b", "comment": "Malware payload (Dridex)", "value": "16a521b49c0c3aab724737c433a9140e33f7a5f12b5656cc165474c58f8b47d77737fbf24c3dc77b1d5eaadc23584823", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339361, "uuid": "a3d8a93c-d473-4c56-aa46-956242b1ec4d", "value": "B1F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339361, "uuid": "fdbd728e-01a2-4bd0-b6ce-78d9b863f9eb", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339361, "uuid": "af0ddf57-cea5-433e-8b45-5a473f870629", "value": "3072:9YG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/iddX:pERMVPG6+Y63HoG1QawL40Prx6KjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339361, "uuid": "25bcd069-e9ba-4e2c-b01d-467be8ed8f8c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339361, "uuid": "76baaec0-0ef5-45d9-92ae-5370d3eb778d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339361, "uuid": "9c726732-292e-4ce4-952d-4f9842109d6b", "value": "0e8057c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17215f70-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331394, "uuid": "b13c7384-1189-474d-a342-65873967ea4c", "comment": "Malware payload (Dridex)", "value": "c3434ef06f2a90d5ffa043fdbdecce3a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331394, "uuid": "a753088c-d7f4-4c4b-a875-c6735459d586", "comment": "Malware payload (Dridex)", "value": "3295b0778fa9539d67d5ee72eaca088840bbc1d0aca51ebfaa2a87c2633d6e6a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331394, "uuid": "0b849cbc-2d47-4dbf-a362-d38b07b60ee3", "comment": "Malware payload (Dridex)", "value": "65d39131f8ad3825e0fb9562e6d1452b8f8048e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331394, "uuid": "297afbb5-1e4d-41c4-bffd-0d3f97ff6d95", "comment": "Malware payload (Dridex)", "value": "86371128cba9864a802819dc59ec9bcd3e4a03ced7661c86ec222167b292b293bd4cede20412659f3c42a25ae025b461", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331394, "uuid": "3a4d4cd6-5c62-410d-bffd-a73fa3d9940b", "value": "91F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331394, "uuid": "95b6e8cd-1887-4863-98ba-96e53ac454e7", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331394, "uuid": "219da201-be5e-4105-b8f8-be599065dbeb", "value": "3072:VgG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idxc:5ERMVPG6+Y63HoG1QawL40Prx6Kzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331394, "uuid": "920ef35a-6e20-4c47-823a-833a3ae21e72", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331394, "uuid": "1b4ea811-8128-46db-8c63-7ce9344b4bd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331394, "uuid": "72da8124-5041-4697-a865-928442bd3b40", "value": "c3434ef0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ec4dff-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306160, "uuid": "381f8ade-dd5e-4d32-bf4e-b5db40eddad2", "comment": "Malware payload (Dridex)", "value": "64ab203e030ef6b6da46f760ed23a6c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306160, "uuid": "807d4eb7-67e0-4da7-9d9f-735d1383e6a2", "comment": "Malware payload (Dridex)", "value": "32975f737abcd99373e18a4ff264357bdaab69603c7d72e947f27fb22c8058ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306160, "uuid": "cf7327a2-798d-4a66-be4d-bfcd78f2b379", "comment": "Malware payload (Dridex)", "value": "54c178b3f25b2dfc13218b6448400da5fd4fcd38", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306160, "uuid": "75268163-be9f-417e-889d-fe1cc54ffe41", "comment": "Malware payload (Dridex)", "value": "e0250bb85a467574ba076db1410b5e05fd74b112d4dc62332266ce96ffc46aa488b8fe1b54338b4890988d4ed0557c22", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306160, "uuid": "6336be51-a239-4755-b36b-7b87fb49d3e9", "value": "ECF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306160, "uuid": "d3ae6b5c-6fa3-48d3-9795-8d1ae108f582", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306160, "uuid": "d87bd49b-aae5-4f6e-8feb-88518a104041", "value": "3072:gWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:g42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306160, "uuid": "d5dc09bc-f1e3-4d53-b089-05e4c025e6f2", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306160, "uuid": "392f69c1-fb56-44aa-bed3-0cd5cec1d333", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306160, "uuid": "32cce4e7-ea0f-4aa0-9122-47602c48e769", "value": "64ab203e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e04a40-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284494, "uuid": "30150d5c-40d4-4b37-b1b3-df04a5594534", "comment": "Malware payload (Dridex)", "value": "52de79d7c968da99055cfb013a2ade43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284494, "uuid": "0c273b51-20d4-4baf-9834-4c46582eea7a", "comment": "Malware payload (Dridex)", "value": "32b8a2cae0277bb3d19ae56fa885d149fef6fce2f1561e5ec1042962f2a11f38", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284494, "uuid": "b25136e2-b18e-4b3b-b45c-3482bee76468", "comment": "Malware payload (Dridex)", "value": "0aeefd64cc669373887e553bc29f50aaa0baa408", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284494, "uuid": "fc8e8fe5-a609-4c35-8634-8bb20daa39af", "comment": "Malware payload (Dridex)", "value": "dc71117c0ac1fd4538394a1e67edb3bcb61bc543a7f216b59d42d19aaae959cb9a6ddf137fbdafacd195eb8116fd66bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284494, "uuid": "a0713196-f716-4c11-a33a-38aef90fa26f", "value": "6EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284494, "uuid": "6b998f7a-171d-4ba3-bca5-e44f4247a6a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284494, "uuid": "d0fac8c3-ac9b-40b5-a954-98c27ef546d5", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284494, "uuid": "f304538b-22b5-42bc-9dce-b619add3405d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284494, "uuid": "ce745f5b-7df6-4c88-b004-60d4d602b46c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284494, "uuid": "0507d79b-cefe-4bb0-895f-4fac855093b2", "value": "52de79d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f56ae-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338833, "uuid": "10a85631-553f-4714-82e4-838d91c1b669", "comment": "Malware payload", "value": "2fca92d0f9f308818861cbdd3be8e3ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338833, "uuid": "35c15715-a565-4b4a-b09f-ab84ace9caa7", "comment": "Malware payload", "value": "333198d5285bb77e267c64fd867b8002566d62c47ce864c226583c02bc01c7a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338833, "uuid": "f18b44b1-7862-4bac-a313-da4f6e90081e", "comment": "Malware payload", "value": "a6a61abc758c9cedc99eafd1f8e11fe5463c5b50", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338833, "uuid": "b4e53d16-5702-4d7e-a436-755fb52ec44e", "comment": "Malware payload", "value": "6d757c8664d765268ad0507188eb28b73e3dd686cffe69b88a1091621fc05eb7632dec8172e5fec17b1338940552aeec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338833, "uuid": "676e8dbb-75ee-457d-8ddc-c5099e4cf678", "value": "26F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338833, "uuid": "1d0697ef-f454-4807-af32-99b8be44ccc3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338833, "uuid": "79f1cb4d-9692-4992-aeb5-38e9e429d20f", "value": "3072:XB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:x4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338833, "uuid": "cd4714b7-bcc9-4a7f-a783-9f0ea0907373", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338833, "uuid": "4c85d441-e64f-494e-889f-a5f7c7e6d3c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338833, "uuid": "194d9eb3-0f70-4cce-84f7-e5a1397c719a", "value": "2fca92d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d528e494-ae4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620294346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294346, "uuid": "a67e5f8b-c438-4449-b980-f709fdf32c1b", "comment": "Malware payload", "value": "d8fd19fef4605b4217cb2546c470a918", "object_relation": "md5", "Tag": [ { "name": "cuba", "colour": "#CA5694", "exportable": true, "hide_tag": false }, { "name": "fidel", "colour": "#452D7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294346, "uuid": "bb81a7f2-a61d-4bd0-9f0e-a947d906d8dd", "comment": "Malware payload", "value": "33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e", "object_relation": "sha256", "Tag": [ { "name": "cuba", "colour": "#CA5694", "exportable": true, "hide_tag": false }, { "name": "fidel", "colour": "#452D7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294346, "uuid": "4457ba48-5107-4a5d-b9ac-79b084788d79", "comment": "Malware payload", "value": "79786955d426945054e6d02050b8f9ada01e39ef", "object_relation": "sha1", "Tag": [ { "name": "cuba", "colour": "#CA5694", "exportable": true, "hide_tag": false }, { "name": "fidel", "colour": "#452D7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620294346, "uuid": "930fd407-b510-4bba-83b6-fb262a751b6b", "comment": "Malware payload", "value": "4b6c8bb73c511a640dd5f61e55647e1d2df1d409d83167bc5cb7ff5f68844e0f09c01b2c9fc401e607acf08a881a8163", "object_relation": "sha3-384", "Tag": [ { "name": "cuba", "colour": "#CA5694", "exportable": true, "hide_tag": false }, { "name": "fidel", "colour": "#452D7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294346, "uuid": "06e759e1-8d06-4e3b-8085-8d23db3c14c0", "value": "BBF38C21B5D1C472E8B3093218E99AA5893DF5343FA14DFB63970B3DCE302E16A35967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294346, "uuid": "f4cb61dc-3726-4636-89ce-00db3824dea8", "value": "3dfd6c1844e4962d112479d58d5da410", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294346, "uuid": "7355eb07-23ae-4941-9fce-382f92def3b8", "value": "3072:WRDVJnsys6q6q7U9jVse9yuqO3acuKk+huzeVgjedzFgX4t3YbSdV:4DVJsysPbIvse9vqM7uZEuzeuX4kSdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620294346, "uuid": "abdbc144-c792-457b-a81d-43feaec27e53", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620294346, "uuid": "3832720a-a756-494b-8881-def3929d52f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620294346, "uuid": "d63d33fd-7f79-4745-ba0c-31fe4a05b4d2", "value": "cubaransomware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea99f20d-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339479, "uuid": "7a8bdcc5-3d0f-407b-aa0a-41ac5293bd68", "comment": "Malware payload", "value": "7cbc960f717887b7355514928327b8d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339479, "uuid": "566f6e63-086f-4a07-a5ca-82d96ca2df65", "comment": "Malware payload", "value": "339d4a7293eb019ce3c916d9243955ae7b5a3be47e68190c24dd8a562582a8e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339479, "uuid": "3ae88311-d993-4ba9-ada3-4fd8ab7f854b", "comment": "Malware payload", "value": "e7aca3e4e1761a57b5f2cc8b00498825c812b3bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339479, "uuid": "4f023407-cf45-4ebc-baed-9554c35bf065", "comment": "Malware payload", "value": "a5525b5e6ee1077cd4a68e2bebd003239f7aebb7ee8c4d59f1d8eca4187bec3f7e1dc7f4045cc6f0ba2779572c849fab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339479, "uuid": "0efa1e04-5dad-4a2e-a440-6c566244a023", "value": "B8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339479, "uuid": "a6c72fdb-f4d8-4a57-a21a-651cbe2f436c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339479, "uuid": "1a09871a-e96f-4abb-b576-002241ea0e21", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339479, "uuid": "c6a8a953-b37c-4e8a-9af4-0ae6f29e8d5e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339479, "uuid": "7171cbcb-1566-4825-9c42-2c32f38572e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339479, "uuid": "5995f9f0-aca2-41ac-942c-afb83ca06893", "value": "7cbc960f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0b3afe-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324159, "uuid": "18033f44-4966-425c-be4b-f0c3656b0ee7", "comment": "Malware payload (Dridex)", "value": "7479a23ccd12d5c9b2eef8b46a0d773e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324159, "uuid": "de089220-ccab-45cc-acf3-1c1cc3ee4274", "comment": "Malware payload (Dridex)", "value": "33b93e02f426e6010d00275f7d0a0e91059e0c2523efa235c420a892f9190a35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324159, "uuid": "2e058110-3b29-48a6-9184-4fb38b3ea778", "comment": "Malware payload (Dridex)", "value": "d26f4afe5757851b4d78641c7d58df6b1b5a36bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324159, "uuid": "412bd93b-8e3f-450c-82b2-23bc3de8770c", "comment": "Malware payload (Dridex)", "value": "42d2dcfac4fa76401b28c58a85b92fe0e842a44e7f0e27fb55dfc1c5e3a5e11dc14a7ad80ea1cae7001850cf1f19c423", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324159, "uuid": "e094eca3-0ac5-45ed-9eee-d708f8b53c0e", "value": "9FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324159, "uuid": "9ef4feb8-15d2-45fe-88ce-1a8350f0d476", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324159, "uuid": "bdaf5770-2cd3-4420-8c76-a27296f23f01", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324159, "uuid": "db6c549a-8ef3-471e-87b4-70dc12eeed02", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324159, "uuid": "fb906ed5-1e43-424f-991c-35c137161f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324159, "uuid": "7351d5cf-4d49-4dfe-8538-1ee1dc24c41c", "value": "7479a23c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b029891f-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273668, "uuid": "35f0f9f1-7f1a-40ff-8cfb-57e026f020e7", "comment": "Malware payload (Dridex)", "value": "c5063e827b29109727e2c3ccddfd3a04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273668, "uuid": "97b49796-6db3-47dd-a409-d1db2e6d3b72", "comment": "Malware payload (Dridex)", "value": "33f962617529cef14d4470ed592cf26504dc38200f9575985bf9f2c06f079261", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273668, "uuid": "7a0472ee-f8b3-48d8-8c0f-03a0fd7ec595", "comment": "Malware payload (Dridex)", "value": "cfc0096b8465138b758ed329df72a22f9a12da39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273668, "uuid": "feb00a82-ae1a-45e5-b88a-2849be5a999e", "comment": "Malware payload (Dridex)", "value": "5c9033302e4619789a4c164f11719415aa4e1cb93eff55d69770306e7fee0c0855d3269bb24739da986560b92924e5cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273668, "uuid": "8df458aa-146f-4864-ba82-9a14c8a1a84a", "value": "FFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273668, "uuid": "1f9eafba-a981-4165-9efa-0facebfc8dd5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273668, "uuid": "8c1ea131-e927-42db-82f0-840a54c4bacc", "value": "3072:PDlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273668, "uuid": "43fbc846-e368-4e3f-931a-f9425cd8a685", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273668, "uuid": "94c38aa1-84fc-4259-af01-e841860bcbe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273668, "uuid": "19beb14f-a1f7-4266-bbf1-0cea44a84a52", "value": "c5063e82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79855295-ae0a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620264557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264557, "uuid": "de28b0c8-c9f2-4377-b5f4-feb4e94f0e26", "comment": "Malware payload", "value": "aa53a47cf27cf8982e8c07834444c9a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264557, "uuid": "0258f783-8c74-40db-b016-8b45728c9f7d", "comment": "Malware payload", "value": "33fc694cdd58475a990849f5738ce2781dbd8f3805d8a330dce03d3709433982", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264557, "uuid": "87264256-b492-4bce-addf-3849b803e7cf", "comment": "Malware payload", "value": "5eaf0ccd9bea59ed824d4a64b2f470322c114f3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264557, "uuid": "062c8b33-7cf2-4829-a418-5291276a3c50", "comment": "Malware payload", "value": "c68c51bbf4761f32d90b0f2cbb6bff42901595dbc25bffec7f934828ef17e9e2e0778667e583aaebbcc8345d44de7fd1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264557, "uuid": "c3273c05-631c-4de3-9963-e289f88ed912", "value": "EC262A17F9D704EAD57EF2708296A732BA71349943713BD36F904A991A26FE07A3D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264557, "uuid": "c0217e00-b9a5-47ad-9db0-5a1c0ffdb57d", "value": "20612d6eb20a68293e9cdbef2f5c2b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264557, "uuid": "abfd9db3-d809-42a4-afbd-76aab1d2db7b", "value": "49152:4SrHAwUb4Dp4wiqPZzko0NRtq1SsFvKFi8HpgGPdP6VX8V4Lc0qTQQ:4vWfKg78HIVX+vQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620264557, "uuid": "411768f8-c07e-4d01-a1d5-7595423c1c86", "value": 4468288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620264557, "uuid": "7bcef844-0b6c-4739-a07a-19dd67a521cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264557, "uuid": "35e2e3c3-9696-4ae7-b81c-3be41afcb0bf", "value": "banload-upx2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4676d245-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285517, "uuid": "b6656088-7ccf-4a97-a1b1-20fe15fa16f2", "comment": "Malware payload (AgentTesla)", "value": "b411b84963aa7abd405a054f6ec0d351", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285517, "uuid": "d8f2d1a5-c34d-4c17-9014-c71a64821877", "comment": "Malware payload (AgentTesla)", "value": "34380ef9c6381117678077c058c01a7726209854d4bbc0283dd60a25f77e6558", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285517, "uuid": "d7093d93-a00a-49dd-b351-af879b94cbd3", "comment": "Malware payload (AgentTesla)", "value": "7dd8d83812b05f0d2281ef7f2c189d38fba474cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285517, "uuid": "ffd90ae1-3dd2-4b25-bfa6-6b32c4153158", "comment": "Malware payload (AgentTesla)", "value": "2ff69cb9a20739b72ccea624ae50ce5c7f983fe273c59667453c4792369b713be66760eef7a4237ebf92e8c3730af2cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285517, "uuid": "10d47a8b-3ef0-4e1d-9836-31803e0407d8", "value": "C435BE2222989920E17F63748462C13947F67E03E676C71CBAE97C9B3F73681D65B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285517, "uuid": "df9e4611-6956-4faa-ad2b-cdea5ffc5f97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285517, "uuid": "030af497-adfd-4de0-bb91-bb16454fe69b", "value": "12288:alGAHjdcnoYMrENK9VhquU4eJZOtxEYehfChHcW9Qr8:alXj6XNKLh3jeJZQl6KhHe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285517, "uuid": "60113ac3-3e54-4daf-9b7a-cd0b9c005c9e", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285517, "uuid": "7dd1023d-7ca3-4b11-8b7a-6ecd75332183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285517, "uuid": "3baca3f8-68fd-420b-bd7d-0035fd31e59a", "value": "Consignment Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2641dbf5-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331419, "uuid": "256fce82-d22d-496d-b256-bda0d0a31862", "comment": "Malware payload", "value": "6d2fd8361b0b419b2514fde4cad67b00", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331419, "uuid": "ea124902-297a-4efe-a256-1e71dc5b8922", "comment": "Malware payload", "value": "34488886ca264892317c94ad156d4ca3fe3e9978937034b31d569549dd637ff7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331419, "uuid": "8078dd86-ef63-40eb-a13c-7df2d81a79ee", "comment": "Malware payload", "value": "145f63ad2a1646af72a0c8236288b36bf47c6c69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331419, "uuid": "e07e1c9e-c6db-4138-a8e8-0ac08b4bcef5", "comment": "Malware payload", "value": "9e4a461c10f4fbe9dea4ffdecf210b2d0c51a6e698177e9263988616be931d38b0f1bc224c686f75c442b77f08daa5ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331419, "uuid": "7ac239c1-35fe-45a9-a289-6a3510b0775a", "value": "28F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331419, "uuid": "f5906490-6777-4065-a3ae-893d4344e445", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331419, "uuid": "667d5af7-dbb1-4102-8068-0b0813a20882", "value": "3072:ZbG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:wERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331419, "uuid": "12aebc00-f2f5-43a0-8db6-dc305b3c88e2", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331419, "uuid": "7b62937f-3d10-4c4c-9cc9-9ccf931dd01b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331419, "uuid": "b2ddcde7-6ea9-43eb-8aa9-50ac12d2f861", "value": "6d2fd836_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4124299f-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334900, "uuid": "ffae0d55-8c55-4690-bb16-9840df41c633", "comment": "Malware payload", "value": "3c6fed1e19ead9658abe8f86f70097ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334900, "uuid": "ba99a429-35e9-41d6-b375-c57894dfe997", "comment": "Malware payload", "value": "349c91f40545cf6504f9e4e746efc56c631de7b6d53031813fd8dafc9dae22e5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334900, "uuid": "5b4933bf-adca-4dff-975e-4ecca5fb87e8", "comment": "Malware payload", "value": "2ad544de8b5e3b9f617e7d266c6e2893136f7404", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334900, "uuid": "3d099402-10f5-45d6-9912-a47dfb8cabf5", "comment": "Malware payload", "value": "9500849937f19730a4d1186293644823e840f9fdb8c7bd571e4c16e8dc167e54de166d2f50fe745a124b6ec14c95b7b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334900, "uuid": "3b62ec07-7733-44ec-8a6c-7f630aa89c62", "value": "B3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334900, "uuid": "abfe303a-c352-495d-9556-346bd3f14556", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334900, "uuid": "9c18b9fd-4cf2-4375-b659-e312175ee729", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334900, "uuid": "cbc01ccf-55fc-49bf-91e0-aef27a9077c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334900, "uuid": "58a7d58f-10e0-4ca8-9638-4e6acd0ef37a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334900, "uuid": "c1218fa5-9398-45c4-a506-4ddc46518fa7", "value": "3c6fed1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf54adf-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338703, "uuid": "b5e08c0a-a1d5-4073-9185-8aa7926e94fa", "comment": "Malware payload", "value": "951d20977efc833ace2473d5d29dcd1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338703, "uuid": "60174e02-54b0-40c4-a93e-45a7b02dddce", "comment": "Malware payload", "value": "34a3e7ade299ac4219ffd5585292fb72fb7bec83d9b3bd3fd07dfee9fe868711", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338703, "uuid": "66624c7c-d2ce-4bf4-bd18-5eb343c7be10", "comment": "Malware payload", "value": "94970fed7964f27a067ffd03a3cd067d58bba286", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338703, "uuid": "f0751f07-3af9-4b69-af61-9fe64af2f90c", "comment": "Malware payload", "value": "461d638692aac70aa900400b06c01329c80ecfdc1595799cfe111781135ab06e5d6bc2b600f1c4fe5d5df579308f694a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338703, "uuid": "3f588249-3279-4d0c-9d45-52afd6f4f8c4", "value": "29F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338703, "uuid": "7321ba9c-6041-4d18-8f64-de47241e9295", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338703, "uuid": "4962f2dc-aeee-4b7b-9d87-4faa8cd75774", "value": "3072:okG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:2ERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338703, "uuid": "80f576d4-044f-42c4-8a0f-b9672f5a1a91", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338703, "uuid": "7736eaed-3e72-46a4-b841-3939905d37db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338703, "uuid": "cc370c69-692b-4e27-86e4-6c4dfbaed1a1", "value": "951d2097_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c25f9e-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334883, "uuid": "5f6269c9-b83b-4bab-902d-15b432704245", "comment": "Malware payload", "value": "569afc3aff553638f7fe97672360ba61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334883, "uuid": "b4edcf70-9dfb-429c-94ca-fe3b8a0f2d04", "comment": "Malware payload", "value": "34f5f0a92660c81bcdcb80fc62726eafc02e1b638cba3e163636e36c482afa30", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334883, "uuid": "88b97c06-db04-431b-98c7-64f769b7c82c", "comment": "Malware payload", "value": "317fd1239dc8ee5d9ae72830c826530a8df5facf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334883, "uuid": "58373a3d-96c1-4023-a400-28f4a1322b4c", "comment": "Malware payload", "value": "09c050ee4d66710349692298988cb7a06fc6bef16b52eba8ec29a209ee2ef4d1f0c280f82dfbda1b2d9f50dc49e22a02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334883, "uuid": "4d06c173-e096-4d46-9592-87956082d0b0", "value": "AAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334883, "uuid": "126f7f68-35b7-4dfa-9ad7-9142dc1ff031", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334883, "uuid": "1e3ef035-16bd-44b4-8e70-81165a39ff33", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334883, "uuid": "6f9e3596-e64e-43b7-b09f-281f7c7503dd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334883, "uuid": "8ce43cf3-3c1c-459e-8b44-b2694a99ff39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334883, "uuid": "9fe58e03-6655-4d04-9c60-9753eac94c49", "value": "569afc3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca89294-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338731, "uuid": "a825236a-5384-491e-848f-df4485d3479b", "comment": "Malware payload", "value": "b29f1783f6121ddd64d63bd6a1add15d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338731, "uuid": "e3970a8d-8a8a-457b-afb0-0d983c8e700d", "comment": "Malware payload", "value": "3521476fdd8d5e519d3b304cddb120261772009b3aa08d857c70145f6c373641", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338731, "uuid": "ce9c7ec3-16be-481f-9c69-42749e970fa3", "comment": "Malware payload", "value": "b0f523529127893111370a43b1b9709e244d20ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338731, "uuid": "67b71c33-53da-43f9-97e7-87f9ca55123c", "comment": "Malware payload", "value": "7ffad15994da99d04fbf90f4cb7e68ef8ffeb7da76283dc2a815d0fd28146225a7986341b17b1adada6b27ec7dcbfa6e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338731, "uuid": "c9fe3cc5-fd29-4c16-b507-df048f921bb4", "value": "AEF3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338731, "uuid": "9404c044-dc98-47bb-9b76-481c66af338d", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338731, "uuid": "73b81747-4690-4c9f-baa7-72232d047403", "value": "3072:wkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:+ERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338731, "uuid": "a4795fea-7d7d-4107-8038-8762c9d537e4", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338731, "uuid": "53a3b0da-d3e6-49a4-9f64-981bdcaf1138", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338731, "uuid": "f567a0dc-685e-4c19-b15b-eed4955c49d9", "value": "b29f1783_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1a3941-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309660, "uuid": "c5206750-6904-4831-8a73-ff86717f3616", "comment": "Malware payload (Dridex)", "value": "0185e1bc7bc61aa9494407c7935e6b80", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309660, "uuid": "f246c7d6-851b-4dc2-bbb6-c6c88e6e26d0", "comment": "Malware payload (Dridex)", "value": "354b3f9e9173342762988f9327e5edc6c8dd7b41bc3e9c69ecdcffdc2694cf35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309660, "uuid": "565d78b3-f268-4889-b277-0c60fb662a1d", "comment": "Malware payload (Dridex)", "value": "cf41b02c2c9ac3246baea1cf3e782a1e21e424f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309660, "uuid": "dccb68b3-332f-4e05-b2bf-085251a53c4c", "comment": "Malware payload (Dridex)", "value": "edbedfea5cfc432a157a526475a6d72b2f38be52446f9d36fce1b2db1744e17e77623b73f8a927a569c48f4b9b36e3bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309660, "uuid": "8dab1a70-124a-4396-aeef-beef4bed0ed9", "value": "05F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309660, "uuid": "2010dc46-65a6-4141-9630-d0bf64e45146", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309660, "uuid": "7ec5f473-cdfb-4814-be31-834dbb42d260", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309660, "uuid": "5abe258f-a1af-466c-b845-779d730976c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309660, "uuid": "e838fe4f-9778-48d2-9483-766efc8538f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309660, "uuid": "9461f342-bc48-45e4-aa24-018098b2398b", "value": "0185e1bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ecf1e1-ae45-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620289811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620289811, "uuid": "6b147ad4-bc0b-4fca-b61e-184beae796fb", "comment": "Malware payload (AgentTesla)", "value": "4194149553d08ab8813d4ec5d198678d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620289811, "uuid": "dc0578f1-8c0e-4403-9029-b97e36db164d", "comment": "Malware payload (AgentTesla)", "value": "3554907035fcbd16600a742b742765253cc472b496b4bbf54228c1e5772a7cae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620289811, "uuid": "deaf4620-cdc5-40ee-b59f-d78adcc39069", "comment": "Malware payload (AgentTesla)", "value": "bfb9ae6539134779eeca3efc7ca2ef829db94670", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620289811, "uuid": "56d9c0be-cc0c-487a-8205-4c3afda8c010", "comment": "Malware payload (AgentTesla)", "value": "c1fde7e0c1e48dc840b36753048a28f5be267ba85a4085de7a05b2d2d365e3b84f0b0e8463286e5f8e388d75c1f0015e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620289811, "uuid": "ba36f2fa-cbc6-4c8a-9820-d85fbc38e152", "value": "3C7423D8D2F528B2295E3D5DFA0ED224706187EE26F474B1E3F8297934F05618BE31A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620289811, "uuid": "fff9b14c-3382-4bcb-a125-3fb6694e58b5", "value": "6144:YTXOf3vtM+U4KFpEmacX4xtYj5MTAArI5vdicCoJBP0Lpsh4sLUhIjYtRo7t+:YTXO9M+U4KPFlosj5MFI5vgcfBeGhLU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620289811, "uuid": "e65a52ec-5a1c-495d-8eda-45a255103a32", "value": 370650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620289811, "uuid": "78a07f67-0080-4567-954f-7bbd2b094733", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620289811, "uuid": "919c13e2-31ee-4f42-8e8d-15a91c5394ad", "value": "8e3ce8b450e36c5785512ec8c21e9af45a125386b9a48b19125f7d5d51723e00.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3407d46-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302450, "uuid": "3083ff7a-5dda-4311-b917-3cc421935bb9", "comment": "Malware payload (Dridex)", "value": "4de517b8e0dfb69a928ca860526dc54c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302450, "uuid": "38f5b3b5-18d5-439a-95e3-a74a9ee408ca", "comment": "Malware payload (Dridex)", "value": "3576a7f9bd5b512931b4569fe8e231d944e5c52d193480f3ef7b798a2c027e5e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302450, "uuid": "8c8f05ff-07d8-4684-81b5-77f3d51632e6", "comment": "Malware payload (Dridex)", "value": "d41d9fddb0495965f9bb41d84ca5c233b00ea674", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302450, "uuid": "62b759c4-4b2e-4791-84ce-f69079b3409d", "comment": "Malware payload (Dridex)", "value": "58a0c1824472b80c188fe1a0286b53b9e3820e90893b530ff9988fc748d5818bcc2760a8c439c495033f0912fea53586", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302450, "uuid": "8a39d13f-792d-4e2e-a6bd-f6aabd9fe537", "value": "BCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302450, "uuid": "88a04458-6a4c-4293-b28d-4a98e4140778", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302450, "uuid": "48c10ddd-cf9d-4d98-941c-03308ff229be", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302450, "uuid": "66a0967e-deb7-4373-81e2-fdb628802c12", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302450, "uuid": "c2067be1-f0eb-42a4-b927-bab29ae2e108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302450, "uuid": "7d1fee8e-0f00-4495-8064-159f9ebb087e", "value": "4de517b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e423dbe-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266525, "uuid": "fb3caffe-ca24-485f-a2b0-0047c2d1235d", "comment": "Malware payload (Dridex)", "value": "b79c4d6a1a06c16bb261bbed2d644197", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266525, "uuid": "5e8dfff8-260a-40c1-81f6-eeb0a7de55f9", "comment": "Malware payload (Dridex)", "value": "35832f027a5c322a728cac3fe5c05c6dac03ba10667ecdb74f396f6aad2360d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266525, "uuid": "988e01a1-1ca7-4b9d-baf5-f4010bc6fdf6", "comment": "Malware payload (Dridex)", "value": "71bb7fa4cd76b84722fa17e6625d3b92fff41ff8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266525, "uuid": "2e2a992b-3f45-4452-913f-7f90936b7d6a", "comment": "Malware payload (Dridex)", "value": "1a1ae118c6b9599c2ddc0c5c01d347b96088411626a74ab39e5c10c40a40d796846f3f84b69a7ea09508e6c367771fbf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266525, "uuid": "da67c9e0-fc49-4058-9ef8-497b2cf8e640", "value": "F8F3C085DBABE87FC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266525, "uuid": "bfff26ea-2c05-4d88-9178-d2f17959c30e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266525, "uuid": "3bb51105-9fdd-4387-97a9-47d63f4b504f", "value": "3072:Ut45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266525, "uuid": "c2de8c29-f1ef-4d2b-8b30-c365d3c5dcb3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266525, "uuid": "6fdfb33a-75b4-412f-b654-38caf60266e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266525, "uuid": "d5e3b3fa-9351-4ced-8b0c-f8efaa9def82", "value": "b79c4d6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6b4780-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339216, "uuid": "f54171fc-2978-49e1-9943-082156dabf96", "comment": "Malware payload", "value": "20c94ef0c6cd94f748c730f8039822fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339216, "uuid": "75092e50-1f19-49d8-8a6e-79ca4834cd0e", "comment": "Malware payload", "value": "359e063d471117f6523b58f8505ce23e763fc3b540b52b8a5b09ca817897fa2d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339216, "uuid": "a85d15a2-a15b-4e70-b9d6-3c0d823a4907", "comment": "Malware payload", "value": "ea33bf7c6daf66e2777de3b400f2096f41618a31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339216, "uuid": "a7ffb7b2-c80d-47bb-956c-2eda01b6d995", "comment": "Malware payload", "value": "5e697fbd27d090073cf49487f1aecc985db4bc5ad652bcba9297e01646bf2b8fe53023fe6f73ab32d95aab63bfaaa576", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339216, "uuid": "b0616212-1dd8-47d9-958e-a5ea889c0b5f", "value": "28F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339216, "uuid": "e5f869d2-dc66-4fe2-b509-3ab413dcf780", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339216, "uuid": "b542c786-686f-4a91-b99d-200b68c38090", "value": "3072:yeG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idDf:+ERMVPG6+Y63HoG1QawL40Prx6KRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339216, "uuid": "59c35170-4181-4029-a4c4-77bed65e9fee", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339216, "uuid": "5527b41a-e6d0-49bc-a642-57bbbd182a82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339216, "uuid": "19e14002-122c-4886-861a-321eac8d2e99", "value": "20c94ef0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2b84fd-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338999, "uuid": "afc00e27-2f66-4835-a63e-274555156a00", "comment": "Malware payload", "value": "46f81872184d20ffe29ee1e4be7c1621", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338999, "uuid": "a4432e83-5fea-4c8f-a8c6-e3bbd1d74186", "comment": "Malware payload", "value": "361271c70c96ec02751425633e85400eefaa5cefd4293c6cf539784833322982", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338999, "uuid": "0aedd3ea-f357-4861-a4d3-fe7bb0088efe", "comment": "Malware payload", "value": "1a5b967ab298a9aaef34400f6b64663d9ab1b948", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338999, "uuid": "76c474db-989c-4a2b-aaa8-06e1e42edb6e", "comment": "Malware payload", "value": "ebd443fadb2de795fc2c1150601dc7c5615284155fc7a9325c14614cea87805e995042a70ce6bc82d35472d9c8ed887d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338999, "uuid": "ae8231c2-5f8c-414d-9c03-82e5b4de23c7", "value": "23F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338999, "uuid": "02c13758-1ee6-4bec-a530-eac062a5311d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338999, "uuid": "192a1196-1569-4871-998b-71afbe04c002", "value": "3072:8B45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338999, "uuid": "18219280-33ee-4374-9f2e-6b7baf932516", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338999, "uuid": "d41c9bb6-9268-40f4-a7c8-13634e1b6b61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338999, "uuid": "7d97effa-ae2f-4eea-b3f4-45c70b806332", "value": "46f81872_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e69dce-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334913, "uuid": "e6705556-648a-468d-a88e-a10ff08592c2", "comment": "Malware payload", "value": "149733b9339a628801c70a45f4e80225", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334913, "uuid": "4238cb2c-eac4-4c1a-95da-486d208dfa35", "comment": "Malware payload", "value": "364afc6ec1441d76ae27076048ef21f0798819fd887803f0eedf93d534a20815", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334913, "uuid": "4b6c85af-bd69-450d-a06a-5576c7da90df", "comment": "Malware payload", "value": "867dead9551fe09150c2f66f8e9e01bc914d7c7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334913, "uuid": "7ed253aa-8597-4595-a357-57d4779e12d2", "comment": "Malware payload", "value": "db713dc2bd244494de9ad01c228428b0b23faecceb20df22ffa53e7fd1b542db9c3b6b132bd56e05e689526f5ca0712c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334913, "uuid": "ce7c8af5-955f-46fa-8c21-0acf3eac6cdf", "value": "76F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334913, "uuid": "a38c8235-5c80-4700-a5dc-dca943427d7d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334913, "uuid": "bb971af5-3204-44b6-bcc0-3317dc966db4", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334913, "uuid": "e727fe07-9768-48a9-98c9-57a590e9ee48", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334913, "uuid": "5ffd99ac-9e32-4d90-b139-4c0139c13f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334913, "uuid": "6cb0d641-4ba6-4b6d-ae5d-c45a542a6c2a", "value": "149733b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8958933f-ae98-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620325572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325572, "uuid": "f7dcabb7-9e05-409f-a793-90329735861f", "comment": "Malware payload (IcedID)", "value": "6a8b0d96b3d8236e46e04538bb7314d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325572, "uuid": "7c70c9ef-08d1-4749-a6e3-2d2c84ac1c19", "comment": "Malware payload (IcedID)", "value": "36919e6f27708c1fb53a693e7e6dd14fa8c0bd119825e4eaa7a442b33a5dc5b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325572, "uuid": "be2bb3d2-ea71-4bac-9997-f4b751132e2d", "comment": "Malware payload (IcedID)", "value": "2a93bb52744ec63a8defcc9f7036ebcf36ad98f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325572, "uuid": "26a5d5fa-5089-4b36-99a2-32f16d38f92f", "comment": "Malware payload (IcedID)", "value": "593ecaab71660ecd58204897b122ff29e23b9fa80cf0fda8d0ff6274357cfa11641f194b257cfb55d474414f9f634446", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325572, "uuid": "a4d3cd42-05c0-4b86-bde3-12ea50cae479", "value": "A6347127C5ACE17DF64754F1343CEB89C544AE80AE118DD7A6C6D812AF139F123227EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325572, "uuid": "f1c8d2d7-37aa-4052-be18-3b8042c6311d", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325572, "uuid": "650b8b4a-bb12-45dd-bbfe-ed2188b95b53", "value": "6144:6Ax88XNHffIYjh6QRdk7fodX67o8ck+EdB7vMqRtr:d88XNHffIY4TBoJqRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620325572, "uuid": "fa2daa3c-b8f1-4c66-ba0c-a293bd59466a", "value": 237144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620325572, "uuid": "4cdd1095-1aba-44e7-b5ca-dba909e44c0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325572, "uuid": "bc9b1c14-e22a-4990-912d-812c6aa6117b", "value": "36919e6f27708c1fb53a693e7e6dd14fa8c0bd119825e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505e1b05-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339221, "uuid": "b1f91f04-376b-4730-842b-5784487c836c", "comment": "Malware payload", "value": "25c3e585036c801566124ab6c856c8af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339221, "uuid": "8b962dba-7a1d-4438-aaf9-ef28cf481974", "comment": "Malware payload", "value": "36ca4da8b9c08adec8abb6346fb37136e76f993fc769ed9cc390af334d3480af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339221, "uuid": "58794776-2cb7-48c2-a0b7-370f59b68ac3", "comment": "Malware payload", "value": "27d3459a9bf2ecd5abfec0b8427faa12d2f63347", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339221, "uuid": "41c0901f-da17-435e-9ca4-cbfe443c71a7", "comment": "Malware payload", "value": "a89bac227ca8118cae7095e3326e7fb13bb8320b0884c1ae9375240e6d0f7fce3f56c6a5fb7b5f576d6af2f4caa4e1a9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339221, "uuid": "6dd3a5b1-78c2-4c92-b0d8-3fb0c3cdf632", "value": "1DF3C004D167E6D6C51A583322EA3B3BA6314150D748F885EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339221, "uuid": "98811c59-582b-45be-ad52-b90d576e898f", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339221, "uuid": "a664794e-1d1e-4efe-be1b-f7d72d8ef2e7", "value": "3072:9+G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/id9l:LERMVPG6+Y63HoG1QawL40Prx6Kvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339221, "uuid": "e7eb3b76-b2a2-43a1-b76e-ac586dc42e67", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339221, "uuid": "68330186-aa41-4378-bca8-c9c5ef017764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339221, "uuid": "ce7873bc-ac32-457f-bf02-b1cb4744f801", "value": "25c3e585_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318440c4-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277321, "uuid": "07405b88-fd9d-47fd-9405-4836e0772328", "comment": "Malware payload (Dridex)", "value": "5df7247c8d48c5326c509caff40cd2bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277321, "uuid": "4fccc8a6-59eb-494c-a819-897ffe63e4a6", "comment": "Malware payload (Dridex)", "value": "370636c312dfa8cefe762b761cea4293441c59e88a735926c7a4c5f9f090f47d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277321, "uuid": "ae8b5276-788b-498a-aa09-7f52472b617f", "comment": "Malware payload (Dridex)", "value": "7a090e26684977bca2e058af84fa92d62158a4b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277321, "uuid": "32c81f53-2ba0-4229-b435-ee421170d6e9", "comment": "Malware payload (Dridex)", "value": "886a4adc9c19d4ee7caad422ef39bc0d3cf427b7705f0b96df4838ab7f573188b72efb8219a871e3013f6b34e767ad55", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277321, "uuid": "b1f024f1-5bce-4d78-aa15-ddb8ae8db8fa", "value": "72F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277321, "uuid": "74f4eb1e-03f6-42fc-8d6b-b08c5d464979", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277321, "uuid": "493aba51-ecd2-4261-8302-4fd521981e38", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277321, "uuid": "41e569e1-b11b-4ee2-bb6a-70264f4a0413", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277321, "uuid": "2e57d667-218c-40f9-b306-df8f666a76d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277321, "uuid": "07eea6f3-8b7f-4d37-bb19-f3b1e21a5d20", "value": "5df7247c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d95438-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1620284502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284502, "uuid": "178918af-51db-483a-9fad-93b279169c27", "comment": "Malware payload (Hancitor)", "value": "693df6e9f5dc0cd3ed4c6ede503ce8bc", "object_relation": "md5", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284502, "uuid": "d0b8062a-fef0-4993-aca2-958b71c55de6", "comment": "Malware payload (Hancitor)", "value": "371357b50b0b673d30e42f68d65987dd340e7eacd482c4a5fdbf0f12a2cb2bf6", "object_relation": "sha256", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284502, "uuid": "fd6e5d47-d3da-4d03-b0ee-9645acdf3f38", "comment": "Malware payload (Hancitor)", "value": "6cf0cdcae848f850a2c6aad0ebf1329c9801036c", "object_relation": "sha1", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284502, "uuid": "572db10f-0276-4ffe-916f-50e9c246e01d", "comment": "Malware payload (Hancitor)", "value": "948bd3319ad162412d669ae5a06fe3cc491fc880e41915be3003a4ac48fbff8d2b49e3f71f93185457913b93924d843f", "object_relation": "sha3-384", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284502, "uuid": "8675b34d-2ab4-4d18-9e02-8395bb9cf06c", "value": "1E55AE10F640C13AF4B300B88ABECAADA639BD215B1845CBB3C87B9E1B355E16D31757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284502, "uuid": "75f0ca46-4216-40fe-a659-dd457ea88d6a", "value": "24576:dEIjNvrhFNrYDpLdlmnPJAXauRWtmBI85MFTo93ui6IBcSMrlIwf:dTthFBYVdQRAqFo3R6ISSsIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284502, "uuid": "a7416271-950d-4aac-80a7-44a978751dcc", "value": 1402880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284502, "uuid": "37845c23-521e-4bb0-bcbf-db4dac8e8df4", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284502, "uuid": "0e73e16c-8dd3-45f8-8a7a-1fac8f1102b8", "value": "693df6e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f65432a-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309718, "uuid": "72d464ef-1eb3-4dab-b49a-0d4131f89f53", "comment": "Malware payload (Dridex)", "value": "b8003db71dbc1a16d431eb71f2e74294", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309718, "uuid": "d41b67dd-e4a3-4fa8-95f7-11d17e219df9", "comment": "Malware payload (Dridex)", "value": "371e593cce9429d13c0b7e1a82c8595d6a65e1cacb86c1f6defd9a40817e8ca4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309718, "uuid": "92a589d2-0152-44ae-ab3f-fd23d388c040", "comment": "Malware payload (Dridex)", "value": "fb0315cdc6704c7bfe6b5bdd4ff96cfb79ee2274", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309718, "uuid": "02f36842-a829-424d-b9bd-ce70db6b1851", "comment": "Malware payload (Dridex)", "value": "d7e3aa17b57092137526f52be1cbc7d45d848582571d4db4b11ecdb19cb604e8229ed9c7d5263973425d90036acb3a81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309718, "uuid": "017d99d2-a76e-4bb4-a0b4-dfbd1376e80e", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309718, "uuid": "8bdc2428-c345-4fcb-8614-52f73648d685", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309718, "uuid": "96bc6bb6-ba08-4405-8cba-b62509deb3a8", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309718, "uuid": "89761b4a-1638-4924-875c-a561b7bf8fc2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309718, "uuid": "4a5cfe09-4252-43dc-86de-4fbe6ae26e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309718, "uuid": "6d4e5200-222c-49cc-a26d-e65788d0b110", "value": "b8003db7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13be9480-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (WSHRAT)", "timestamp": 1620320221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320221, "uuid": "3c855961-b023-47bf-813d-454b29a8b8dc", "comment": "Malware payload (WSHRAT)", "value": "97bdc3e834299ad8505b94da49176fc7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320221, "uuid": "82a7a4c7-2234-4003-bbe3-0f2231d6cb63", "comment": "Malware payload (WSHRAT)", "value": "375e7e5373d55c3186ca08f32134145b57616753a82b9d9c83e69b603e6b7edf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320221, "uuid": "efcd2bb1-5e78-4d66-8d5e-59284fdecb11", "comment": "Malware payload (WSHRAT)", "value": "4e64a2fa3e3827815eccc6e7ca00e2187b240214", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320221, "uuid": "703f30e9-394c-49fd-ad41-d08ba90337cf", "comment": "Malware payload (WSHRAT)", "value": "bec0a5cab6766bf86741744dd685561fd2bf2643d1e54f2592e47aabcfba453397e725b4ce692ee96713e25a2f6152cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320221, "uuid": "a3116016-5e79-460a-ba16-92931c52eea0", "value": "E4D44F8125F9392FD372EE58CA0198196868FF131C8577E96B863F4DBD7C8881AD9D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320221, "uuid": "b2a0a5eb-026e-4403-b5e4-04683259d928", "value": "6144:yTXjRsLR0YE5jILL6DLpBF3ILTm30E1ShBlS3cGdjRsLR0YXzMrX9DojVP1sUXLr:CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320221, "uuid": "15d4b9ab-5506-450d-b98e-24362a7f93c3", "value": 615660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320221, "uuid": "0d8225be-749a-4869-93a7-7a9b1377f217", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320221, "uuid": "a1858391-c3db-4073-9f0e-e23724b44900", "value": "06052021.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57f41d0-ae2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620278912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278912, "uuid": "65dfbc9b-18c3-4fff-a1da-41d76fe2bd68", "comment": "Malware payload (SnakeKeylogger)", "value": "9c2e176e111bb2f7ed1925c5c7d13d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278912, "uuid": "45db3bce-0235-40f2-910c-60f3000828c2", "comment": "Malware payload (SnakeKeylogger)", "value": "375fde3cc68b1a198dcd8baf09ac0d386b908eac19865fd30be1519889711322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278912, "uuid": "70a70394-6497-464c-9f0e-b6f4e42d24cc", "comment": "Malware payload (SnakeKeylogger)", "value": "ac770a9fba940e7922650d20183404ae59eaa9c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278912, "uuid": "635b9ebf-a80a-498f-a77b-52c91d0afb40", "comment": "Malware payload (SnakeKeylogger)", "value": "26eba80c6b9c6f6fc43f687ac1ab81e0294232ef07d6bf76d7025cdd6cff4ffc3a0a4e646c84a7f0a01e0950d421a40c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278912, "uuid": "1320d1de-07c7-460d-933f-f281677bd42c", "value": "F7051A6B352C16F6E60A8D3193CE0E15419943B2AA37F04A4F703FF95B52D636936CAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278912, "uuid": "0be641ef-7d28-4127-b56b-f6969d1ff143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278912, "uuid": "c7cfbbd9-7d87-49c5-bd92-a7290ef12516", "value": "12288:TooLLoS60/K7yh0m148XponqCTLMGpEHd47j+pk0eE:TooLAcXCTgdO/BE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278912, "uuid": "ac00b4b1-9fdd-4d8a-8791-198a522c8b87", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278912, "uuid": "0911f41b-adeb-4aa7-86ec-8954e491d5c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278912, "uuid": "df0bd804-65a7-4b2b-9990-30276e7c539a", "value": "Pre Shipment Doc..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e31b49-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620309702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309702, "uuid": "86122c6c-db79-4839-90d6-857acd9abb8b", "comment": "Malware payload (AgentTesla)", "value": "3ef83bc46fd5da50c80b7bc71f87412c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309702, "uuid": "6b903821-8b18-4cb7-aec7-8c8b0b0d3129", "comment": "Malware payload (AgentTesla)", "value": "37c3b56ac7faf689f3d8d9b083e4101e09bdd0db48391c0f029fd8f7dba3ffb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309702, "uuid": "bdf4285f-a87b-4862-9ddb-090730c272d1", "comment": "Malware payload (AgentTesla)", "value": "b786db3ff72e5e6e6af20f557060c65ad691c26b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309702, "uuid": "808b4a35-7562-4d63-89eb-1c56d33e594f", "comment": "Malware payload (AgentTesla)", "value": "a11833e1d19cff8b252f65a6b3eab8d08f44fea61699e77f217815cee711dac684c3eebacaba83286633732bc1bcef1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309702, "uuid": "5a68e781-b8ef-45ef-834b-5d12dd68e9df", "value": "153717EC761075EEC617CC32DBCE1C25A6202176672B9607972303BD9A0ED57AF384DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309702, "uuid": "8c553d34-4ba5-43f4-a43c-d2581df842d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309702, "uuid": "1535145d-cd91-4a86-adcf-89a3b19b29ff", "value": "12288:eWKdHgg69qwwrroLLoS60/K7yh09lC5uiLF14QqLcvH7QD4fb+lmKAS6+dM4sORq:eWQgPqnoLA9Gu+1IR4fwAS6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309702, "uuid": "04f2824c-21c8-49e5-bd58-31e22d9e6525", "value": 24117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309702, "uuid": "295ac25d-805d-4e15-abec-4eb35841cc1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309702, "uuid": "6c30df3e-5708-4c0f-be4c-e34cd58cb340", "value": "3ef83bc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2459b758-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620285030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285030, "uuid": "0a74d7b9-1a30-4ed7-a641-8ab127c9ea7b", "comment": "Malware payload (SnakeKeylogger)", "value": "019f117cbe2a8db8cc8226aa82e45d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285030, "uuid": "23ad8704-def3-41a2-918c-94f3c9c0fbae", "comment": "Malware payload (SnakeKeylogger)", "value": "37f2fdd1b2957d8a8eb7fe5de5ea705ece492afaf2859165445d95b21cc885a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285030, "uuid": "e1af2c5c-34ef-47df-b777-b2c942b6dc89", "comment": "Malware payload (SnakeKeylogger)", "value": "b30ac2073366860e73c1a4f95c8f1cdf2a6a6ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285030, "uuid": "ddf11fc0-4045-489c-bb6a-2d422538a60c", "comment": "Malware payload (SnakeKeylogger)", "value": "2d0765364a6ac806dc7beab7191ac3061b00449a120e589f01946e8aeb5d173e8d552ebd0461685d3b99cfa49f86ea76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285030, "uuid": "897416b5-cdfb-4bd1-a947-3b93fe5da443", "value": "04F4023C31886A66D93E573C2475C44067F47A2A96A3FB1FBFD031B71F6AB1046217A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285030, "uuid": "f7e8d086-b25a-406c-b10a-7ada3dde99ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285030, "uuid": "184a37a4-8314-472e-8f97-97148c15c127", "value": "12288:NmtkfS3qThrQN9432d7XRriq2ZG5Hb1SDCddkFbubJxe+7M:t4S3Y7XR+qyG5JSsOC17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285030, "uuid": "5e3f256f-1d1e-4203-a5f7-f2c04dcff42c", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285030, "uuid": "53ea603a-d0dd-45c0-8115-5475d5eb7b6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285030, "uuid": "6b13c710-c486-40f8-9dde-d1ddfe9f5a3a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248815aa-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259261, "uuid": "f9d86435-fb5a-477b-902b-cba91bfec199", "comment": "Malware payload (Dridex)", "value": "4d9018afb8873d854300c7bf59b5a1ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259261, "uuid": "e197c030-a63a-4dc0-bd2b-608878096e3c", "comment": "Malware payload (Dridex)", "value": "387202b6c4fb19650b81eebbb1f6bc1f207a83ea57fb938fb36cac87e1bffa6f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259261, "uuid": "2858f474-a673-415f-a862-7a0d8e61e944", "comment": "Malware payload (Dridex)", "value": "5bd863107d7a66b9a4b5c922c87646f4a389dd77", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259261, "uuid": "48339984-0f72-4bb2-a541-53a100acefd6", "comment": "Malware payload (Dridex)", "value": "5f2f81f633a8fa077521aa7ed330fe3b4d6824fc84fddf05164e4d2833b680df8a33063e8538648bb50ccf658705c85c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259261, "uuid": "5729c763-0a37-47b2-9ddc-7192c2e3cf14", "value": "32F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259261, "uuid": "10480862-f80f-4ec7-b8f9-976220db96e9", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259261, "uuid": "a0b51d0b-0aa8-4763-bc6f-ee6f1193f112", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259261, "uuid": "fe335584-528d-4d6b-8ed8-f7f90b1eb136", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259261, "uuid": "8b77c022-3236-44d4-bd35-c222343878c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259261, "uuid": "bfb31d12-55d8-4369-b559-ac75b940c207", "value": "4d9018af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8534c910-ae98-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620325565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325565, "uuid": "25d299f2-a3b3-46ab-9a63-536ab34f4a0b", "comment": "Malware payload (IcedID)", "value": "69a9613ec679307c2600d6940211559c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325565, "uuid": "2f0a023f-9c84-4b44-8ab6-1af63269398c", "comment": "Malware payload (IcedID)", "value": "387713eb2858b620cdf67430b071bc942316f5c29644ce25cca0215d90444c96", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325565, "uuid": "626ae0f9-32a3-4065-b041-cdf8c7696d7c", "comment": "Malware payload (IcedID)", "value": "ab85b2755f1de47060d970067900706e26ad69e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620325565, "uuid": "1747e51d-5aca-4ecd-bf9b-bacf408ed356", "comment": "Malware payload (IcedID)", "value": "f5fd60ccc61d8e42d2f6a3558c2761b38bb6c120c2cca5528fcf3d31f46b6d53cf65bc918a6169351d3d41c9443304e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325565, "uuid": "ae7d5181-beca-4baf-a22f-8fa4e57e5dcc", "value": "20346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325565, "uuid": "bc710135-f3b0-4a0b-8e10-e16aee2af61e", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325565, "uuid": "0f17bf3f-cc9f-418a-a094-b8a3cb210b64", "value": "6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888IH:dJJLaU1mUGduNzGSijExi3oomlnG9PSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620325565, "uuid": "493796c0-9d1b-46f4-974c-b29d8f9d769f", "value": 240216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620325565, "uuid": "289bbad3-c29e-4eee-9106-83f0dae5566e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620325565, "uuid": "fa2d35d9-97df-44dc-aaf4-374311cd4b16", "value": "387713eb2858b620cdf67430b071bc942316f5c29644c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567ce792-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313461, "uuid": "d9a8331a-b17f-4922-bcbf-3067260be5aa", "comment": "Malware payload (Dridex)", "value": "ad7c719df2828d437e18f2ae1516533d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313461, "uuid": "dd986243-bc94-401c-8181-bd287f928c1c", "comment": "Malware payload (Dridex)", "value": "388437c9aa0b6ca1fac6a4f113e130fd2aca57714642effd475063f1275d7af0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313461, "uuid": "850f384e-ffc5-4478-9196-b501d0bee1f1", "comment": "Malware payload (Dridex)", "value": "16ec4844fd76a6b5ded9152047da3128f9533572", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313461, "uuid": "6b76161d-4202-45c1-9393-86ef302e8e7a", "comment": "Malware payload (Dridex)", "value": "abe1a069aebd3772d0fe4270d1cd8e94f57f1bf578ce28b4cf3b01c5dfb884d1cd4955987742e5209322d5b55bd86bb5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313461, "uuid": "67397602-c57a-450a-9d65-16a2de075db4", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313461, "uuid": "ec38db62-0cc0-43d3-8c34-500cb053d005", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313461, "uuid": "975f3f16-fddd-487f-a93e-0d2feece042f", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313461, "uuid": "5734e4a4-197d-465b-a036-9f298d57dc2e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313461, "uuid": "58ba3d8c-909a-4eb7-b054-253eaddb6efd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313461, "uuid": "9f9463b4-e4d4-4c98-b575-9a8743ce8ed2", "value": "ad7c719d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adce79e-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288209, "uuid": "a67d616a-9b2d-496f-b4c8-04b3256d8952", "comment": "Malware payload (Dridex)", "value": "8f8ab4d83c712515e6d7d624e98f60d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288209, "uuid": "95a5b49e-770c-4881-ab5a-29ddb44c0027", "comment": "Malware payload (Dridex)", "value": "38b7f58b1e4526d90fe3913fde165179bc75b80b684f3004fcbe9aca2ed3366b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288209, "uuid": "7831fda2-bd31-4207-8344-78e40d54412a", "comment": "Malware payload (Dridex)", "value": "0c5243bce2bcf4033280785ef645865357876ff0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288209, "uuid": "8a1a0db3-7bd2-49c2-b697-0d23458c8174", "comment": "Malware payload (Dridex)", "value": "b5b47c7a5fe21dd6f75f4538d72b82d76e6f1e2c188662cc404208609ae6d098f3a72c1ee46d4bda293cfe14685ef6a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288209, "uuid": "de35b3c1-ac2a-48c8-b975-fdb523e03d2d", "value": "B7F3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288209, "uuid": "9acf8fce-8dd1-4dee-a3fc-b7302e724103", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288209, "uuid": "eb13adae-61fd-42f7-b231-b4cb47583aba", "value": "3072:+B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:n4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288209, "uuid": "bc5973ea-575d-4a05-85b9-ebb3696bdcf7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288209, "uuid": "e91270c1-4ee5-4ea2-a9f8-db9da9259466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288209, "uuid": "a76baa4c-5ae7-461b-bea0-d34b6696f521", "value": "8f8ab4d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f42372e-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298873, "uuid": "a2a52e89-dea8-482e-ae45-3cf642274e35", "comment": "Malware payload (Dridex)", "value": "af25877deb5fdd6a74f227b3917767d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298873, "uuid": "7d453639-df95-456d-9970-8b870e8d2145", "comment": "Malware payload (Dridex)", "value": "38d1333f29cfe86e7aaa6b26b4030cafc312a10707e93decb37fbe96711af96f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298873, "uuid": "313c0e89-eb70-4865-9556-e1aa2b5a0e93", "comment": "Malware payload (Dridex)", "value": "550a35bc064e4b6b6f8248ebf4bfb00688c813c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298873, "uuid": "0fd8fd64-3842-4510-a0a5-6eb63200829d", "comment": "Malware payload (Dridex)", "value": "7e78b3c244ac2b682b7d6df2c6f133f03e5f36594895d2d3050794d062cb5c68675a859291f9e3bd91d467fc1b79874a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298873, "uuid": "128566eb-79a9-4093-80b1-9d083ce08c81", "value": "C6F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298873, "uuid": "86c9af77-88e8-49d2-bc3e-831855d2ff11", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298873, "uuid": "65e8b3e2-8d0b-4efa-8853-0bb868c043e7", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298873, "uuid": "4011175b-2195-406e-9e0c-aceec5363f31", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298873, "uuid": "c1d32068-39a1-41f8-95db-6b701bcbcc1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298873, "uuid": "60247a75-37fe-40a8-893b-1e5b7c228b97", "value": "af25877d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117a1773-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266530, "uuid": "899541ed-d177-49d5-a473-0cbe0493e669", "comment": "Malware payload (Dridex)", "value": "eb80bc4b1aacbd937d472449bdd94c6f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266530, "uuid": "ad95b3e4-b9ba-4932-acf0-bf9f5fb04230", "comment": "Malware payload (Dridex)", "value": "397d21e9a70526c87be262643a0aa6eafff60d849ea07b12ca93d7e000c6dad0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266530, "uuid": "086b12d0-4673-4ca6-8939-605effbd617d", "comment": "Malware payload (Dridex)", "value": "e809e525c4c9c98c52e7e57b0e1868ff4a80fae1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266530, "uuid": "7cc7cbd4-d56f-4a63-bd28-8d9f3d306fd3", "comment": "Malware payload (Dridex)", "value": "36e9bd831f4489382822b9118fc9194a1ac536d3014f5eaa2707fe1f8ea6c27ffc77a463cffdb455b59fcb63f0cfde95", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266530, "uuid": "658eeab5-b659-4aa7-8e3d-3dc194a4f5d6", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266530, "uuid": "2c16abc1-7695-4125-91e2-8971c58ab960", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266530, "uuid": "5b14c296-7d0b-4244-8f71-7e191ae73b23", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266530, "uuid": "9c48b336-b49b-4b35-90aa-8bf1bb2cc08d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266530, "uuid": "2e1b10d4-3713-457e-83a6-58f96d161682", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266530, "uuid": "2f63314a-a729-4a3b-94c2-72add8387e39", "value": "eb80bc4b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6762dd8-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295261, "uuid": "89b7cd4e-eebf-4a39-bad2-9d241e35a912", "comment": "Malware payload (Dridex)", "value": "64a8219681aca111c76a0e73ea04fb74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295261, "uuid": "13759172-c703-4ea2-a966-6354fae2a909", "comment": "Malware payload (Dridex)", "value": "39be81491adc3b35f7fef49efd4cbe52aedc31c0638deef53b2f155a64767905", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295261, "uuid": "da72bb75-492f-453c-9606-b98dd61cdab8", "comment": "Malware payload (Dridex)", "value": "8b9c6a5c6d97697ce6b3da0374ffdce326c9f8ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295261, "uuid": "2645204a-258b-4578-836d-d4bf18342444", "comment": "Malware payload (Dridex)", "value": "767fd60684d2f79a1837be3b1d47694d3bb0305cf5dbca9073d0bdb34f6fd67906100b03cefd066f85a1f2eefd0de75c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295261, "uuid": "8893d582-4f3d-40fe-9f40-1108fabc54aa", "value": "A0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295261, "uuid": "1855a637-b655-49c0-8873-01e284009e6e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295261, "uuid": "8f698381-87a2-4ca1-81e3-6112d1274511", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295261, "uuid": "087cd388-6815-4bb9-bf59-ae8abd05a81d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295261, "uuid": "a5c71456-c9a9-41d9-83d1-bcd22b9b54ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295261, "uuid": "006ed5c9-51b4-47d2-ba6f-7f35ba6b039b", "value": "64a82196_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20141fa-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331278, "uuid": "f53a71d8-7e98-43b2-86f4-d5e0496d21e7", "comment": "Malware payload (Dridex)", "value": "06d3bf3439eb0d6a34fd7a5c81ff6f16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331278, "uuid": "f573e231-de67-41a5-be0f-490c2d511648", "comment": "Malware payload (Dridex)", "value": "39ed139345642096ea98588580ef1673ba469a5a19d6087c55fc9be6f719bfee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331278, "uuid": "61bb7997-4bf7-4268-b43a-175b6767985b", "comment": "Malware payload (Dridex)", "value": "a1f251cbb724057682b6ff096c342ecbcd229945", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331278, "uuid": "99662d6e-ba05-44fb-8a0e-48ab332fd3b0", "comment": "Malware payload (Dridex)", "value": "306e38f876318907fa63029ebb04d45845412a73585d8cdc8bd137429ac0e979ac2abd97b44ef9b3a92a7bb8a49a0de1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331278, "uuid": "f7988ea1-69ca-4eca-8019-364a97b81412", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331278, "uuid": "dca0203e-59df-428f-abcc-4ec341e2aa4a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331278, "uuid": "f62dbf49-1e9a-4ae7-b251-aa5b6ca70aaa", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331278, "uuid": "f93fcc95-8a37-48c8-a23f-d0fdb6f89945", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331278, "uuid": "f7a677a7-a790-4dec-b669-2b22e0a60e33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331278, "uuid": "5b184777-7409-459b-b39b-23f3579963ec", "value": "06d3bf34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e89295e-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620285665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285665, "uuid": "49adba45-f49a-4cc7-8179-151e5f100058", "comment": "Malware payload (SnakeKeylogger)", "value": "64325f0e08a364425cb97715a58457af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285665, "uuid": "0f56ba54-facc-4606-a416-ff8c2bb2c361", "comment": "Malware payload (SnakeKeylogger)", "value": "3a11e93d6c4a21ff966d34fd500c81e69ecd4b63d6906623d3b37ecf4d60bebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285665, "uuid": "830932c6-45ca-45c0-a844-cd279a1cc6de", "comment": "Malware payload (SnakeKeylogger)", "value": "1f2efb3e59fc7120d00c282629eeda230c415a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285665, "uuid": "207a02c0-ac3c-418f-81d2-39a6171c42b9", "comment": "Malware payload (SnakeKeylogger)", "value": "b1bedd30536ddc34ad68264667458c67c2d1edda47b06a375bd6ef5939dead71b384617f8a21cd2da7b6d355aa29dd08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285665, "uuid": "689a7254-3a6f-47eb-a0a1-43965c32630d", "value": "8E35AC2222989924E17B63348462C13947F67E02E676C71DBEE97CDB3B33681D667313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285665, "uuid": "aad35551-d853-4d6a-869c-c8f9d0623852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285665, "uuid": "54cbd0f8-a532-4d98-9a56-9f44002d323b", "value": "12288:/XYBOcDnocM/fBMJ8n6tfvXe/aFX1CUWimEe02hDL1479eH:/XhS0Bs8nyu/aFX1CUWimDNKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285665, "uuid": "e712befb-e184-4ccb-b3c2-38362d3e6a2d", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285665, "uuid": "2b9a29ff-fe27-4d66-bd52-c91844f25012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285665, "uuid": "9b25df5b-7594-4251-90cb-b21b4f52c82b", "value": "283773883887009pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35290465-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331444, "uuid": "aed0b3ac-b152-4e97-a347-ed98a4f369ed", "comment": "Malware payload (Dridex)", "value": "7054941d653ea0b83dcfc92c7ec2d46b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331444, "uuid": "e3089424-f56c-4887-bf3c-8dbd61940c3b", "comment": "Malware payload (Dridex)", "value": "3a24fe0b0c844dea06117616362cd2ace0050232ad78577feabedb9da9b3f926", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331444, "uuid": "58af2277-5164-41b5-9d0f-6380076a574e", "comment": "Malware payload (Dridex)", "value": "8bb2c43046320e5b0a9b4aca7e77e6c7ff2858e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331444, "uuid": "a50f36f2-bc6c-431a-95bc-432dcf8ee447", "comment": "Malware payload (Dridex)", "value": "90d27c8fa2f08e7b3171c262911e44d5b63edee78c60507b88931ccad2eaf0b10c273ef9519f988bc7696a96b7562bbb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331444, "uuid": "a7d2e437-9922-440b-a2fb-62e13fffdd1b", "value": "25F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331444, "uuid": "fc37f058-8aec-453c-bd02-f284e1ae0469", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331444, "uuid": "91cf063e-b585-481f-acc0-a23e383407f2", "value": "3072:HiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ceAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331444, "uuid": "6f49ee9b-085d-4d77-9782-637482cb3fee", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331444, "uuid": "d6f48968-36d3-4b1c-b869-2240518518ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331444, "uuid": "a01d4d67-d187-4908-818a-d383db727e7e", "value": "7054941d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f75cf3-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339285, "uuid": "5270edd8-1c96-43d5-b721-c5c8671af93c", "comment": "Malware payload", "value": "97bec3f422e10408730e6d43fa016ea2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339285, "uuid": "8a658cfe-ef08-466e-8664-68a14e180ecd", "comment": "Malware payload", "value": "3a45073ebe5f4db2f6e981ab79169a053003a9a972c9171d55ebdf7e034dfd37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339285, "uuid": "1cb7de5c-a077-40cf-b5c6-8b129841d3b2", "comment": "Malware payload", "value": "50afda3154fdf89668018d0ab01b2246adca4e33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339285, "uuid": "8b1a5abb-0d79-4920-9a4a-e0cc0c6f99b0", "comment": "Malware payload", "value": "89f3e9eac497a04b7965d59d273ffa4d31491a73acaf019ed0b6d74578a816ca20ee5b14e29de75a3bb8dda83111bd09", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339285, "uuid": "759cd26d-369d-4afa-99a8-c797ad4fbba2", "value": "AAF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339285, "uuid": "5c8e54a0-ed76-4c32-852e-5a485e01659c", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339285, "uuid": "1e8e2c3a-546c-4d3c-afdd-161a3706477a", "value": "3072:4hG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idKI:hERMVPG6+Y63HoG1QawL40Prx6KoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339285, "uuid": "9878b17f-9662-44fa-834c-9fc92a25f8dc", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339285, "uuid": "f0a3be1e-bb51-414c-9036-7cb40dc09064", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339285, "uuid": "23ff0bfd-97df-49bd-8cb0-c7e3a77ce744", "value": "97bec3f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18577ad6-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339127, "uuid": "cd087b12-1c67-4b2d-ae89-38205830fd7a", "comment": "Malware payload", "value": "a37a96d340d6dacfae7542f4fa536b87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339127, "uuid": "7ee161ed-27c7-4de1-89d2-044b3c852bd8", "comment": "Malware payload", "value": "3a95e3871c9ba84c6adb3ee89db72c09772f644512dcbccb9baa00ac54c5f49c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339127, "uuid": "483e8130-6211-4262-b89a-f20ff6bfa24a", "comment": "Malware payload", "value": "5647134f55f0aabe17a2bc5da88a8cade139be98", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339127, "uuid": "0756ce57-ded1-4d58-8768-deec5e635bcb", "comment": "Malware payload", "value": "7e3890c9665a11062182c763a360324aacc37cb06ec5f417b1b52ee2b78fbef6dda2ea6424f9fc4900194afe6b410b00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339127, "uuid": "50ef5878-5684-40fe-9c8b-84a9778d196f", "value": "B2F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339127, "uuid": "e0044854-a867-406f-a746-859a137ef86a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339127, "uuid": "16ebf528-3e52-4372-acab-513e3857b73d", "value": "3072:TC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:e4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339127, "uuid": "df808e91-e276-4f84-aaf2-f946e0a50115", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339127, "uuid": "8e619762-fde9-4a4a-bfd7-8d2997cf2c4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339127, "uuid": "5a6e7a42-7ca0-4eae-9a89-54ed474d7e95", "value": "a37a96d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fd5cc3-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338960, "uuid": "58841696-38cd-47a9-ad1f-dc8fd811da7a", "comment": "Malware payload", "value": "c0ea746dcf17bfd2afcdd1d19c071316", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338960, "uuid": "d4eed83d-56f1-48ba-9bbb-4ba6859ede07", "comment": "Malware payload", "value": "3acc8077db080f08e67a462d073b72e57f82de500a26964c18f6ca394f5bd128", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338960, "uuid": "53993794-0a2f-4b06-88b8-4f5b4e456dcf", "comment": "Malware payload", "value": "650f15a4e2180f9934b31628e961ff165264b434", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338960, "uuid": "9be710b6-07d3-4050-9f4f-62f873051c59", "comment": "Malware payload", "value": "d170c4954ab3bb80fe2583ea07697b83e95bc7c778dcd6ff40a7bfe9f3d85d5fe20f37e70ab55cad6ea24e0c292334d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338960, "uuid": "b4206152-17ad-4752-820a-6f97506cd815", "value": "45F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338960, "uuid": "227bb28c-b7f6-496b-a19e-db195ba4d069", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338960, "uuid": "a0b29128-dec0-4fec-8ff7-e4af8990d96f", "value": "3072:7C45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:W4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338960, "uuid": "17c2c334-0d06-45ee-a184-05bf3744bce7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338960, "uuid": "d03521d3-0cde-41d1-8bab-d4a9610d6a23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338960, "uuid": "924ffbde-8dad-4a7d-b4c0-b07d3e5809c1", "value": "c0ea746d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb269f7-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620285047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285047, "uuid": "26ff4cb9-6192-41b1-b23a-add47d596799", "comment": "Malware payload (Formbook)", "value": "51e414df61a38f968f3469b87b55a007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285047, "uuid": "63b7e71d-613a-4ed3-82d9-3395c986c570", "comment": "Malware payload (Formbook)", "value": "3acd86ada75ac819a4374720b7e4dfbf270974237f9e7794c7cc51d510a9bff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285047, "uuid": "a1f8f858-ec52-4a65-860e-f09271927155", "comment": "Malware payload (Formbook)", "value": "81e101222f03e27d1e627b36daf2bcf5cfd478ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285047, "uuid": "82f80c3f-b0d6-4f7d-877f-3eef2d2931ec", "comment": "Malware payload (Formbook)", "value": "74837c0a3c4549136e7f8ac2f3a4e9ffef483d6eda322f8d4206314038877b8d18258357480a50595efd6bef65d6d542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285047, "uuid": "421d5212-b2dd-4b4b-835f-1cfac017c406", "value": "FC2412BB67C0CCFBC86626709A351A685BF3D2D0511A07175F056EC5B8239D3A92E2F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285047, "uuid": "add0b183-a834-41dc-85bd-ad28d48ed9aa", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285047, "uuid": "26465f8e-53d6-4a44-bb22-5709d1652b88", "value": "6144:L9X0GgSJwl/XSrXbd2t2DM4g3cpTk4omhcWk:l0VSuGMIQ4lpTemhcWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285047, "uuid": "bdd6e7fc-05a8-4f29-9100-6320e02b95cc", "value": 210542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285047, "uuid": "68844787-2dd7-4cdc-b22c-7e42590f5366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285047, "uuid": "b4ee6dfb-048c-4faf-a7af-7982c4a0df23", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd81cfc-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331432, "uuid": "5d8ee0a8-d77d-44fd-a349-5aa685645efd", "comment": "Malware payload", "value": "8b5ce08dcf9c214cc4a885873da180fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331432, "uuid": "e6c6df3e-a4f1-40b9-a517-4a46b6bb343a", "comment": "Malware payload", "value": "3b14ded6da10148413dbfc12000cd9e43082841c2718e5b88d3e1e734ca8b7b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331432, "uuid": "2470f52e-d8c3-450f-b16c-b7ea66a46620", "comment": "Malware payload", "value": "64667a84fa3d3bf95b11ad08dc01383785d77011", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331432, "uuid": "3a448947-7539-413c-9905-73a9782aedb2", "comment": "Malware payload", "value": "9b1be34373f5898708132add93a38348d3551001df42fc107ccdc186b2e4ff477de1e7b5672711225d0be39a96aa5f25", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331432, "uuid": "c4dad188-58c2-4412-ba62-0480ea055bb0", "value": "F3F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331432, "uuid": "0c610128-579e-428e-bd21-66d2f2272996", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331432, "uuid": "3fcdc58d-ade7-45f4-abc1-d545e82f68ae", "value": "3072:1lG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idEl:OERMVPG6+Y63HoG1QawL40Prx6Kql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331432, "uuid": "43fd810b-3ecf-4d42-8317-e60231d41513", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331432, "uuid": "cd3a9c09-d32d-48b3-93ec-80ec295a9857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331432, "uuid": "3d989cba-13b7-4719-b366-b78d4a621ac9", "value": "8b5ce08d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267a4472-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334855, "uuid": "b86b6fb8-3fd6-4a7f-873c-10ff55124482", "comment": "Malware payload", "value": "f079f914de43c8c89208805d614d657f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334855, "uuid": "30de95cb-50ae-4689-80d5-717ef3d38ea4", "comment": "Malware payload", "value": "3b52981254c799fffb9e0e95f0677043a10612f6e4d8b61719e9e5849300789f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334855, "uuid": "4e029184-c023-4e35-9e4e-a586aa51f694", "comment": "Malware payload", "value": "f5054f8e565d2672be2a5cfb8f7d1f3c8cf8c280", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334855, "uuid": "994d2fa2-e515-42e9-ae32-17552d0ef723", "comment": "Malware payload", "value": "04fb415c0fae8146724ac68c22b772e6c7d7c78482e9cf8c41bc0ba10778bc1604b0469610ff8f919bfed99c6e4c3dbb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334855, "uuid": "243fd699-4ad1-47a0-9d07-b74655d9a897", "value": "C3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334855, "uuid": "bf77a140-4805-4a9e-8e5e-85f46c18a106", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334855, "uuid": "e3cb02a5-165a-4fc3-b568-212a63049699", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334855, "uuid": "4a16ea8c-c95f-46e0-85f5-70d7ea0df8de", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334855, "uuid": "c131c817-a791-44ef-a958-92e63eb8cc3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334855, "uuid": "0ea47a76-8e31-45e5-ae3a-4e1b5141fd1c", "value": "f079f914_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4705e745-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270056, "uuid": "63aedec1-7b1a-42c2-bf8c-528009ecd4ac", "comment": "Malware payload (Dridex)", "value": "69f4275a458b878577c39f161553892c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270056, "uuid": "742a732f-5f06-4ea2-b91f-d34e2a7a8853", "comment": "Malware payload (Dridex)", "value": "3b62ff472f2f27d0f6d54225b8b081635b3b03ecf5cb9bbfeb140fef67938cbb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270056, "uuid": "d34e12b2-22f2-4d90-ac79-065821a9d08b", "comment": "Malware payload (Dridex)", "value": "ae346e72ddbb76f46689285616837a88b3ec9425", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270056, "uuid": "671f7ba8-cb30-4b23-b8ed-28f2c86bfd50", "comment": "Malware payload (Dridex)", "value": "843c30698eca488761a043a2754108ab252c1dae0dffb392d237dba53c6f708489d8e282e7d03cac62a66e94cb8da683", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270056, "uuid": "65ec5be0-bf29-4b9d-a5bf-77076b1601c1", "value": "0EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270056, "uuid": "bb3cd2fb-d436-4ab6-b6dd-5c78cc89c523", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270056, "uuid": "f8b098f4-dcdc-48ff-9c14-f54b2bd2f0ec", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270056, "uuid": "a6ca783c-2561-4cb1-928a-5727431ffbb7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270056, "uuid": "f77c1cee-f98c-4e8f-af7d-eea29c5a87de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270056, "uuid": "70bbae3c-aecb-4dab-80b6-a80a08933ecb", "value": "69f4275a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceb236d-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295245, "uuid": "6ca63a62-c018-4505-8b20-dac6365eccb4", "comment": "Malware payload (Dridex)", "value": "266c8c1b709639a2c1ec9f79d5497490", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295245, "uuid": "728205f1-6c00-4725-ae2d-4940b8b7c4b8", "comment": "Malware payload (Dridex)", "value": "3c2f118dcf729eeeca5c00246cf2fa484f433d84704e5eec648bca476bf797b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295245, "uuid": "eca0ecb0-858e-4a2a-a1c9-aa07ff88bc55", "comment": "Malware payload (Dridex)", "value": "292dfada06040305adafd258d5a55a11cedd2947", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295245, "uuid": "f3515c58-59f1-4539-af2e-90f224018074", "comment": "Malware payload (Dridex)", "value": "d351f8b232ef029b7494587efe68dff5c3421275a179880653c493a9ef511f319a4c054bf2b9113fe10575aadfa7c54f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295245, "uuid": "844788ff-b059-40ea-9884-07a52d5fb723", "value": "24F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295245, "uuid": "af866f9c-16f4-4900-8813-da9ff5cd1d94", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295245, "uuid": "d1e6bdbd-1b43-4486-9a6c-a689ac45e714", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295245, "uuid": "e44d19eb-21ca-47ba-966f-83aeca52ed5d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295245, "uuid": "4deed9cf-c8e6-409e-a9d5-877594d73d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295245, "uuid": "5771175a-b3f4-4abb-87cc-04ecfee01820", "value": "266c8c1b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6d53b1-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295295, "uuid": "5e2a3a9f-132d-48bc-98e8-c4fb64a44d06", "comment": "Malware payload (Dridex)", "value": "c10f8eaa1846055e110540355f5d4f41", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295295, "uuid": "dc211926-f0ac-4f1d-933e-508ff46b03d4", "comment": "Malware payload (Dridex)", "value": "3c3809617c1dd64d04c3799d1c094537035481b562d4b7844f69ef8c8aab5197", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295295, "uuid": "2a1b5035-b570-4164-9fd8-7331d828173e", "comment": "Malware payload (Dridex)", "value": "a529d6c453255e3bb7051d208be4cc56a281c617", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295295, "uuid": "8ac1480d-3b2a-4bf9-a695-5a21ee460c3e", "comment": "Malware payload (Dridex)", "value": "6c0b913b99bc275b5dcaec007257266dc225c0a5feaf72c67ffff42953729dab997c917f9632277eb60333f3e009b6f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295295, "uuid": "6dd97822-07ea-4fdd-bdb3-36b585d29f7f", "value": "B2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295295, "uuid": "a464cb75-3c43-47d9-8b59-e4092acea612", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295295, "uuid": "59e4c08b-89e4-44e4-b60e-5c83080f276f", "value": "3072:Flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295295, "uuid": "8724175d-6aa8-4376-8b8d-ef5b47f17654", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295295, "uuid": "a93ac127-cef8-4b34-ad8b-cffed50ff601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295295, "uuid": "24718d0f-e30f-4008-ba9f-2e6d38433ca3", "value": "c10f8eaa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947d20fd-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620298962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298962, "uuid": "a893e226-c7ef-4205-90be-d4d4f6051083", "comment": "Malware payload", "value": "98d381996975a0cc403830d4e2fa54f2", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298962, "uuid": "46a37fcd-d543-4f06-9484-8e7dfbfa2cca", "comment": "Malware payload", "value": "3c392225a76bfde1e5939a05258758d3e93948a961076b977b888921ff19ac15", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298962, "uuid": "a1270d02-769e-421a-96cb-57d02bcdffa6", "comment": "Malware payload", "value": "06a16f1d83d9671185db332aab1a9df9177a0b51", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298962, "uuid": "19407d08-ba58-40ac-b763-33562365147d", "comment": "Malware payload", "value": "6bd208d5a4ede8f0cbf185a66651bf15e02b0d3e686a6d98aead6aafdb7a420b5afbd4c457bb22d42ec7eeffe65b5dea", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298962, "uuid": "d6fc3811-df2a-4cfb-8be4-df9a351f9c5d", "value": "DF7423B06D1407FE8EF01047B32F912A26B1564B6C5094963E2BB096A1B4FEBEF7F415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298962, "uuid": "d04d9159-6097-4cfa-aa85-5e92bd47489d", "value": "6144:S0Yhl8mcQuKNAdBQAFWu6w8HMdTAqo9vg27Ux7yrBEiEc+nYy8Zigrk:SDlm1KNABQAFWePAb1Qx7yrBEiAnGZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298962, "uuid": "34a5864d-9937-48ab-a1a6-467db81924f9", "value": 344344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298962, "uuid": "ac1adc91-9930-4e67-86e9-9f31d61269a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298962, "uuid": "424ff54c-0dea-4351-948d-f5dd7074b4d0", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9734d218-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339339, "uuid": "45ff6192-4cd4-46d1-b8ed-9d41f703002d", "comment": "Malware payload", "value": "2f06f24d7e791d04149c24ebd8d0f09d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339339, "uuid": "bc0ab8d1-1574-460d-b049-a7097805650c", "comment": "Malware payload", "value": "3c43900b91fc4db532c7b66871f1b66c3c06ea3c1aea0447ba8ee4a97aa4fdbd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339339, "uuid": "f236fc47-1675-4e26-af6b-9d36a28653c5", "comment": "Malware payload", "value": "80d9d4f39277a666abddf033e1c3cbfbcb5797c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339339, "uuid": "f36a7b24-9f0b-4338-930d-8b2d12c88c5b", "comment": "Malware payload", "value": "f36fbc97b4db4038056681fb30641bc6f68be799d4c293242fbd38bbeefbe7466e95f454e874d3e64813bd80633ad0b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339339, "uuid": "8f6beeb2-46c4-421f-aad9-de2d918314fd", "value": "16F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339339, "uuid": "fa534dfe-862a-4d22-bb6d-35f6425362f4", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339339, "uuid": "1641285f-ed41-4c42-b0a9-e1e3f8ed2bd7", "value": "3072:DiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:NERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339339, "uuid": "4bb4a890-e91f-4415-b8f1-136931eb5eef", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339339, "uuid": "3c114da9-ec05-4454-85ad-e5d05a25552b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339339, "uuid": "880d1503-a1e5-426d-876b-febd30edd62e", "value": "2f06f24d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1eaba45-ae2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278503, "uuid": "0606c34a-fa6e-414a-8c64-e35abdd02eb8", "comment": "Malware payload (AgentTesla)", "value": "09d54756c5654318ef0a1f5d526a1fb3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278503, "uuid": "4abf35a2-51c7-407d-81da-2e37c5d5d7e9", "comment": "Malware payload (AgentTesla)", "value": "3c6d138f6873dc416fb3ef2b3a57ed0afa41022c37fdd98a609d730bd0c684e7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278503, "uuid": "bc720844-4115-4d67-b7f0-474584189a62", "comment": "Malware payload (AgentTesla)", "value": "2b09bf86d649e36a4c2355cc985d5e2fe42f0bc1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278503, "uuid": "7e4513e0-e2f5-4942-82d7-4018dde0736d", "comment": "Malware payload (AgentTesla)", "value": "f9a44f2201dbffb2d8ac3074468cef48da845e7505c64da72e35cc89da4ff756ae90d55c635ea4546be7d74e4370118b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278503, "uuid": "649f49c4-a4db-4956-99e3-ba5d7c3f4664", "value": "2EE423C0D0580AC3A701B7FB7470FD8B9BC0739E79A46B376623A1F5027AD6595827A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278503, "uuid": "5464bdf8-c4b6-48cd-a42f-93079d6844cf", "value": "12288:U1Tm4wKGk1yqcKVnKlWaXHPaVzDDfI9g2DegLZUtxO1/95lbO0xBeUmfzsn3:UcfKx1yqPiFXHPaF49CsUtxElbOweUmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278503, "uuid": "ccc5adbe-4838-484f-aff0-7c325edd31d8", "value": 684720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278503, "uuid": "ffe71227-7709-4643-9390-17c6e6f38e93", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278503, "uuid": "66f7e56c-a3cc-4334-8213-4ed43910d6f3", "value": "Payment Advise.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b04a456-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291672, "uuid": "c662aa6b-1ac0-43f3-b088-5e6f29e570a3", "comment": "Malware payload (Dridex)", "value": "e75a0c7889ffa66af6c7f09a4854b395", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291672, "uuid": "4504a3ab-1de9-4dfd-80a3-b926a9a002a1", "comment": "Malware payload (Dridex)", "value": "3c76e2dfda951e10b55aaee9a6671495751b46dc7750e84ad85e5f61f039a6dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291672, "uuid": "96b3d0e7-b650-48be-a036-60365c9e7dfd", "comment": "Malware payload (Dridex)", "value": "e6389e5186b9ee997d4d9f72b052f73d1679a210", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291672, "uuid": "2c59f42e-afcf-4e92-af36-32c4e9d12920", "comment": "Malware payload (Dridex)", "value": "fca84057df0645ed7faac17cf9625008c494f2d47e964fd0e4cbd0e4b485136575d4c7c7344329a8646c1be5b3fb44c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291672, "uuid": "ef440c1e-a068-4602-9023-654fd1ead57a", "value": "ACF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291672, "uuid": "52fe637e-6468-4668-a8ef-b86a1e235bf3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291672, "uuid": "6c74ca14-9663-4afa-9d05-e49431945ca4", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291672, "uuid": "ea79e8ac-a451-4a63-95eb-bf8ee5ea9782", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291672, "uuid": "3d384019-8275-423a-9423-80674d45900a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291672, "uuid": "b477f955-91bb-47a3-b971-4ca3c37518a2", "value": "e75a0c78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0c730e-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262894, "uuid": "66eecd70-2261-4379-a73f-3c332aac6600", "comment": "Malware payload (Dridex)", "value": "42ab9c4f8437d41d4fca65181b2a6d77", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262894, "uuid": "235d32f4-f5b2-4be6-ae24-414ab48bb294", "comment": "Malware payload (Dridex)", "value": "3cb4d6f5cdfa912b9bd32966a0f233a41ce41bb17502c032204b5b89431ae4af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262894, "uuid": "c32d3cbb-6e3e-454d-a477-aba8f847ca14", "comment": "Malware payload (Dridex)", "value": "d08123ae4594f8de125f437c2f5d37f171c1a5b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262894, "uuid": "1f482bb2-5ab1-40ce-9b2a-c219e1aa631c", "comment": "Malware payload (Dridex)", "value": "7034a439448d64d5a741b62d36e1f06970bcb89acfb42dd8ec1082b877dcc12cb00b84d18162158865166cdebf7076dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262894, "uuid": "f8121950-1f68-4aa7-88c5-17356d057cbe", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262894, "uuid": "8c7e56a7-e934-4543-9e58-cf8f4dde9282", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262894, "uuid": "5c3cb911-e58e-4e99-90b9-307e4b3c7ad9", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262894, "uuid": "f372492e-9824-43b4-a167-204b743eb104", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262894, "uuid": "43870743-4ef4-4e31-acf6-70033584d3d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262894, "uuid": "06b7646e-a2ed-4102-b3de-705dc2409618", "value": "42ab9c4f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe2665b-ae86-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620317926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317926, "uuid": "67b877c5-06af-480f-9a35-b5d1e7220d0e", "comment": "Malware payload", "value": "8b51a1e424e33f99c89e14538ab79ad3", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317926, "uuid": "cfba4295-4a67-4182-b33a-2500a9e7b3b6", "comment": "Malware payload", "value": "3ce7a091f24c19dd1a0875c60f9e97ee017435614198c62ca97220658723b785", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317926, "uuid": "da3b21fb-54e0-42cd-8757-c1164a1eee9c", "comment": "Malware payload", "value": "5d80a3734f62abe6e248b2baad1a24eea19492a8", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620317926, "uuid": "ab5c6f6e-8c64-4f8b-afed-aa668b1171fd", "comment": "Malware payload", "value": "d68a2630922599bd3b459eb5e0c382772de6be69c03eff08da139fa143badd201f0a3a26ea77af975953848c92108cef", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317926, "uuid": "b6625d87-149d-42f4-9de6-d94b16b51a02", "value": "CC25BF72BC41C0B3D5F210B689B9DDB12DBC5D314B1A82C742D03BB9AC364D27A7D99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317926, "uuid": "0b8fbdc6-5efd-4be6-8db7-5669624e3929", "value": "dac67ad15d498d52b875fafdd7113e11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317926, "uuid": "a4075f79-b142-4aa7-8031-f2593fe46ef3", "value": "12288:mULKPViLB87+nDS1hS0/ZxcJZYNyfI9vN+Q001i4zSqCUlRlhpNjRNFxKBz:mULKPDVNf9vN+Q001i4fpNjRPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620317926, "uuid": "b36c3cef-5463-4196-ad4d-a3c7682b0725", "value": 985168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620317926, "uuid": "9697c226-68f0-403a-9107-dcdb2a41bd89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620317926, "uuid": "c22115bb-7e69-4d8f-89b6-1532ddd117df", "value": "\u51fa\u6d3b\u8dc3\u6237\u8d44\u6599\u53ca\u804a\u5929\u8bb0\u5f55.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9dfca9-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288082, "uuid": "008f3564-272b-4603-91c0-11bec6d37cc8", "comment": "Malware payload (Dridex)", "value": "bb9e839e45789132413a6ae5f1c2145c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288082, "uuid": "4b97e065-102c-4cfb-a459-38a0eaf391f1", "comment": "Malware payload (Dridex)", "value": "3cf7c1a9abfdb4a7e3e5b0f1cb6f79d9d6041cb6c98f868e03590415fd75b0f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288082, "uuid": "43258da0-3737-4a5c-92d1-ba69895c8b22", "comment": "Malware payload (Dridex)", "value": "3368d6269a8db5aad515abb5b132bbf02b456f99", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288082, "uuid": "cc271202-2a38-498c-ad7d-3f687f534d94", "comment": "Malware payload (Dridex)", "value": "5f1ca66bd63e9f02c508b77b41e1534537b861a5abe3b96978012f0446bbc17aa9746a857cf197cfa7b87fde567cead9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288082, "uuid": "b0cd2617-f13d-4329-b2b0-d2739feb6736", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288082, "uuid": "49ea3508-de1f-434e-ac4f-28428ca1f56f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288082, "uuid": "cf63ce44-23e0-4242-9566-816e3e4b64d6", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288082, "uuid": "d885563c-5cfb-43eb-914b-cc3a3ffb7dd7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288082, "uuid": "ed6f52f7-6dee-4a7c-a843-cdc46e677be0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288082, "uuid": "88774b42-8e9e-44d4-bd56-b95193b814ef", "value": "bb9e839e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32be2e9a-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313401, "uuid": "a8ef2266-5ca6-4ad7-aa1f-2fb85b71e069", "comment": "Malware payload (Dridex)", "value": "008bfc874c8537fe6f3fd4ee3fbac355", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313401, "uuid": "ac74ba35-0b4d-4788-8ffc-3db28816817a", "comment": "Malware payload (Dridex)", "value": "3d11495fa0d13472b04a4fcc2db59e2686fe0b02c060f44c75b5bf415ebe4bb3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313401, "uuid": "ccad1db0-36cb-4e1c-a7e4-699c2978e4bc", "comment": "Malware payload (Dridex)", "value": "8867a10f8686da706861dfb8dad2df724090d36c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313401, "uuid": "fdbb19ea-9dab-42cb-8022-bc0a24b8545b", "comment": "Malware payload (Dridex)", "value": "ade325e0eb287eca406d11e2eb4dd3e00d8a9b52903c655187fd15c3d941cd9d435ff2cc4457b5c8f743769529d517e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313401, "uuid": "a1fa2664-98df-487a-826b-4e70f8fbc48a", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313401, "uuid": "d7fc2501-8db7-4173-a412-0e7779d80992", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313401, "uuid": "7f559c12-f486-4983-b73d-d438e711251e", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313401, "uuid": "d533cc27-7b65-40c4-b027-cdc2c38f6f17", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313401, "uuid": "583066e2-edac-4483-8fd8-d7c27bfa0d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313401, "uuid": "928dc176-1186-43b2-aa69-fc94b6886cce", "value": "008bfc87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d3090d-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338713, "uuid": "7ffa0e70-f8a7-4ec3-a6bd-b27c051c0b59", "comment": "Malware payload", "value": "ef05e3e18e8b7aa1e105b4031015ca36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338713, "uuid": "59728ab7-803a-4dc9-ab66-f89fd5efe213", "comment": "Malware payload", "value": "3d5e66fa234684d5ed4deb54c6d359641a64436aae6c1aae2431143b9f24b583", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338713, "uuid": "f545ae00-a25a-4a19-bdfa-2c89e5a1b22c", "comment": "Malware payload", "value": "dcd1ad0559d9bfd87fa7444f006b7351effe6986", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338713, "uuid": "f7bd4069-a258-451d-be2f-a35dcb69fa23", "comment": "Malware payload", "value": "3ab96be60e9ba7ed36ad62f0544a6bdc59f0e202783320f74bb49c51d03e3cfba002b83af83f40fce3360fd99dd86510", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338713, "uuid": "6296405d-5bbb-4865-aa29-18a33baba7ed", "value": "C9F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338713, "uuid": "593eb8eb-38e0-4862-825d-539264782405", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338713, "uuid": "ad1956cc-77ba-45da-9d91-94e34a437aca", "value": "3072:mOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:2ERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338713, "uuid": "662cba78-238c-4412-a29a-e869469434e2", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338713, "uuid": "09d7b80c-8431-4cc7-a385-d36ee86c1712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338713, "uuid": "85480af1-4bef-4930-9874-60883e2c408c", "value": "ef05e3e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba96b0b-ae8a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620319697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319697, "uuid": "02309407-d93b-4e58-b99d-d2c4c7f0b2dd", "comment": "Malware payload (AgentTesla)", "value": "2f3b713208e4529613738cb2a4aee54f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319697, "uuid": "b8e74e7f-7d5e-4cef-96bc-00601c729f76", "comment": "Malware payload (AgentTesla)", "value": "3d623f12fae326524e0e1c798644d024e90e62622c0ea9479d43003662add5f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319697, "uuid": "63f7ef55-0915-4dd8-9c00-f04731f98e69", "comment": "Malware payload (AgentTesla)", "value": "a8b73e2ba6e2b6a31338fe3fd44f4dc55398a1cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319697, "uuid": "45721b97-04a7-4a03-99fb-20a36aa92dee", "comment": "Malware payload (AgentTesla)", "value": "d5bb0eb97ece0a5d1b4c65cb4fafd4e995d14dc05df708c739d6a5e656caf63cd8c8f842e766a8cb73be7027e5bba3c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319697, "uuid": "142dda92-f3b1-4867-a730-a363a2fc5104", "value": "28359C2212989924E07B23748062C13947F67E03E676C71DBEE97C9B3B776C19B67213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319697, "uuid": "d537af12-6116-4210-9e80-75e47b88ec53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319697, "uuid": "631fc914-2d19-4a49-b02d-b549636da5bc", "value": "12288:Yw09DtmPnoVa3TWw83IjaruBOuZ+MlSwi+zLM:Yjtxa3V4saruBUASwZzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620319697, "uuid": "6494ed95-db13-414a-af64-5389b0ade0c7", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620319697, "uuid": "872f7354-5faa-45f1-986b-1ce548123689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319697, "uuid": "bf7903f5-b8c1-4d25-9659-9c0cd7f154cf", "value": "2f3b713208e4529613738cb2a4aee54f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7170f570-ae6c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620306634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306634, "uuid": "aba4ed7b-b6e4-47f2-9d3b-a55af17f3008", "comment": "Malware payload", "value": "3a5ea4602985f1db670f166e111aefd2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306634, "uuid": "71bff8e6-92e0-4030-ab8d-949e2908f26c", "comment": "Malware payload", "value": "3d63156060c7568b2c3065820f698fdadb6e48910ec82593a61c306c13f5692c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306634, "uuid": "a6dbb902-1d2a-4f0f-a81c-8893fbc6a6cf", "comment": "Malware payload", "value": "165975dd8d3965068f3dc0a2c5b512e5e6a9de1f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306634, "uuid": "34c95ff0-0a05-4e35-8389-8eaf180c7f82", "comment": "Malware payload", "value": "2c8c20054dd9f92515f4591dcf42d1eb89ced8e185efc6b5ad3ca1c40d8cc9a3c163ddcc3cedd6656608b9cfd1e28ca1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306634, "uuid": "aff3cc05-dfe7-469a-b178-e678d9cb862f", "value": "F4060253DC088B43E52547F8BE474EAC6F1A2B4CD9827AFF10225DC73E656264C9E12E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306634, "uuid": "3d6e09a4-bc7f-4641-9519-b7c66bea83fd", "value": "98304:JoycO1vLPTvgX9l3N6+lsNy93RcY0W7/iJg8:Joqvz8XL3N6gsU9aY0Wcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306634, "uuid": "9eb4419e-0ebc-44a0-8af4-ca2b18718d37", "value": 3831871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306634, "uuid": "f15b1d47-0758-4f01-bc50-cd14ebd4d863", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306634, "uuid": "fd8e455b-4e05-45f4-ad11-8419376f334c", "value": "Giam Gia Dien dich Covid-19.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3f0972-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342116, "uuid": "f9c7cf7c-b93e-426b-856c-bac985494966", "comment": "Malware payload", "value": "4d0588915041f4155095c5f250f675f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342116, "uuid": "b585b2c2-209a-4896-999b-1790beb80acd", "comment": "Malware payload", "value": "3d807aba40a26f359b4f090468d754d6159bcfcbb8daeb1d1967c753a8e524ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342116, "uuid": "6f020408-1075-4c86-80ef-37bd27795fab", "comment": "Malware payload", "value": "f3265be9b63959d32c8262431598803cac6e2d1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342116, "uuid": "e246a65c-20df-4daf-9070-035457a2399e", "comment": "Malware payload", "value": "6aa3e721721f11a1fcf9075656b1a4422a791a7a0ff2d208f9419d1b67b5b778ab3e13fcef943f209a12d1d9e4e9ac27", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342116, "uuid": "39184077-600a-436f-9fd0-66ac88653684", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342116, "uuid": "0baf0e81-b521-4108-bd84-1b35ea45b327", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342116, "uuid": "09b47d9b-d9df-4e18-9cfc-8b7c600da134", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342116, "uuid": "2ef5d6a7-a35e-4507-bef2-7487b7add26a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342116, "uuid": "5970334b-cd87-46e8-9b60-2fb85a870b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342116, "uuid": "1e117713-e4e0-4a14-8599-925a22b8b235", "value": "4d058891_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1865ea09-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324094, "uuid": "4024b87a-7326-45a9-805c-f5cde34c60ca", "comment": "Malware payload (Dridex)", "value": "65bdd4d500de5535311a33f64c4a349f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324094, "uuid": "504daba3-6195-405e-ba5a-5dffe5c31664", "comment": "Malware payload (Dridex)", "value": "3d9db20d461df637190743f6624c1f63ab18ae36e0b880f6986e071977946fce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324094, "uuid": "c72e3bf8-5223-44fc-99a1-d32000ea0d16", "comment": "Malware payload (Dridex)", "value": "42a1aa663e9dd7b22c1db71019cb85c85ded3420", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324094, "uuid": "1accacc9-8e0b-41b9-9522-0f96fcd90697", "comment": "Malware payload (Dridex)", "value": "14985af78e2ee4c6d14292e4a200c44b74ac78acc5b1b05e8354144721bd7b3f3f8f6372628c8cbb33c8f30db4a47bf9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324094, "uuid": "65bb2417-93ba-40ba-a954-ab612fcde2d4", "value": "9CF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324094, "uuid": "0cae62cf-2e82-4a40-aa6f-9a92e05057e1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324094, "uuid": "1e22af26-3446-4572-aba4-f360d382a743", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324094, "uuid": "c01f51c9-07b5-44af-96cc-5b26f6eecf56", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324094, "uuid": "1283b0c4-769c-496d-a2ff-597b999802ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324094, "uuid": "46fae902-e7c4-4e47-bd65-11caeecd2522", "value": "65bdd4d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969bff92-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291664, "uuid": "c1a9dee6-3755-4178-9350-15a2408fc353", "comment": "Malware payload (Dridex)", "value": "e1802c7415b22b9a1a104bf4e1025a5f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291664, "uuid": "eb86a4ce-6f32-4a71-aa54-bd72dc03ae3d", "comment": "Malware payload (Dridex)", "value": "3dbb66c4a53daefa58069812bc2de153718e2b5826b9d9567745dceecd745b69", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291664, "uuid": "1c759ba1-26bc-4d20-932d-0dd7d93d64f7", "comment": "Malware payload (Dridex)", "value": "6a0a7751ada1de43b9001fa0f209983376594b83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291664, "uuid": "a2b25c94-e81e-4627-b912-c881897a6894", "comment": "Malware payload (Dridex)", "value": "91c13feedea03f87b05cdf4a3b66f2456acd2b6c0f9135f07c9cca6cb2047b00a09bb5538d03630890097d35c79a1f5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291664, "uuid": "f3fb02ba-652b-4d90-a89e-1b5e74f52526", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291664, "uuid": "52d874bb-5845-4c66-985a-66258ffa7fb0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291664, "uuid": "b20d7385-e889-4431-bad1-97014c279ba4", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291664, "uuid": "25f540ca-37d7-4762-bd5c-23ad17cbcc0e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291664, "uuid": "fc544ed9-d768-473d-a3b5-a444b85fe25c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291664, "uuid": "aa666b1d-26ee-467b-96f0-f583ce06e495", "value": "e1802c74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09eab8e2-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266517, "uuid": "60e2cd20-ced2-4dd0-8fde-7863a308e582", "comment": "Malware payload (Dridex)", "value": "5ac3c9f3269f229f580c9afcfe889080", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266517, "uuid": "a8a12479-6b2f-4983-b194-3972b13ed4f2", "comment": "Malware payload (Dridex)", "value": "3dcad8fd63778dde95201901a96926be9da662f6d5e0dc5d4796f3b818b707d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266517, "uuid": "5b7c115b-02c4-44a3-919e-8636ebdaed34", "comment": "Malware payload (Dridex)", "value": "f2836d840eb06ea4506b9807160baa08ab824c9a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266517, "uuid": "5dd59c9a-e972-4872-9400-bd01463a2948", "comment": "Malware payload (Dridex)", "value": "0146b6fc51aac850c16cb1f4fe1f8a4ede106904c296f161526d37beba530fe07653d4e7c5c796b14e81abb114220284", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266517, "uuid": "dc42551d-899d-465d-a0b7-c329365acf60", "value": "14F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266517, "uuid": "59c968c9-9cce-467b-b9b0-0095f8a86b86", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266517, "uuid": "e72dbbcb-ce63-453d-8acb-c702541366b2", "value": "3072:pe45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Y4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266517, "uuid": "9e99993b-2abb-4a2c-9f87-dbaf1c7ec3b5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266517, "uuid": "40d5a419-3db6-42ab-bd27-a989eae562a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266517, "uuid": "b828583f-b50d-4b84-9e1b-e05d138f6344", "value": "5ac3c9f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43343b3-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309780, "uuid": "f7a244f4-2205-4871-9bf8-598a25840b16", "comment": "Malware payload (Dridex)", "value": "db796403ba53929ddb68dfea6d333a45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309780, "uuid": "0ad13edd-5e68-4da6-bfda-29810814355d", "comment": "Malware payload (Dridex)", "value": "3dd2d7649e907f19dcba61283915257c047806898749005492314c5fe771fc44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309780, "uuid": "f22dc397-ab60-406f-91b7-8173dff0d0d8", "comment": "Malware payload (Dridex)", "value": "48c443072df779e94036410493afd72981c4cd5c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309780, "uuid": "2cc18d99-ba1a-48e5-bbed-ad28e70a8c6d", "comment": "Malware payload (Dridex)", "value": "1c316422385a263b0a697f9dcf2d3c8a9735397e509d3bb821aa1eda056a1b5f905da9f428693f391e0382fc9411a0a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309780, "uuid": "6d359cd0-a376-4a9c-962f-93f150de5835", "value": "86F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309780, "uuid": "33033ca8-49cb-4694-88e3-7636e4ce6f20", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309780, "uuid": "8947d60a-d050-4f26-93ef-b00293af58df", "value": "3072:HWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:H42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309780, "uuid": "03c0fe5a-cff2-471b-b84d-3c202d80cd43", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309780, "uuid": "291e6628-eaf0-4609-8c40-981bdc7ba472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309780, "uuid": "05f642cc-6d0f-4285-b8eb-7a1242f4e215", "value": "db796403_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d14c59-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262907, "uuid": "f3d47b67-73dc-4b19-bb11-7270cb778f61", "comment": "Malware payload (Dridex)", "value": "a70e06184ed8a3bd9068f794b4a8a78c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262907, "uuid": "a23a2ad1-92d8-444d-8b82-73691a11a298", "comment": "Malware payload (Dridex)", "value": "3deb203e07f5f7183315e513d4f2651658146aeb181283cd9f4dd62dd5d30b77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262907, "uuid": "d9afd135-77d8-42a0-996d-5773ff90866a", "comment": "Malware payload (Dridex)", "value": "54fa2fff232fded418a8a69c5913e19a64a064d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262907, "uuid": "d5e845cc-2262-4a9f-af83-b260a4c9edd7", "comment": "Malware payload (Dridex)", "value": "9dac3587872c6bd1bb430125ada62df6014fec1936d713cdf70ce8ed8b9c30455fb5a8a4f6b9bfcf97269dc6d8831234", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262907, "uuid": "b0fe06ae-12f0-4d45-bcdc-82369a92b680", "value": "FEF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262907, "uuid": "46142c33-f0b8-42f3-b79c-4ba920f76ff6", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262907, "uuid": "1eb576a8-5647-4748-9714-5860ed152762", "value": "3072:eA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:e3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262907, "uuid": "29deeabc-75fc-40e4-905b-4f573419a16e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262907, "uuid": "eaa7ab01-041c-42fd-aa6a-4b93a69696d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262907, "uuid": "4d59b147-bc7d-422e-bae1-1ee37a6ed5a4", "value": "a70e0618_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6df90c8-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273733, "uuid": "96ae7fb2-c967-49d8-94c4-ec51e10d1540", "comment": "Malware payload (Dridex)", "value": "74b8a2b792f725e1620a8c908de225d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273733, "uuid": "ebbdcda2-5d32-41dd-b83e-13e3239d70e8", "comment": "Malware payload (Dridex)", "value": "3e263e1704da87d800e44a64eb407847f2dc554046f0fbf5a8289bc4fb0684c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273733, "uuid": "ddded372-c248-410d-aef4-5b38efa1bb68", "comment": "Malware payload (Dridex)", "value": "73d6dbd0ea895264256c54bcd2380af12cfa50a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273733, "uuid": "b3ac6d31-8842-4286-82c4-5c4d2c6d8d7f", "comment": "Malware payload (Dridex)", "value": "7f2d1127d4dbdc9cfc752d2381df061553997c20904e453b3d8c05f2addaf7c567ec89a884b986aa5cba965c9d333aab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273733, "uuid": "b989778c-da6d-4a61-89dd-2127e9b5311f", "value": "2FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273733, "uuid": "4eed6374-26f8-465d-8902-70f6dccbec5d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273733, "uuid": "aab266cb-b9c5-456b-a776-7242f778bb33", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273733, "uuid": "297e68c9-bcfa-4f50-b999-273bfc5e61f9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273733, "uuid": "7b48cdba-5d0a-413b-ba08-2bc208824fe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273733, "uuid": "fe44238e-e98a-4317-a4ef-5a9393ae6171", "value": "74b8a2b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a223dcea-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273645, "uuid": "a2e62e35-83dc-4f14-8954-ec5e247cdcc6", "comment": "Malware payload (Dridex)", "value": "d5c24d2547c4b2ed145c21ce91034513", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273645, "uuid": "a89f506f-16e4-4591-b709-2577ab31ceeb", "comment": "Malware payload (Dridex)", "value": "3e593e2541191bb98e73fb8e9b13909dc340cb70f1c075c2129204fd5290371c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273645, "uuid": "6381523d-1ee1-4c49-bd29-93ee798f46ab", "comment": "Malware payload (Dridex)", "value": "1921bb3a3cddf56de30d16cf00a65465e9091550", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273645, "uuid": "f6bc60b8-2f25-4d34-90fc-f10fda2bbfe1", "comment": "Malware payload (Dridex)", "value": "dedb2821a937a185c89788411aeca937e648eed679a183852ef7e84086225a9ed961d0bc0b33fbad71a018416041bdf1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273645, "uuid": "57827cde-4d87-420e-907f-03089e3e8c81", "value": "C3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273645, "uuid": "1dee97f7-be42-4add-8555-7a07a169bca7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273645, "uuid": "d092b696-1a55-4ad3-853b-a8a283dc0efe", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273645, "uuid": "eac9f3ec-e3c3-4c46-a2e6-97f1c914026e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273645, "uuid": "f2d8e3bf-a283-4c1d-b680-b10b7ce62193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273645, "uuid": "22764e52-4575-42e3-9828-4c608207959d", "value": "d5c24d25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bb9f00-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338963, "uuid": "0cd5e5af-c428-4222-abe7-80432f066d29", "comment": "Malware payload", "value": "d8e945cdf844b41e157b85de31bd36fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338963, "uuid": "e54274e0-b0e7-43b9-8d5c-3f773e6ed599", "comment": "Malware payload", "value": "3e7b63161250c0e0a46f3222696dfb5000659a86e33676bece19a1e8bc711781", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338963, "uuid": "539af28d-f83c-4c02-9c15-ef78e3c4c340", "comment": "Malware payload", "value": "6e2a9373806111f0a32c7a6212d4a8e22d59139e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338963, "uuid": "2128c009-4723-4f3b-bf3b-37e870b696a7", "comment": "Malware payload", "value": "bb5f7e1a3da8d3bf0ead0a16457a5c3d65b02d89eafdd22334f3b6eaec0a4a786d6265de7bf8a7d67ad3f256f464412e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338963, "uuid": "fa915c37-68bb-49a5-8932-be4f49a63356", "value": "5FF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338963, "uuid": "42212ed3-e3fe-4088-85fc-75c434600835", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338963, "uuid": "a112f77f-2656-4d54-8538-6a589101f414", "value": "3072:JB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:34KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338963, "uuid": "36559d24-1100-4c36-933a-dbdb5bd64955", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338963, "uuid": "b2f8913a-f48d-4530-95ce-0886ba42e94e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338963, "uuid": "cae3e8d8-1079-4d03-a27f-01f903f708e6", "value": "d8e945cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a3f7bb-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306155, "uuid": "64ebd7b6-cc58-464e-8414-85167873f512", "comment": "Malware payload (Dridex)", "value": "689cbc0aadde036eb7c6c87c0ea05381", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306155, "uuid": "f847fea4-77e8-4ac9-8d48-54d2094cf716", "comment": "Malware payload (Dridex)", "value": "3eda58b6f73324aef5f9935a43eabccb8f5933dac426de401e3787a9998679ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306155, "uuid": "86c42d20-c0ba-4a6b-b9ea-ed1fea6f7ff8", "comment": "Malware payload (Dridex)", "value": "9b465987c0b99aa71309d98d03afeee24e79185e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306155, "uuid": "57b67576-11af-406c-9bb2-5407d65fb902", "comment": "Malware payload (Dridex)", "value": "f6c113a9a287346dd60d15773c9b4ea49beedfb5690d4d32683c6f3a4acde8fe3c7ce82e415bb212afeab6577dd02bfb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306155, "uuid": "0ccc52b0-055a-47b8-9a66-adaf643343be", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306155, "uuid": "0e67b8a1-20cb-48d6-a46e-0db1f8624425", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306155, "uuid": "7a94ccd8-a479-47f5-a83f-263ff9dc9ce1", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306155, "uuid": "654ec5bb-7833-41e0-966e-52db7d1dc7d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306155, "uuid": "59181abe-d0fb-4977-9523-0b66b7e603cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306155, "uuid": "13e4bafb-c2a0-4e8c-83d1-5deea4f18e49", "value": "689cbc0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007bcc3b-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338657, "uuid": "65d56916-daca-4be7-9929-2601122984fe", "comment": "Malware payload", "value": "a5a32427ca0b0e8548c4ea7de9a1bbab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338657, "uuid": "4eb17e66-1575-470d-9ae5-0116bdec2da5", "comment": "Malware payload", "value": "3edcb6923ecc87c3a95799b396be3191484c814daffec64f054ce7e2699a713b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338657, "uuid": "45669bf8-4894-4968-bdff-6a56b49e2d81", "comment": "Malware payload", "value": "28a347f8aa9840b6d44a5f2ee90bd224a8247b68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338657, "uuid": "4a8244f7-d500-4fbe-bc21-8b11501619ad", "comment": "Malware payload", "value": "9db78ec91b90eba024954d15b267ce9441cc5ef66237a17d5f0aa1ae814b872262e2d61cc569e68df7c8f6d7f65b7c8a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338657, "uuid": "a19b35f7-67ed-43c4-bf12-9140ecee4a46", "value": "41F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338657, "uuid": "13d68da8-ee81-4890-8b7d-dfc68d064ac9", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338657, "uuid": "053929f1-fe23-4e38-8eeb-285c7cfcc451", "value": "3072:+B45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:g4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338657, "uuid": "86fd2c29-a4d5-49e7-a265-19e054be3e30", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338657, "uuid": "a86a4e10-b899-4282-ace0-5675e85be4ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338657, "uuid": "fd38ac5f-6b6f-449b-9528-431ce988decc", "value": "a5a32427_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d3c393-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339075, "uuid": "3657e2f9-f9ac-4c9f-8440-75bb88612df7", "comment": "Malware payload", "value": "6798ac2819ff5eb58386f05b08eba748", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339075, "uuid": "5fee15e4-ea48-44d9-8c5f-f80845da836e", "comment": "Malware payload", "value": "3f150ddcabab7b6ccadfb96f9f39c1f1a4104bd403db313a25735104f0aae158", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339075, "uuid": "33fd9e1b-988a-472b-b0b3-ee879bab3ed7", "comment": "Malware payload", "value": "bdcf51c64167acf5154742b13262f08f7b401c96", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339075, "uuid": "99dbbf5f-0393-425e-af4f-cb9c810c66c9", "comment": "Malware payload", "value": "793f028f828a7aa05dfc031e1ab1729a5afb45dbd757dc767d9f98362f24528b197e1ffc05e3755e28a19db32fa5a699", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339075, "uuid": "8fbc796d-a9ca-4a45-b521-23e72189ec88", "value": "2DF3C004D167E6D6C51A583212EA3B3FA6314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339075, "uuid": "56b5d8dd-2f42-4b45-8ef1-90cf08c1cb26", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339075, "uuid": "7d5c039c-2332-4240-858f-f4d66aee07ce", "value": "3072:CVG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:vERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339075, "uuid": "0d2a0fb5-4a8d-4461-913c-1987d0f6afaa", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339075, "uuid": "79f9f201-cc6f-4cef-9149-33ea34bd90c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339075, "uuid": "54459c49-35db-4a34-ae5b-728a9600cac5", "value": "6798ac28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f2545e-aeac-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620334002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334002, "uuid": "2ef8a358-6442-44cf-b7db-da5872af00a5", "comment": "Malware payload (CoinMiner)", "value": "117e4e3f1b6edae6745f82cf072008f1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334002, "uuid": "81ed7c27-e5c4-46c6-b9ac-3330decb4f64", "comment": "Malware payload (CoinMiner)", "value": "3f3ce1f91c8f439a2c903fa08544b08e21704a53c3ab260d3a0b8d3dea425020", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334002, "uuid": "7a029f86-e264-457b-918b-c5449f556f6e", "comment": "Malware payload (CoinMiner)", "value": "62bcde8f6c592a4be16b0d0feeb5fa2df13b0619", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334002, "uuid": "178400c2-d66c-49f9-b000-f49f53cbefec", "comment": "Malware payload (CoinMiner)", "value": "8feac7e84bed0078ef4c4c4764b25c646c6a5397acd6b2ebe7204840108ba6eaa3a7b9072c1025ba1930d13006076095", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334002, "uuid": "407044e6-5738-4aa1-a998-89ecba077571", "value": "5D3523203AD380FBCAB23AB06D11734A65FBFA350F0A8AD35B50150B5E585C59BFD6D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334002, "uuid": "d8cec922-e8f6-4202-b37f-090e2ba7028b", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334002, "uuid": "6741ae6b-5a81-4446-8c35-9ffd2d9db191", "value": "24576:o1qUujZ3P+kMUTeGfspVGx2HMv87d6Iosk/8K/rEkfI1glO:o1qUu932k5TVsHGxcl7zhMoNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334002, "uuid": "f59e0fc5-31b4-4913-9511-6ee2e211723d", "value": 1081282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334002, "uuid": "24d25a2c-4a50-407d-9a4b-4fb30d077cb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334002, "uuid": "99b85f56-0504-4fc3-9e16-39fc05c8f637", "value": "117E4E3F1B6EDAE6745F82CF072008F1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37de5f96-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306108, "uuid": "c8e15bd4-cd54-4e74-97ce-d242d913a040", "comment": "Malware payload (Dridex)", "value": "7f6421756ee0a485bb62c1a9c213ef2e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306108, "uuid": "c765bbc4-797f-4a47-a722-0c95ca3c0fda", "comment": "Malware payload (Dridex)", "value": "3f517b5b5fcde42b7c284b589c067c7aeb635b8e87ab077d3f57bb0b86d6983a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306108, "uuid": "cfa90362-5267-4aff-94f1-0737649342b7", "comment": "Malware payload (Dridex)", "value": "841b2bf5060bc6d23ceb07a8910676cbbea70ea2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306108, "uuid": "1a3517f4-adfc-4238-b257-ffcc908a7cee", "comment": "Malware payload (Dridex)", "value": "861fd41f81f63da0d687aacc58b86eb0aebe342856471201d360db59db17da4d3884d8216bc2be8ae8624fd0ec94d354", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306108, "uuid": "2cbc81a0-57ef-4e74-b870-dff9b0179c00", "value": "BAF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306108, "uuid": "2b187805-a3b3-49e9-9a7f-0062c0a39fda", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306108, "uuid": "a7368541-ec7c-4156-930d-183f2183bd27", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306108, "uuid": "01bf702a-6581-4a08-86a2-331f51036af8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306108, "uuid": "b6991813-150a-49a5-aae3-b4e644b407de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306108, "uuid": "564fe1b0-a4be-43fb-9181-2db01baaf140", "value": "7f642175_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061ba2dd-ae14-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620268658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268658, "uuid": "d214cde9-f3b5-40c0-ab75-3c0b4c149bbd", "comment": "Malware payload", "value": "c7dc21772321f714343fe78280bade69", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268658, "uuid": "d3cc1101-24c9-4c1a-80d2-57404546bb19", "comment": "Malware payload", "value": "3f5f44af3f5fca619e54e05c25a1661101697dd1a0726ac9ea41b70a7a39f00c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268658, "uuid": "630995fe-2dfe-43ca-8ea7-2e5ba393a9bd", "comment": "Malware payload", "value": "8f8d0068c0bae8a7039aa6e3eee9f90629726cc7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268658, "uuid": "55c9c734-5155-41c2-969c-44a0cca5ab94", "comment": "Malware payload", "value": "d61198e77cdc389f60672340657a09315d1907f328eb73bcaac28d277dd39b6b144f7c46b3192115f13ad13ba2b806d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268658, "uuid": "175e1372-fc79-4e33-ab1d-d1aa1890306a", "value": "74E0C0F3F87241721D0098940AA1B60E19E1E90E9E4504C770AC4B31DFC9DCE8847DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268658, "uuid": "03cf6542-a2f7-4b64-ac5d-22ad6c7fcdba", "value": "6:qF/sGXvDLIhNBAoOwNAEdpQs+wEoy90NhbvGAFae8vfnNkzuHXVdqWQoMTpAq7UA:3WAhNCp4AEdasD0WbZ+P/aWyplfPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620268658, "uuid": "9e1c02ef-98a3-4a44-9fce-abe66bc93d79", "value": 374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620268658, "uuid": "cfcc2fb9-275b-4179-beb8-ed080d3922a5", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268658, "uuid": "b5898fca-eb26-49bb-bc7e-ad64e895a7ec", "value": "3f5f44af3f5fca619e54e05c25a1661101697dd1a0726ac9ea41b70a7a39f00c.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08c3e04-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339033, "uuid": "d27d8b6a-6fb6-4dc0-9281-53bb4eaa85fb", "comment": "Malware payload", "value": "c3c991c5c436fb8436e2b8e50137a966", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339033, "uuid": "64466942-b2d4-4c5c-a7b7-a322ec8c56ca", "comment": "Malware payload", "value": "3f9d5615192ad315322d77893ef4140e1c2dec4ea930003bb40332a952f3abe5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339033, "uuid": "f427f96b-0ebd-459d-a76e-2087b546cd19", "comment": "Malware payload", "value": "836162c2862082e9f11d80a304951fbfbeb5102c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339033, "uuid": "e97f1632-4ce7-4469-a3b5-8066602a4793", "comment": "Malware payload", "value": "fc3bbb441d3bb07dc4d8996f82b7a797f149a3b75744fd0a6a730ff7b58dc2898134bacba4d745a67c45f8e10efc30e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339033, "uuid": "4800725a-73db-4cab-a974-738424c48746", "value": "DDF3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339033, "uuid": "4e2b5137-e2cb-40bc-a5fe-a1c0148bd63c", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339033, "uuid": "08cdbcdd-dfa5-47cf-8d0e-0056376fcc42", "value": "3072:6kG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:EERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339033, "uuid": "cf44a104-8cf9-4920-a881-250817cade9c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339033, "uuid": "eb1e669e-34d0-4827-8f7d-81fd984f1338", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339033, "uuid": "ba1cac2c-1fd6-4e93-8821-8abacd8e11fb", "value": "c3c991c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec82501-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285719, "uuid": "9efe1584-1868-4bd0-a88a-5d5a12cf77c2", "comment": "Malware payload (AgentTesla)", "value": "f938f818fc084ebdd32d5c02a353aaca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285719, "uuid": "0668ba61-356f-48d9-b465-13d78507c4b7", "comment": "Malware payload (AgentTesla)", "value": "3fa40179e35abee79981eaad63f79962d9fdaad9685fea8380f04b98384e070f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285719, "uuid": "1549c5a5-4e80-4cae-969b-9a028bd79f0c", "comment": "Malware payload (AgentTesla)", "value": "48d68c458c16e772b2da95f3260d454554b8c28f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285719, "uuid": "4a05d46a-e089-4b59-ad69-4b33f83dba6d", "comment": "Malware payload (AgentTesla)", "value": "41e819e28ec0116feab14465ee23b11a03fc68e9b0a64d85377211cc3aedfaebc9b9e05de0bf32b7940abcefe1365476", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285719, "uuid": "74217938-f04b-4b97-bf99-ae743481380c", "value": "9F35AD226698A924D13B63744566C13847F6BD03E772C60DADE87C9B3B732C2DA67313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285719, "uuid": "c3c7709a-6e09-408a-ae4d-c0b8be4637a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285719, "uuid": "888ae5c9-605c-41eb-aa5c-750e9b4756cb", "value": "12288:JTKEcSRlKBMlH7/AcKgyW8H1cGkvo22xRFj66gGc5+I:Jg7tgyjjk52xL6xGu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285719, "uuid": "f9af8ebc-a397-44b9-bf3f-64fc39512684", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285719, "uuid": "9976e21d-9013-472f-b8ed-59ff5f470787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285719, "uuid": "ac0b9e89-5a7e-435c-b370-49d5ec8a4ee1", "value": "New Order doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bdaea9-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620295305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295305, "uuid": "01bd90f7-a870-4329-bfdc-53fc981f1161", "comment": "Malware payload (RaccoonStealer)", "value": "db8e6a08c6ddc34b327ba5329d15e243", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295305, "uuid": "9872d042-9c68-44e4-903e-c9e7068e43b8", "comment": "Malware payload (RaccoonStealer)", "value": "40175d0027919244b6b56fe5276c44aba846d532501e562da37831403c9ed44e", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295305, "uuid": "1cc3e452-f895-4e0f-b41b-9843b57e6697", "comment": "Malware payload (RaccoonStealer)", "value": "122b97dc9db7aa44b685327722d0fd69a41d9dda", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295305, "uuid": "f19196ac-8ff3-4e25-aceb-e3937c594101", "comment": "Malware payload (RaccoonStealer)", "value": "093a21584e543d6ba39cc79894708f3ec9d89acf895235d854f14010929a71321a06ffa9c73115cc999f170de793091f", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295305, "uuid": "6e345403-4e8a-46c3-9553-c2a8f51b195b", "value": "4BD4F112B180C075DD7715B68D15DBB08E5A7C67022256BFBADC3ABADF282D17B2130E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295305, "uuid": "3772ea70-0a62-46ae-9c7d-26d88e8398c0", "value": "ef8bfa67cab8f52c3f5ca31f772f6178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295305, "uuid": "b6ab021f-c0ae-4cbc-8498-daa0161913a1", "value": "12288:3Jv5xpXek+3ddmFnmCRg3nnzAPo0ZVzjlFnc5imzmr:395x9ek+fmECRqzAAiFnyimzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295305, "uuid": "363abf31-c7b8-4414-8aa2-a5d62f16633b", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295305, "uuid": "2aa94cd4-829a-418e-9575-aa5497b3dc12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295305, "uuid": "eb9fd751-77e6-412b-ae63-3aa7e489484e", "value": "db8e6a08_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b427b992-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339388, "uuid": "fb5514f3-28c8-4c03-b721-07ae644216b1", "comment": "Malware payload", "value": "b0e26a7299854800d45616964e35c8e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339388, "uuid": "55aa206e-1f65-4737-aac0-72377a1a168c", "comment": "Malware payload", "value": "401cbe4f4068c85ba26a78d5b45a5572805ee49a9b8f7c61e7b145fc6f9e8b48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339388, "uuid": "d9ca6748-c791-4ebd-8494-9e5fadf590b6", "comment": "Malware payload", "value": "8e0cd66a84bb0f543e79406336c373ef1fd6728b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339388, "uuid": "3f711226-1353-4cba-a3a1-492b3624ec02", "comment": "Malware payload", "value": "90ccc557f07edd5a4fddd99baa54eecdf7f37e59280da3bd8743f723d62f3418da2a6fc82d69e74a3117458bf55ac331", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339388, "uuid": "824cf651-a217-456c-85d0-9303f5805760", "value": "71F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339388, "uuid": "2d570ea6-007b-4937-8d4a-2e6bd5685e7e", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339388, "uuid": "1207b0da-f70f-4a47-b3f1-9d44ce096783", "value": "3072:mLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:dERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339388, "uuid": "2748d828-0567-4d29-8e51-5d81a24fc32c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339388, "uuid": "d6fe8fe4-4cc6-49ce-854c-ca70aed9088d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339388, "uuid": "5c4ddd8e-5ed0-4963-bfcc-da8bce8d298c", "value": "b0e26a72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297f73a8-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338726, "uuid": "6a3faf97-353e-4481-8862-b8776ad937d7", "comment": "Malware payload", "value": "0c739af3da41aafa3e0eec6ac4a931a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338726, "uuid": "6595c1c6-498c-4ab9-a688-7550e553ce3c", "comment": "Malware payload", "value": "404d70d14e887aec236e3c7dd6c9fd0b0669a0fa16344b3f7e1dd995a73b817a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338726, "uuid": "c9b28dc8-c4dc-48ee-ad78-ea1c1d643d74", "comment": "Malware payload", "value": "4972354fe73dfa5ab46b68f464b95183e8caf20a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338726, "uuid": "f27659df-5514-433c-92de-575465420efd", "comment": "Malware payload", "value": "88cb2651af3da984ed7c6c36bc283f1a0b7315b2c93cbb127f3a1b92941b69901c17e17a6f77121d2718d51c14db13d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338726, "uuid": "4b22bd35-58f8-41ff-b33c-6a8ba4d91922", "value": "2AF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338726, "uuid": "39b73845-e89c-4405-937f-f7b2f8ae5c9e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338726, "uuid": "14af1d97-7083-4277-bf9a-947907e6205e", "value": "3072:3B45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:R4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338726, "uuid": "76fdb4ce-4a7b-4b31-8914-302c56fd4c4b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338726, "uuid": "ea9a3f1a-73ef-4b3a-84cc-9a0f17b8e382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338726, "uuid": "9d58c51f-a128-49e6-9bf0-568593ad83cb", "value": "0c739af3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1b78d1-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306169, "uuid": "348fb0ae-002e-4289-a2ba-4e43f1643e11", "comment": "Malware payload (Dridex)", "value": "9877bc83ea7dd26e77f7ff23f4506837", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306169, "uuid": "10d631fb-432f-49ed-8721-45bb442d7c1c", "comment": "Malware payload (Dridex)", "value": "4068cdb36cddbe653ca3f3cd552c0186da50884adfbdab4210b23b457fa58e46", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306169, "uuid": "cddf7223-57e1-4420-ac05-6727806630df", "comment": "Malware payload (Dridex)", "value": "7f53102bc5f20ad78fe681613af8ec775ff198f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306169, "uuid": "c5a3cbbc-d044-4695-ae36-d8d7a53adff9", "comment": "Malware payload (Dridex)", "value": "d6bbcafd71c36794693e1994a74c864d3a9839666141436b9917745a25299cb336a3e18f79c83724ea59d86c86ac3c2b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306169, "uuid": "b00ff29c-f156-41c8-9da8-c9007c2e0558", "value": "3CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306169, "uuid": "f637cc64-fe35-451c-81d2-57f27c251960", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306169, "uuid": "14e02afb-3f88-4fc2-bbaf-ac07b89d0d22", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306169, "uuid": "84643837-4e35-415b-a8aa-d49f60747b6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306169, "uuid": "383a538f-d801-4e71-b456-5d7d57c7dc96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306169, "uuid": "edc269c6-eb85-4ab0-98f7-6bc5c807201f", "value": "9877bc83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6f84a3-ae76-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620310758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310758, "uuid": "61cdd6a0-510c-4e1f-8164-4902a0a836b9", "comment": "Malware payload (AgentTesla)", "value": "9447449c68ae5cab632f081032623b46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310758, "uuid": "13b3a4d0-ba64-4622-823d-349860da3680", "comment": "Malware payload (AgentTesla)", "value": "409e2c04905a91e0693807f1d77278403dec5094c94b83a79c59bb45c18bec36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310758, "uuid": "37bd4b91-95d6-46f4-a215-c0e1a10b9096", "comment": "Malware payload (AgentTesla)", "value": "92af1e376ba1b3d8155f70f319fae5f931455d7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310758, "uuid": "5024ed21-caeb-4c7a-a5af-1a483ea659f1", "comment": "Malware payload (AgentTesla)", "value": "ae1f0a219c912b2004ff293daabdc18665752269c3ef67e551f146215ecec3397f35f1e7a36b240505126763e4498470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310758, "uuid": "d3810857-48a9-4f42-b182-ffbe0d861991", "value": "2435AD1212589924E17B67348462C13987F67E07E636D35CBAE87CDB3B336C1DA6B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310758, "uuid": "87528bda-f467-4c40-aed2-0cbd26bc8b5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310758, "uuid": "b897013a-511d-4d22-b19e-10bf6220def3", "value": "12288:iuPvtlh2NnocFJ3OT364uxLSMrZenRal1g/yzOyF1xxdxEM8m:iuSbZ4uxptuI1gJ6XQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310758, "uuid": "b0c787bf-58f6-44ea-bc06-591d026fa0db", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310758, "uuid": "5dda2980-d29a-4fad-8d02-ce52c926e9e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310758, "uuid": "fafcf84e-7c77-4269-97d8-b3e79c7b9ec9", "value": "PJkdKLYI1UXi4cM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ca124f-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320543, "uuid": "e166b7f7-3a4a-46d6-ab45-12de3d8e4341", "comment": "Malware payload (Dridex)", "value": "92a2dfec22fc48f26d9d09e28bd57d7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320543, "uuid": "26f1df91-ae49-43e1-9c43-06b90e973769", "comment": "Malware payload (Dridex)", "value": "40b60e9f21679108f4790d5330e7c20c95ec464905588681125086dedada4c17", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320543, "uuid": "87d5bc54-9033-4f0c-a0d2-65b0da9cf3fb", "comment": "Malware payload (Dridex)", "value": "fce55fe6d594fb98c04e1963ed22f8109b33da5c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320543, "uuid": "10cb8161-b855-4588-a1f1-6cd0dfd502e4", "comment": "Malware payload (Dridex)", "value": "ce8723bf5b729c9399ff9d123e73397f37cec568129d44586299d86f1304a72bf8102e0002ccc38005a29d5e77dd1382", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320543, "uuid": "e09af415-d162-4648-a988-4e51421f83e1", "value": "3AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320543, "uuid": "0a50df08-1992-4e76-80a0-b796949a1ac7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320543, "uuid": "bce5bdee-3762-41b8-9401-db1bcab1d7e2", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320543, "uuid": "0cd0eb0d-a606-4e68-a73b-a37af28ea9d1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320543, "uuid": "1a271f1f-82f9-41c5-a2fb-4377b2209d11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320543, "uuid": "77965c60-356f-4281-a510-8abeb7458d2f", "value": "92a2dfec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13295d96-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277270, "uuid": "36f44201-3cd4-4478-b979-e311eed662dd", "comment": "Malware payload (Dridex)", "value": "5ba211e497894062432524650df7f4f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277270, "uuid": "b7cb7ab0-366a-4088-882e-c6e04c96b6df", "comment": "Malware payload (Dridex)", "value": "41031f3ff4b175f14afeb4ad152e5efc86987fc6be39babdb23763812ce79631", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277270, "uuid": "b1b88733-f3a5-4501-9aa6-55718eddc990", "comment": "Malware payload (Dridex)", "value": "bc3b3d13579bed7008c13c95c7b83d7bff25de8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277270, "uuid": "2dde7a8d-2e07-42f0-a8aa-166c2aaff30f", "comment": "Malware payload (Dridex)", "value": "43faabfd46ae8b9f0606390a8d7c78aeb8ecb2f16fe50d302ddc601c22e07529016e1cef8db5052f46f90afd254efcb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277270, "uuid": "7c5a9a65-8452-49fb-abfc-fddbe4e88ccb", "value": "D8F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277270, "uuid": "7b4533f1-acb3-4a60-896b-5b50a97f65a7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277270, "uuid": "1da19642-d013-405c-9abe-244eb1ce0f46", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277270, "uuid": "915e594f-5c0f-4424-8414-3c41ea42d989", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277270, "uuid": "f47bffcf-51f3-4150-b4fd-e8992f9c3a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277270, "uuid": "56ce2361-fba6-4a12-950a-0cbf63d8b038", "value": "5ba211e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f54803-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339304, "uuid": "cf9676a4-849d-488a-add1-0424ad609818", "comment": "Malware payload", "value": "c7c1ec2b5a31f742d2b57df04c7a5379", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339304, "uuid": "225524e4-2b2a-4655-b0b8-1c0e05fb85de", "comment": "Malware payload", "value": "4103582aa4365c1107a060dc0b3cba12833d2342af666c2e143c5d6816f25972", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339304, "uuid": "609b7cf0-2ed7-4434-9f61-65ace6fa86cb", "comment": "Malware payload", "value": "e2fa0417375a3f2e5c7be22e7d2044e912d91865", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339304, "uuid": "b2426d83-7f7d-4e32-84fc-f7478c1d187a", "comment": "Malware payload", "value": "11f37241a9c943e5e6809325a5ce030afeb7453c361765e5e561839f4cdf3ac7eb0f5d34c08c1f8b1eacba54c7367657", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339304, "uuid": "f2932bb6-5ae2-4998-a51d-f22bf1604156", "value": "C7F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339304, "uuid": "581e3c63-48ac-412b-984e-6ee94e335d00", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339304, "uuid": "d5250a4e-ed45-429c-895a-55d01e2db5f7", "value": "3072:DEG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idOJ:HERMVPG6+Y63HoG1QawL40Prx6K4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339304, "uuid": "627fc016-1b23-46a5-a071-badb6e48c33d", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339304, "uuid": "2c6265ac-67fd-484a-b4cb-88e8cbf18231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339304, "uuid": "925de89a-0d3b-4e29-b10f-309094aabf8c", "value": "c7c1ec2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beee06c2-ae67-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620304617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304617, "uuid": "f1b2c262-f73a-4c51-b8b9-6c661de24ec2", "comment": "Malware payload (AgentTesla)", "value": "55c5c904d7955f3799130d6165e82f4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304617, "uuid": "1e2c15fa-4e3e-41d6-8750-be694ba64771", "comment": "Malware payload (AgentTesla)", "value": "41292e87ea6535601aff98d2a400144ae93fc1a0d3e8fe8dde903df90cc330e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304617, "uuid": "fd33eb03-05fb-4b83-b203-8468fa12d8ad", "comment": "Malware payload (AgentTesla)", "value": "10ecfc8283ad4ebb57b1f1834a58c9a1e7e02b3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304617, "uuid": "6599b50e-3060-4992-b1a0-97c2b9bf3995", "comment": "Malware payload (AgentTesla)", "value": "0fed5c366c5e05114caacc495cf801f365f704c86a09a210a92cfaa26a6ada99948412554e836af928f288ddfc1264f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304617, "uuid": "b753b99b-9432-4f8e-9854-957ab4b1ed7d", "value": "B185FDA97C63F07CEBDBBFA581D66EF6A71F73272978923D019850901B09036B0A5371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304617, "uuid": "c26d2997-762d-4e70-bb9d-b5acafdb0c37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304617, "uuid": "1b368cb1-9894-449c-8a08-9ce1678e04b6", "value": "3072:5MY/dgZNNEB5LfryZfENTwHivJNZiChe/GkW1Gq1UlxZ9OLJ1Hp3Dl2LvowLxY/K:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620304617, "uuid": "667fef86-b47f-4994-b05e-a42b7d8db8e5", "value": 1845968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620304617, "uuid": "9b7cb0b3-9659-46d6-b6a9-beb70f7b95e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304617, "uuid": "9d5f781f-62b3-4714-bee7-8e7325940918", "value": "mena_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784bf71f-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270139, "uuid": "d4b6b15e-b25f-4403-9ce3-53091f0856b1", "comment": "Malware payload (Dridex)", "value": "5677dca8686f8ebc84acf0c1c0ed239b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270139, "uuid": "690ca284-ad66-4c5b-8239-696e45b5559a", "comment": "Malware payload (Dridex)", "value": "413674ae7cddc1fd1b5e971c056c7c1d5541bed824e33e1f5c0c1eb18b119088", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270139, "uuid": "ed28e52b-fca2-4f31-a4c8-7331dbb9d645", "comment": "Malware payload (Dridex)", "value": "f9eb05978f5dff9fb59040d7efad67d432305506", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270139, "uuid": "1fe33178-9042-4939-8769-05317c6d3d9f", "comment": "Malware payload (Dridex)", "value": "c609def6382b8af13c768ed55ccb74715b139e4d23c1b1f864b939af4b30cc36c8364d1996467b349459a1933c5bd8e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270139, "uuid": "b86acf34-871c-47c0-98b8-3eaea3e9b230", "value": "B7F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270139, "uuid": "394213fa-1e81-4225-aac3-ddc7f9abeb0e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270139, "uuid": "db780044-18e3-4a55-9696-6d0a8b96b0bc", "value": "3072:sB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:14KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270139, "uuid": "e194345c-319e-49f6-b5cb-20164e40f692", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270139, "uuid": "91f0f27a-125e-4e35-bcad-bfb4304a8ebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270139, "uuid": "eedf867d-cc0c-4d67-906a-47a2681d44b4", "value": "5677dca8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4dc119-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291706, "uuid": "f0cf36df-f102-40e3-a5b1-1b63df5e06aa", "comment": "Malware payload (Dridex)", "value": "4ee2bc1769c9f1abb1e18afe42e33536", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291706, "uuid": "02accc0f-8156-4237-b997-d981b1980bd2", "comment": "Malware payload (Dridex)", "value": "41628caef7c96262209fdf080470a2c9d7357f4c7ba3a3c4ab0897804cf8d2ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291706, "uuid": "561c35b9-0b99-4923-890f-40f5c10d2bbb", "comment": "Malware payload (Dridex)", "value": "e2efae6fc8b8dafc5ffb11b9dda7a5ac7f032d3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291706, "uuid": "dcc31fbd-3e1d-4c24-8b89-2dc9dea930e9", "comment": "Malware payload (Dridex)", "value": "8f5f770c662ce04b78dae008b842320800b3f2e9ceba59b55eafb936dd5586def8a559abf6334f97179bb660b2e1731a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291706, "uuid": "da163476-ab78-4e1e-8787-bae4758853e2", "value": "D1F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291706, "uuid": "264e644a-35ea-4f8e-b072-bc8a94c05ecf", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291706, "uuid": "5e31e60e-f0a5-41c3-a5cc-cbd7f090a180", "value": "3072:rA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:r3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291706, "uuid": "f3d3bfbb-93fb-4082-af97-34b8cc747887", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291706, "uuid": "1b73b922-3bcd-4ba4-a8d7-8726be09372f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291706, "uuid": "6d9ce75a-f3f0-4874-b0d6-d02b4f59a9b6", "value": "4ee2bc17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08250121-ae23-11eb-abe1-42010a9c0039", "comment": "Malware payload (TeamBot)", "timestamp": 1620275104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275104, "uuid": "afed8b6e-9abb-488a-ab60-61bf9bc34640", "comment": "Malware payload (TeamBot)", "value": "781ff3bba03b51bf03971555e48e3041", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275104, "uuid": "f260fb81-3dcd-41fd-b93a-8288ce214dea", "comment": "Malware payload (TeamBot)", "value": "4176503a6e226f3ee78f38f37bd7fd9cb38e834def41ce5395a0fde5a4acfb7b", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275104, "uuid": "44ff1365-6f8f-4b29-b21a-0bea939845c4", "comment": "Malware payload (TeamBot)", "value": "22c3177a1b5534a442e0bd5087b73250f9848b95", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275104, "uuid": "3b78ac43-edfb-4bdf-905f-e5e813f8692f", "comment": "Malware payload (TeamBot)", "value": "4ee800ce90d5e57c8ca0dc9b7926ab541f1180d46e68b87dd7b93e3b5cd65cef61dbffd7d45cdc3dfca9bb958a6ff605", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275104, "uuid": "25f33034-4fcb-403d-b23e-a2238fdb8a56", "value": "0F1502117580C075DC1728358961EEB45EA9782226725AFF3BED39FBEF28640763234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275104, "uuid": "2abd6d51-cb44-412f-86bc-1955b8401bd7", "value": "229d85caa4a32f0682bca8d22f161759", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275104, "uuid": "fbb2f1ed-f127-497f-9711-6e15a49fbb01", "value": "12288:2ldaiLwJmm3eu2K5tTZBsPUCTx8dQSjio3eb//5agUe5izmr:2LaIwhmKxSB8dhja7hdUe5izy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620275104, "uuid": "447c2859-9bf9-45f9-8501-1126813e7c0d", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620275104, "uuid": "1c8a0348-b31b-4236-a558-da4e50c4feab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275104, "uuid": "ff187617-6288-46a6-8673-b4f16d24442f", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96508696-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338908, "uuid": "b1761fc2-bc07-4f6c-adba-abdd50c417c7", "comment": "Malware payload", "value": "3f302a1d4a43b87934fa03d7e3f3052a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338908, "uuid": "1f7c5417-1061-41ce-8cbb-eb9ada7ec167", "comment": "Malware payload", "value": "417e1e1a2a43ddf568b0aacf223b58f8401460bc42248e0a2fae86b3a19d1778", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338908, "uuid": "3a81a291-088e-4104-b29b-c4d018b3fdd2", "comment": "Malware payload", "value": "17e02cdec9e7263e50ca298fc9d22309a05f42f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338908, "uuid": "d8259eff-cd4a-4aca-8e8b-043d359c8a35", "comment": "Malware payload", "value": "e4f6abfe354a55861730f92a7f058fa9bd517165876c0092377cb6daf76b3fa2af4eeab4faad77962e588ac0c1ad7198", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338908, "uuid": "cf385700-3edd-4a7f-91f7-6651d79af8e6", "value": "96F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338908, "uuid": "04f70c35-5089-476f-9fbf-266af4773b7c", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338908, "uuid": "fa759fee-7e94-49c2-92c8-743b382ab469", "value": "3072:qLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:BERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338908, "uuid": "1afd073d-7ce5-4711-974a-1202c292a713", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338908, "uuid": "6e0fd328-0c77-4775-84e3-9366ba0c95c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338908, "uuid": "da632dd2-e667-4648-99c3-fafe8db3a0da", "value": "3f302a1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10af2a9-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338524, "uuid": "5ec9b8ae-1620-48d5-831b-146ffd04d765", "comment": "Malware payload", "value": "d30807176c82f6e591221381275bdcd3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338524, "uuid": "a6bf2908-1fb6-4d0e-acbe-056b8956e048", "comment": "Malware payload", "value": "418ba7e5c9fc484f1d4fd1302f99ce2460e3f02ee025ac6ae82dadae50400f65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338524, "uuid": "6ead57a6-a01a-476d-8b1e-c2ecf2fdbf2a", "comment": "Malware payload", "value": "342d85923fd951ab706563c701b6d166ab41d5a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338524, "uuid": "ba44c894-b5c0-4c39-8990-d2b14d40f5ec", "comment": "Malware payload", "value": "7689017459f838b25b48d8146392e718154935ea32e467778f6ca10a4c8b5461eecbcc43551b4b5d7677d19eeceea56b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338524, "uuid": "9bac5051-c0aa-4338-9a65-82348a90294d", "value": "E1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338524, "uuid": "badbec86-4c96-4b3e-81a8-87d43ae68799", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338524, "uuid": "74658d3b-14eb-492a-a4c6-b512274914c0", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338524, "uuid": "fc96eba5-40f9-42f2-a13b-6164fb7b1f22", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338524, "uuid": "da78ffe2-db66-494a-aefc-f60be58cf960", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338524, "uuid": "a2fbc69c-2363-4d24-9b1d-b71837eac7b1", "value": "d3080717_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0e119e-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277309, "uuid": "fd1a135a-4506-47da-9a0e-739c21081962", "comment": "Malware payload (Dridex)", "value": "e2070820682a3d5505b0532667c337b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277309, "uuid": "37e66b42-af8c-4f87-96b2-f300a4925ea1", "comment": "Malware payload (Dridex)", "value": "420c3af5ec67f50bfddbc09ce56daa89a94fad268b3339ec22b477f77d9eb5ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277309, "uuid": "d1a79781-fc9a-4c85-8143-d104750af6ff", "comment": "Malware payload (Dridex)", "value": "b51214ab5136da01453e82b4dfaa3cbae0c1ec98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277309, "uuid": "7d0409b5-be52-4e24-b9df-230cae89e9b8", "comment": "Malware payload (Dridex)", "value": "daffe4bcde36e5e13bb4a53a1aaf8f987a3db6926b4d114c826e1c07560f79c2d5a3d3d107dce6456a06bdf6260d6626", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277309, "uuid": "ccc43368-b402-4109-a098-ff10a6f9d8c8", "value": "0FF3C085DBABE87FC44A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277309, "uuid": "f8548d55-1405-403b-8f4f-923c2e73c544", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277309, "uuid": "8f0638b9-668c-4d65-b148-17669b9587b8", "value": "3072:5B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:84KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277309, "uuid": "6b8682a1-86c9-4065-88be-67f27f265e3d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277309, "uuid": "e7547da9-6bdf-47a4-a807-207ecdaca7ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277309, "uuid": "72aee3ca-abe7-4a1e-850c-3adc1bdc9851", "value": "e2070820_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ea2b8d-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270081, "uuid": "117f271c-dfae-4c72-8422-bc6093738dc3", "comment": "Malware payload (Dridex)", "value": "c9ee283a9bc99473ee24a5e9d67302f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270081, "uuid": "7a068ea2-5526-4186-9786-2a2a6698c2cb", "comment": "Malware payload (Dridex)", "value": "42bdd8277641eb55824a57b00940c513d13f2b426fc8030c5542ebbbc154bdc8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270081, "uuid": "9be293b2-5f67-493f-80a5-090ec7a0b8de", "comment": "Malware payload (Dridex)", "value": "ae35267e24a0076863e137ab1329a03348b0d98f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270081, "uuid": "65768afd-eac7-40aa-8dfc-a2aa3b5772db", "comment": "Malware payload (Dridex)", "value": "049c47c2f9ca866eeafe121fe2f4bf83d5c6dd39fe0a9f1c4554655f41f944bfd0c6d45a04b75acf9a4d535a0378eb04", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270081, "uuid": "7b0f2c1a-0519-4a89-8773-e77bb136f6bd", "value": "75F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270081, "uuid": "e5363a43-4d36-4374-94f7-0f628cd84dd3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270081, "uuid": "d0df5e27-0585-4699-aa91-4af5192eadaa", "value": "3072:oiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:zeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270081, "uuid": "0ac8899a-d540-4a19-9a09-36460db94885", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270081, "uuid": "9b04aa90-a408-40c8-89b7-dd59cb22b9ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270081, "uuid": "536a0cb1-6c4b-47bc-a2cd-30f126e9f250", "value": "c9ee283a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d89c40-ae0d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620265650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620265650, "uuid": "c2b75c31-ead9-4d6b-bb6c-00e2cf4de917", "comment": "Malware payload", "value": "06a58f61b3dc3ab0fa5678d94bc879a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620265650, "uuid": "585e956a-9f35-4292-986e-8efe47994330", "comment": "Malware payload", "value": "43082804cfc584b42cb00c6086f68c924b684ba5ffdbef0be31ae547411bc474", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620265650, "uuid": "1216996b-3ef9-4098-80ac-aea162a9b665", "comment": "Malware payload", "value": "2f02c3dcbf88a83cc1fafd632d3b0abe048f84bb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620265650, "uuid": "50aa5459-dcd0-4a06-af32-4dd2e298e704", "comment": "Malware payload", "value": "cfbd1a27c220cfdf692e6b5e064bed7684f2dab2833ba1d7537324bc8e11e694c9be8642873f1b2426328a8768df5586", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620265650, "uuid": "b9d3ca16-ca3c-42b6-aebc-636b406872ce", "value": "602285057C80441A153391E9FBB1A649FF6542178304CB58B9FD7BA37FB2D5A9833AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620265650, "uuid": "e1437c4c-042e-49c0-9cde-55e6f69c6276", "value": "96:L3Sc6JUufM5li0CsM5lsM5lTy343d+QrRwARzaLX5rSrMM8nCAaT:LH6JUufpq/mRt+QrZaT5rSrdCaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620265650, "uuid": "e787a080-8f6a-45b5-bed7-987afee7d265", "value": 10146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620265650, "uuid": "9ada8d78-091a-4708-b6cb-717690fd8912", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620265650, "uuid": "fc2db4c3-ad6b-46c4-9d6b-e27fa026e609", "value": "43082804cfc584b42cb00c6086f68c924b684ba5ffdbef0be31ae547411bc474.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46382c22-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620316870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316870, "uuid": "4ed32d74-d8c7-45e6-906e-aba2a76bbfc1", "comment": "Malware payload", "value": "2af288c50b186890e36d954d0d21a002", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316870, "uuid": "e4b35598-73a1-4174-9d92-6398d7314e0a", "comment": "Malware payload", "value": "430a5cad8e1f05ce7d3c9e4304eb93bc795bf9d4492eab79790db7a97b3745f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316870, "uuid": "cfd9d926-3649-45ce-93ad-67ec2bfd25ba", "comment": "Malware payload", "value": "bdd7bdcc70ca5a468b56df237d52062d3fec3273", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316870, "uuid": "aa10b943-ccf6-49df-a826-e238c6a5546c", "comment": "Malware payload", "value": "e60d7d7d7c50da9d72816433bf36729628d461f53843fdedfb881084f34e3eb5a4290eb8e3119d0996315b9147cb604d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316870, "uuid": "b2c55a93-eaeb-43dc-b438-81413ac25e35", "value": "0CD5335B4534EDEDFA17682403AEB9116EBC3309435D5E200AF29316D6B0F7613BEAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316870, "uuid": "c49dba2b-0798-4810-9f0c-aa8bd118e59d", "value": "49152:P2x/nZ8mxX2rKyZteu7QQWYp7J9iGGzhZDenol8iGcPEAq7icfXaIKRNNLt:chyJ/WYpTG/DLWiGcPiicfKIKnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316870, "uuid": "5949eb7b-a06d-4f71-b2af-1f3a8aedac68", "value": 2911645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316870, "uuid": "2c735b20-ff98-47bb-8702-f67844d35733", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316870, "uuid": "3eacfc95-575d-411a-b6fb-4008d7db0912", "value": "2af288c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e297dcb-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259357, "uuid": "fc6103da-5ae4-4b84-86a5-fda3eff9d9ef", "comment": "Malware payload (Dridex)", "value": "ad2664e5c0765d5a58337457393ecf0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259357, "uuid": "6c64850f-5036-4cb6-ade1-97b299094159", "comment": "Malware payload (Dridex)", "value": "43d1b585f93eae6edabda974c49b53e0dca5f78e931768fecd6e67021d0fb93b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259357, "uuid": "0f7ed917-1e43-4454-b1a6-cae693f745f1", "comment": "Malware payload (Dridex)", "value": "7dbc08ed50f01088f7fc4535a4a5dd4cd81b8d3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259357, "uuid": "bad8cc79-7763-4ead-9bc6-f66623c81fe2", "comment": "Malware payload (Dridex)", "value": "8c416a4377cdbc44a52de086fcbc7d95a02e63f7ce788ea242c9cbf130df5929e81113f36bcf636c34c26c703a2260d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259357, "uuid": "5d87de28-6704-4ea7-9653-7f9e6ce33235", "value": "B0F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259357, "uuid": "6c0f7c0a-2cd2-4a74-b1d4-9a85aee19e16", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259357, "uuid": "fb133a69-c38a-40df-860e-72f7642fac97", "value": "3072:mB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:/4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259357, "uuid": "6496cf5b-9dfb-40b3-b445-653197a68aeb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259357, "uuid": "1e100d9c-a60e-4bd1-a19e-6f774d9bc96b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259357, "uuid": "06178082-9a1c-43e0-aa37-b8d1c3a0d7b5", "value": "ad2664e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dcceb7-aea1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620329291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329291, "uuid": "092ffaf8-273b-4164-b10b-677ea9142539", "comment": "Malware payload", "value": "c4b0617006900fdfdd3eaa762c68a8ef", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329291, "uuid": "17291a2c-6dee-41a8-9dd7-6d0b3c98c1e3", "comment": "Malware payload", "value": "453e7a4314783ccee4547d5be1f17bd841599bebe9f9f6d8d3ba0b05be7cb059", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329291, "uuid": "cd52c5ff-168c-4c2b-9142-e95b1838b558", "comment": "Malware payload", "value": "4ce54af01029c685759fe181dcc80633a0044630", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329291, "uuid": "d598e4d3-dd01-4f52-9e4a-bab2c0892f3b", "comment": "Malware payload", "value": "90752affa40ca6876180b35828109cd92ba487a91a4d2e5881bdc8e65a417049207ab67578e75a075486fe88fad5c9d9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329291, "uuid": "b83a0328-5af4-4903-bb41-9a6d36b74d5b", "value": "EB833721AB6A9BC0EDCA79370651CAB1D3324FC0170377EBBEAC7B4D2758991492512F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329291, "uuid": "a6230270-34d7-4a65-a22b-3800695861b1", "value": "1536:aYhKiB01bTDkNnhipFnY5IE2vYjsRX7oWe:LKi+3DMInY54vYjsRX7oWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620329291, "uuid": "58ec0e13-5895-4477-88cb-3cd0c6e326c2", "value": 81606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620329291, "uuid": "bb12b7d2-cf33-4f33-bf05-e24171260ae6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329291, "uuid": "d2730dd0-9a08-4e3b-915c-15d8055946da", "value": "instrument indenture.05.06.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb2a18d-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320585, "uuid": "61486268-cb84-4470-a669-69d3be182506", "comment": "Malware payload (Dridex)", "value": "1417fe8d95ab87a0953c9dd018b552ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320585, "uuid": "fc0e8aba-2528-49f0-b50a-4112bf0a7d44", "comment": "Malware payload (Dridex)", "value": "45cea197391c5e9e915540908f67411b8c69ac8b5353ebb90a3e030d97b4fe3b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320585, "uuid": "7cad1906-8d14-44de-8f40-dfb3f6ac59a0", "comment": "Malware payload (Dridex)", "value": "a283e597fbea5b148f1d12370169fb8b9d669c1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320585, "uuid": "e22be519-4d19-4070-958b-5f7f207d7f2a", "comment": "Malware payload (Dridex)", "value": "ae15972866b0aa396cb892865f8124b3d27f3441f882948fbbdf4da1a44f060aa043d56e1e37bf78b26b917a98694f76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320585, "uuid": "f340b45c-3bd3-44e2-a304-8e3c8af3f8bc", "value": "CDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320585, "uuid": "99d87fd5-e974-46ec-b4f3-68d6dfaeb370", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320585, "uuid": "deb168ad-abb2-4dc6-aa17-20e7720a0de5", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320585, "uuid": "be56f14c-56e0-459b-920c-835e38a7a1e1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320585, "uuid": "e2ac8cd1-b7d9-4033-9a7a-145864b06438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320585, "uuid": "26a3c8e3-459a-4f6d-b41a-60684a0829d5", "value": "1417fe8d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6accdc71-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327668, "uuid": "3dcc8c9d-d8ec-4200-a3e2-4caf233e3010", "comment": "Malware payload (Dridex)", "value": "45d5deb896f84106b34953cb6f01e4cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327668, "uuid": "3c582cb5-1378-49a4-87c3-18043981e945", "comment": "Malware payload (Dridex)", "value": "45eb14e3d7f6479bf261a8635a3b59e5583400ae9f06c8491f2ff11ce0a5044b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327668, "uuid": "d0b6a983-d988-49cd-acd9-bf95b57bcf0f", "comment": "Malware payload (Dridex)", "value": "4dec2df51a4323f7118826c9b4e7bc6eabe8b038", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327668, "uuid": "ee7dc01f-2375-44dc-b737-ca19bc0173d3", "comment": "Malware payload (Dridex)", "value": "7b770a73b7fb34e1e23b992fdd802d821561e71f2fd8fd5247d5c3965e08895f9c28b770b89851a82ec626e4df059f25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327668, "uuid": "bd460add-c02d-4dc7-af63-ac32f6ee587d", "value": "55F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327668, "uuid": "cc171535-fca3-4b97-b8ea-0163463b911c", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327668, "uuid": "02a97bd8-d529-41e5-bbea-68d175f14f3a", "value": "3072:VWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:V42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327668, "uuid": "b9fe9c16-c306-4e4d-9e84-8ebda936c74a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327668, "uuid": "cf4036da-08f3-44b1-b2de-70d3f21112bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327668, "uuid": "21d94597-7006-424f-8057-cad80300eb04", "value": "45d5deb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aa76f7-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302457, "uuid": "8f78ab74-101d-476b-9b95-c3993345d2ec", "comment": "Malware payload (Dridex)", "value": "55a37e9d09afb8ac63978b51fcb24abd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302457, "uuid": "27c4719f-058a-4ba3-957b-e5576846c55c", "comment": "Malware payload (Dridex)", "value": "4631999f2269b86a9405056de01d36107e86d4270c5630a2ce84a14de2ac760d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302457, "uuid": "0bcac391-cd5a-43d5-8548-22e0bf025bef", "comment": "Malware payload (Dridex)", "value": "07d88113cff02f8f715c7a49ad2ce99ecd6a438c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302457, "uuid": "ef8542ec-c874-4da1-a1de-f4460a162a3c", "comment": "Malware payload (Dridex)", "value": "1ef2b74c873872366daa92b58c22f7fb75b82f758e8f512c4162ad185cf3f013d76cc4868ee1a4602978f71f04df4e5f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302457, "uuid": "f8f1785c-5e0b-4f2f-9260-5df7e868d39a", "value": "EEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302457, "uuid": "6932a55f-48f9-42b0-866b-3c561d72659c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302457, "uuid": "57999d67-9459-4615-a672-f2c012374708", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302457, "uuid": "2727ab47-9003-4a19-9da9-545003700ebb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302457, "uuid": "c472dcb9-7764-4493-982b-99dc2f0b4c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302457, "uuid": "22500a91-7e3c-4a8b-b8d0-16c654c77fe5", "value": "55a37e9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babc0412-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338970, "uuid": "dda88479-9637-4842-8e76-adb60d3ff91e", "comment": "Malware payload", "value": "92f4688b4bc970f1c1c0655b66f35c23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338970, "uuid": "9748e374-668e-433a-b2ca-8fda10f82950", "comment": "Malware payload", "value": "4710588e895ff1f91e3406416a23b45a0bd18523a9c72b272984ce0d42ffe040", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338970, "uuid": "cc781424-ff50-41b8-934b-36b80fd77f2e", "comment": "Malware payload", "value": "65426dbf461a3b63efecda72a7ee485e9fcfccfa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338970, "uuid": "85a5b191-1d27-4550-b484-27671be0e976", "comment": "Malware payload", "value": "97d65d0ce97cff9227617d2bef7f7d564a39dfac9919da0d0575dd4233220c05d3174600acbe24bc7b5704d0e90dccc0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338970, "uuid": "0903c913-8a16-43b6-a7fb-cc675156fdea", "value": "A1F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338970, "uuid": "aaf29925-5510-43e9-b05e-0b41cf0ade77", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338970, "uuid": "49f6cd79-3e61-46e6-a900-600a7e533233", "value": "3072:JkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:xERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338970, "uuid": "3ca23ced-81a9-4363-9a8d-3539a59549cf", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338970, "uuid": "c04cfe35-683c-47b1-8e02-9fd862171edd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338970, "uuid": "955fc480-f09c-48d0-a177-29be9c2cfe64", "value": "92f4688b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5326f7f5-ae27-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1620276948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276948, "uuid": "054534af-927d-4e22-8357-ae089a0ca0e7", "comment": "Malware payload (Pony)", "value": "8c8e3814e775492f6b250e2db3b636da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276948, "uuid": "2ea064fc-ff22-4d89-83fe-57f2a9feb30e", "comment": "Malware payload (Pony)", "value": "479c2742f5d9d61607933d59d483390286c627282b2f820d50aa72bb08fd536f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276948, "uuid": "7ee95a99-3318-4b8a-bcaf-40bbf487ff09", "comment": "Malware payload (Pony)", "value": "ce8603b7bf0af19d29f1e0b063b26c066f151c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276948, "uuid": "46bd3c7f-c119-4c54-bd57-f1683bf36531", "comment": "Malware payload (Pony)", "value": "079c316381e77073d8a534651685987b17b35a271aa0896dc677b6c3da717c7ecd84b9d44a18e00636b224c4f357e86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276948, "uuid": "d826f3e7-9416-426f-bb1e-b5d6ad78e014", "value": "EE930903FA80E0F1C0A22A7137C15761E7FD9E797C3A8D4AEF9C49856DB22877B16152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276948, "uuid": "e2efb191-17e3-49cf-bbd9-fed5db02d657", "value": "09070e021d4505e6183701ac6e022a16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276948, "uuid": "2696fd54-26e5-4e97-9736-bb5cde575770", "value": "1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEISkzmt2l:2SnMuGc/CfZDap6COU45EIKtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620276948, "uuid": "ee86e295-cc18-4724-9f69-856afaa87c9d", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620276948, "uuid": "96b13957-9b58-4941-b689-8ecf02f274f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276948, "uuid": "0f9f50f6-d0b8-4021-b7da-1ae60c38ec68", "value": "8C8E3814E775492F6B250E2DB3B636DA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b045f4ad-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620285265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285265, "uuid": "35ef5eb3-4092-4165-8c8f-934bb9eaf403", "comment": "Malware payload (Formbook)", "value": "54e12bb22e93723f1207f9b0c68ce740", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285265, "uuid": "cd8184c7-8fd0-40de-a5cc-0fdd52652127", "comment": "Malware payload (Formbook)", "value": "47e832373110163a11b922941cb9a2377c7e44ed290a528073152b0fb1ffef93", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285265, "uuid": "fb43ba93-d968-40dc-9015-17521c7e1f80", "comment": "Malware payload (Formbook)", "value": "c4c2bd10d4e5a21997e1b5a2eec5beccd63759ea", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285265, "uuid": "a05b59e2-3883-4c34-aadd-96feed82c82f", "comment": "Malware payload (Formbook)", "value": "94c6793dd25a54c64ebc785e3c90a7ef469d7974da1a5088406390b39b5cf8ebaaa9ca470fa39509f0fef06df2213e7c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285265, "uuid": "e866baaa-7305-4b92-ad74-a2ce63a80b3d", "value": "1D45AE5222589624D03E13719062C93947F67E42E773D72D6AE67EAB3F33280DB67207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285265, "uuid": "d520391f-a45e-4422-b330-23f4a9588ed3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285265, "uuid": "6194898b-2ac9-4831-bf99-df9a6185e5e4", "value": "12288:tP6lfqSXnoJQSfo9PwSNGAQI7/OGBbuqPFxeElvzLVMAcfNQBLSi:Rvaj9oSN77/OGMyHlbxxcfNxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285265, "uuid": "ab1868ce-0c25-4dd3-a257-2ac6cb427278", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285265, "uuid": "a49fb7f8-6579-4ddf-b2e7-adebe3854f1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285265, "uuid": "a4153e46-3ef5-4d90-a99a-e6fdc83b84d9", "value": "DHL Receipt_AWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7651ed-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338843, "uuid": "d0336522-8dd5-4164-a6e1-6a583f7d3a78", "comment": "Malware payload", "value": "55955bfdb1ecef7ebf73c0feff82d1d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338843, "uuid": "a19788ab-30a4-45dd-a85c-15d007d2ec69", "comment": "Malware payload", "value": "481932290a9cc4728223818519c3fec23e11a1f279be7b7dac48eb5ed1330dcd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338843, "uuid": "8250fa20-ba10-441d-9502-b935eaef8050", "comment": "Malware payload", "value": "de8d3fb972da826c6fab369b34f8a33b8e8be064", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338843, "uuid": "fd8d700e-5be5-4689-b43b-a7c05cc29835", "comment": "Malware payload", "value": "07e9297d5bfb346a47802b1c5e88720c049f90193d973fefa3302c2e6e1b9c13e6b9d9ea48091b1ad2cef1de6e8edaa2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338843, "uuid": "c30872cb-e52b-446d-99bc-f83194578bed", "value": "29F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338843, "uuid": "8d4406f5-3444-458c-a028-23a1d3b2c5c7", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338843, "uuid": "1e1ac671-bc79-4697-99c6-41c3cee926db", "value": "3072:yC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:T4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338843, "uuid": "f02c9d25-c9d3-4554-914c-29384c5d3b8b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338843, "uuid": "29aac7ed-e8f3-4d9d-a799-7d93541b61e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338843, "uuid": "2c3ab9a7-c80b-4b55-994f-14b374679ad3", "value": "55955bfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b0fa72-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270134, "uuid": "dd65912d-0964-4ada-8953-914c0271e74d", "comment": "Malware payload (Dridex)", "value": "e959f5b578bf28eec0003a0ad173c0a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270134, "uuid": "d1846533-5571-4469-8bb0-66803ed5f455", "comment": "Malware payload (Dridex)", "value": "48196c14b2ab3035e896c15d517ce41fde84383b0610dcdd0733d4d7a7ff8ec0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270134, "uuid": "7b71e632-5b2c-47dc-96b3-fd3582e7369e", "comment": "Malware payload (Dridex)", "value": "72cf2b753c2b916a7c748c5b488afe7cb047aea3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270134, "uuid": "cf179db5-63d9-4d7b-83ba-745d649c1197", "comment": "Malware payload (Dridex)", "value": "b66fe687a6b8ae9b09a2d9399316d97bb4a54530fa2694936dc7c3d366bab99782998d3d74d740c854f6929dff6d08b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270134, "uuid": "8dc68bb8-47bf-41af-93be-a088a4a22aba", "value": "82F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270134, "uuid": "58197b5b-12f9-4e99-b2c6-2bc3dfdac78f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270134, "uuid": "afabf594-0bf7-4b64-8501-3a5a7c04903c", "value": "3072:LB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:e4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270134, "uuid": "d1f8a2cd-ff9b-44bc-9f7a-bc8159387d3a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270134, "uuid": "7be0790d-9270-4299-be7d-24555712c317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270134, "uuid": "5ff7e245-8b28-4741-b239-c98d03b4f2e9", "value": "e959f5b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09241e9f-ae39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284555, "uuid": "3194a15e-30b4-4b0f-a090-11ccff03e988", "comment": "Malware payload (Dridex)", "value": "5af8803171e4e1ed91e20799e5cd6b37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284555, "uuid": "237b39e1-3cdd-41ed-9bb0-28a3833650c6", "comment": "Malware payload (Dridex)", "value": "48ae1adeb2158426a5a5e28300a37e6c5d360c77db84bb78662fc6fe494db231", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284555, "uuid": "313b8091-b5cc-4805-b271-8630d084bbd5", "comment": "Malware payload (Dridex)", "value": "459f5fe1acb7f0db6ec53d789fabe83db421f633", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284555, "uuid": "a05cc80f-07c5-483d-882a-fb9d3d20af2d", "comment": "Malware payload (Dridex)", "value": "9a90108a8a07ad59450371abdfcbc436c90d584d63c2c0533b1093125d9dd1841de22359cbd239c2a5257761edae3087", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284555, "uuid": "3b7b0ce6-4303-4d8a-9126-6d44773ca4cd", "value": "BCF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284555, "uuid": "c25d5ae8-478a-4de7-9deb-c506b510952c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284555, "uuid": "cb3c0b77-6f0f-4eed-815b-6953e39219b0", "value": "3072:RiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ieAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284555, "uuid": "415c14a5-faa9-408e-8922-6136366e858e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284555, "uuid": "7138ae00-6fbd-45c6-b756-a375c42b10e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284555, "uuid": "fe1042a1-97ef-4466-a374-655f2a68d1e9", "value": "5af88031_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a4ed0d-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285655, "uuid": "f346d380-b4c4-4bca-82dc-d95a65121bfb", "comment": "Malware payload (AgentTesla)", "value": "af983d8ad89c15e99715344d89e7b982", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285655, "uuid": "ca725a79-6f34-4a9b-88f9-eff04354d4ca", "comment": "Malware payload (AgentTesla)", "value": "48d82009697a2f183959ba343b0d207a81ff68619402ff7d7ebff1b1e197ac12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285655, "uuid": "4b75b3cc-f180-42ba-bf60-0750e27a51c9", "comment": "Malware payload (AgentTesla)", "value": "641ee65e8fb16bc297d3f37e7c64c324bc581dc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285655, "uuid": "831e2ac3-f3a4-49e0-a41f-923f40393850", "comment": "Malware payload (AgentTesla)", "value": "7b4dcfab72b7e21ed4c3d7eff8a984ae20d58c94b2033e33ac001277616339d11b319801889655e5ccba817db9441f0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285655, "uuid": "a7673d71-2520-4746-bcc8-058049161c7a", "value": "80259C226698AA24D13B63748562C13847F67C03D772D61CADE97C9B3B732C1E66B313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285655, "uuid": "9924a7df-e10d-4131-8a2d-91c3eaa58dda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285655, "uuid": "6096982d-6650-4b89-8992-558f4d3f9201", "value": "12288:4LXLNKlKedHpKw8Dh+XsKrm2Kmn4PrBX8t2QtxIc3M:4fSlcDEdTKjzZtUI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285655, "uuid": "55c68e11-e760-4e04-a75d-98ebc121d67e", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285655, "uuid": "312d2a0a-fda2-436a-87e3-a6ab1fd700c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285655, "uuid": "4d0f4e45-f8cd-4430-a8d6-876f8248950b", "value": "ADVICE84857584489393.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e071337-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338707, "uuid": "9eb15648-abb8-4e0d-87d8-f0d185aed7c0", "comment": "Malware payload", "value": "ef4c920bd4a1b3846253b9ef6b9fb178", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338707, "uuid": "7fdd4212-f3e1-4a88-a429-a5b9d840e03b", "comment": "Malware payload", "value": "48d82f677c91581ce6ed3e43955dafd1535b5f3165a73ffc6e60d5fd03b3bd14", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338707, "uuid": "7cd17caf-dc09-4e09-a084-2f28d43eec08", "comment": "Malware payload", "value": "7576b93d316a3aa52e7df5ac7e6c3c61f7795c66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338707, "uuid": "7b9572fe-44fc-41cd-9152-caf89c1bd552", "comment": "Malware payload", "value": "045d8bfdf1dd9ccbc149d243a70b81e207657f742671e21db1240143fa53bd81de33bdebf3f333a77204059a5f6f621b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338707, "uuid": "f5119e74-6091-4cc8-8deb-693cee5031d8", "value": "17F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338707, "uuid": "2362a798-7b4e-4359-b4dd-2c3ec76bd80a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338707, "uuid": "e24e060f-b6c9-4d0c-9c76-067857f9199d", "value": "3072:FB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:T4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338707, "uuid": "b6cd8203-6feb-4eb6-85d3-13ec18ab0304", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338707, "uuid": "41f3ae73-211f-4a69-89df-cb1ee3006587", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338707, "uuid": "16a4eea7-ad75-48dd-855d-4ec143fa6681", "value": "ef4c920b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42911d43-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339197, "uuid": "19476dc7-c58b-4a22-b142-2e7089e30ee5", "comment": "Malware payload", "value": "c96ec47d6e669b3ba855063ab54c0400", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339197, "uuid": "1cce3f09-8538-4704-ac2b-4c473c642d93", "comment": "Malware payload", "value": "48e5a4abf99ddf35d565b16c685218ba8739db779b7b392f14318a30fdf371fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339197, "uuid": "47ff0ea2-5f6a-4a13-9cb5-9109ca869ecf", "comment": "Malware payload", "value": "b198e6c1e740a5eca4ac1e23fa450b1f4700f394", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339197, "uuid": "00cc0e20-aebe-403c-8c0f-07055a09f698", "comment": "Malware payload", "value": "ca261df237f9f5a1e27b0f392a8cf6ecf8971951ebd4916012f8401552a5d6565a9448b7c5d27fe9108027418a9c0f3f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339197, "uuid": "8b1e1c8b-dd92-4088-bf4f-a21147493898", "value": "32F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339197, "uuid": "647a60a0-1f10-476a-8ef6-416525cc082d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339197, "uuid": "e9282743-031b-4c1a-9901-824e1a38bc3b", "value": "3072:UB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:S4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339197, "uuid": "0affaf30-19f2-4e3a-a4a6-d3de1bad0451", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339197, "uuid": "b98fb64a-b18c-4f7f-9d1a-1ee8acf20887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339197, "uuid": "fd68a5f2-734e-42f0-b539-3f4b0faa4e33", "value": "c96ec47d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ba12f7-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313383, "uuid": "4ff8b39b-7bf2-48e5-bbc2-c3efeeb25b1a", "comment": "Malware payload (Dridex)", "value": "74f498efdcca29c961f448cfc4281162", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313383, "uuid": "f6e36180-0d04-48d7-af0b-79a217ae39a3", "comment": "Malware payload (Dridex)", "value": "48f56572f60d49b51207a249d91d5a1b0b507446714abf72a5932daa457f06e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313383, "uuid": "7fd62e23-2fe0-424f-9171-6195519b52e5", "comment": "Malware payload (Dridex)", "value": "c2edb7f06f137efcb82d587e5896f45a22830211", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313383, "uuid": "9769e64d-df9c-4736-8163-0ada2f59f6ce", "comment": "Malware payload (Dridex)", "value": "84360feefed12399ab14e1ae8ddc45a553edf6683e8a75e88367e3f8a9da657e860eba102bbd9db19560f74f761515f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313383, "uuid": "584409fa-9352-4892-965a-bc13d36c497f", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313383, "uuid": "d720f94d-af1f-4496-8832-4427d51dc54a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313383, "uuid": "2b33d7b8-defd-4473-9614-a580f062ef81", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313383, "uuid": "4fe07e1f-dcbe-4f93-97b4-0cadd693e226", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313383, "uuid": "088252ef-9f93-48e9-b3c6-5a54baf05f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313383, "uuid": "da411824-802e-4c10-84b7-878cc0dfbfff", "value": "74f498ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c30d40-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620284475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284475, "uuid": "cd0a228e-e177-433e-93b5-f3921f884135", "comment": "Malware payload (Loki)", "value": "bd537d6dc0f123a8f66e1922098833b4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284475, "uuid": "bc489677-1bc1-42b9-beb3-034440b0c6de", "comment": "Malware payload (Loki)", "value": "491d78834dc6f54c196e41b67869a1a9af8ebe2de8901b17fb25149345c91226", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284475, "uuid": "8fc038c2-56db-4334-87ab-4838d6c785ff", "comment": "Malware payload (Loki)", "value": "a3285da7529fc0ef41ac74e673c42e52faf1c0f1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284475, "uuid": "08e2d9fc-49bc-43a8-9347-b2f1ccd32e3b", "comment": "Malware payload (Loki)", "value": "58fca9af16111ebbcde192ca46188f780e74eb42d030e89543c0843f6b6f41d3feecb27261fc95e43883912e58f75d65", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284475, "uuid": "366ad583-34ab-48f8-817e-e3df6ac6f029", "value": "B855DF33BF080A5BE3A92DB9A431034197F4D1556112CB5B3FA850AEDEC67C52F632E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284475, "uuid": "17d9a961-c9a1-4cbe-8fe9-ce9e1e6ebc9d", "value": "12288:CQ2xMkesnL7aGtBuJ/jFrEP8ZvJzqOAsDA9uV302YzgbHOtpfu+Qd0O8u1/ADog:CZxXjLfBuRcMBHAm30YTOE6O9d07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284475, "uuid": "31f10702-e28e-492f-b8ef-db96ab2ed3c3", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284475, "uuid": "d7a112fc-9ded-45bc-ad36-b03dbad272f6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284475, "uuid": "a0b1966a-215c-41fc-8ea4-4a11f71821b8", "value": "bd537d6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645aaaea-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620316920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "4fd318b8-a776-40b6-aef3-f902791a2eb3", "comment": "Malware payload (Formbook)", "value": "7b4973aec7a63ca2903b317601acbd10", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "9df1b78f-fa28-41e4-8cb0-56639455938f", "comment": "Malware payload (Formbook)", "value": "49418af33201289e66136b482386db29a68e32c689f0b625eed3699b8bb45940", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "a10187bb-7fd3-495e-92ba-91693dc7e4b6", "comment": "Malware payload (Formbook)", "value": "342038824bb18ecc6c4a1097d62755bd06ef4969", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316920, "uuid": "893b83b3-ea22-43cb-bf13-7dfd418362bb", "comment": "Malware payload (Formbook)", "value": "e925be485ae6d0e804061f4ecd2a9a16ca2ce07cd9b066bf99bc56ae87ae16b8772525a1447bf6ee791806ea61dc7028", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "3e2cc8b8-8c70-4f18-b506-9f5b3b2d9396", "value": "933412163650D46BCA310AB01E37FB3BEFEBD314126E0D1F9BB09B543A260658A1DBD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "dd5603f9-fb11-4b56-8491-84e8aecb2adc", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "32c80206-d0c1-441f-b30c-a8314c41231f", "value": "3072:Lf1BDZ0kVB67Duw9AMc+bElCa77BtQQm2QtN5LFc0tkCuvPcin+ajfGGmctO8lbZ:L9X0Gg/2Dm5tjefCSPBnvOH1b7nFcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316920, "uuid": "f7eabfa6-164a-4bd9-843b-c4ca32ac0a21", "value": 231607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316920, "uuid": "e0b655d0-953d-49a2-a0ae-12996c0b9f62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316920, "uuid": "3e2ff946-8b5a-4818-a374-e38a0a672481", "value": "SecuriteInfo.com.Gen.Variant.Jaik.45760.22297.11380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c9cf9c-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270106, "uuid": "86149755-031f-41b7-b2c6-323e011d407b", "comment": "Malware payload (Dridex)", "value": "245e6f0224d3333174ee3c54008e984f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270106, "uuid": "c22ed8e4-5d99-4fd0-b156-f73af5582d50", "comment": "Malware payload (Dridex)", "value": "49a0085749f7a1a7cb96bdf3405f08d9732c70874cfd0b11e9809e4c888ec001", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270106, "uuid": "2c80d067-4bb5-47c6-b66f-10d8c31e9159", "comment": "Malware payload (Dridex)", "value": "ea1655e51ec74e50648a54ddc7eb863490993aab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270106, "uuid": "4f3bdeea-d21e-4905-a187-b195be38be87", "comment": "Malware payload (Dridex)", "value": "8bee12596eb197e785e2d80ae8dd4e877d79c2f9362fb262fa6db6f2bf7a5138e5808f3f6bc4176359afdbe42ef1f56d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270106, "uuid": "63c34135-6c94-4dcf-bcc2-2466f4ad62c7", "value": "9BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270106, "uuid": "57b2a813-39bf-4529-a1b3-eae7c08ef443", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270106, "uuid": "0928f6dc-ef07-43f1-b31f-fefd0fcb08df", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270106, "uuid": "ee76dccd-2d6c-44a3-9166-83fd37333ec7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270106, "uuid": "f3f992e2-a839-4f77-b102-eafafe2852ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270106, "uuid": "1ac9f117-4569-463b-a254-ea7e7bf9f882", "value": "245e6f02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4377dd18-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620285512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285512, "uuid": "477aa02b-c4a5-431c-8189-4105cc4fe53a", "comment": "Malware payload (Formbook)", "value": "9246a29da060479960879de3db2f1374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285512, "uuid": "17658754-1e86-4102-a312-fce2fa511caa", "comment": "Malware payload (Formbook)", "value": "49a4412c27e5eafc4c4365a2b2aeb962d6bf25849ab58d4e7eeb25fcfb934dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285512, "uuid": "e3650c44-64c4-495e-8f3b-8d96c979bc60", "comment": "Malware payload (Formbook)", "value": "fecbed5c0e6cce40444994c85caf7cb838b35df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285512, "uuid": "7d8a804b-262b-4322-a9c8-5dbbfa40915e", "comment": "Malware payload (Formbook)", "value": "7fa7e9e1ea8b8ed1b7ab4459a9f659892f80b9d69317d6645a4c37498f2f2d5e8b564f70cd0b545879082553c879a49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285512, "uuid": "517425e6-05fa-4d3f-b18a-e50aab97ab76", "value": "DE2538EC761075EEC617CC23DBCE1C15A6202176972B9607932303BD9A0EE57AF385DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285512, "uuid": "ffb9f984-3492-47a7-aacd-fe16f89d43e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285512, "uuid": "38ef5af8-08ec-462d-b082-0c483effbdb7", "value": "12288:1sWu13oLLoS60/K7yh04lvYAaG/uF8+6fXouGkQEOxu9KWfKhdQyRcGP8FMhGWP6:+r3oLADu83EOx9hperTWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285512, "uuid": "79aab6c2-103f-4560-9ee8-a35cb3c365cd", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285512, "uuid": "2836a024-0c9a-4b82-ae95-1256582c0ba6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285512, "uuid": "b8d6cd2d-bbab-4ca0-b238-3e64e12c8bb3", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1c44e8-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338596, "uuid": "c9e85cc6-76ea-4ac5-a6d5-e1147719e76b", "comment": "Malware payload", "value": "e7e885ca8b268697dcf74fb326bf96d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338596, "uuid": "2adfc06e-de45-4fe6-b728-b20dfd773538", "comment": "Malware payload", "value": "49a55b0c43714f032241dcc27cfd13b0bbb9bef601a3101cc95b37f3753eab3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338596, "uuid": "76eb7d72-e007-41a9-a190-36f9ca90cb07", "comment": "Malware payload", "value": "7dd36c752405442df3be85b6b95c7629acb7f333", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338596, "uuid": "65eae205-92bb-4230-a9d4-d24a6f9d7b20", "comment": "Malware payload", "value": "0d974bd9ff2bc3b1239a5e13fc861fa0672ece4ae59952537d7691c528584f9b25c8055bf84d7cbdd22aac8052511209", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338596, "uuid": "ad7f6fff-0c46-4eb9-96e0-1e02ec3c3fa2", "value": "6BF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338596, "uuid": "1a2be230-aea9-4538-90ee-d69402736b05", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338596, "uuid": "143f4b8a-e579-45b8-a2fb-4e0273849bd3", "value": "3072:pB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:X4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338596, "uuid": "325f535d-e8d0-477f-8726-aab6cac64dbd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338596, "uuid": "adc762da-f8e2-4a3e-b26c-6f06fd4b448e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338596, "uuid": "8b389fa6-2b8a-4864-90cc-2bfa00286f8a", "value": "e7e885ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e6c76b-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291715, "uuid": "5dbc05d4-c100-4793-8716-a71ffb5b577d", "comment": "Malware payload (Dridex)", "value": "df7407baae79c36a075504bf16005cab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291715, "uuid": "15a064be-a9b9-403d-8ce8-69b630a6b904", "comment": "Malware payload (Dridex)", "value": "4a5efd9791556932d3891f5766d3c154a98685c145036eb3dff519d34e3da5cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291715, "uuid": "276d46be-fe87-4388-b1b7-1412740b6041", "comment": "Malware payload (Dridex)", "value": "4cda4034ec276fb39a5541366746e2c8d153b939", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291715, "uuid": "7f5d7046-5e8e-4027-9b91-4988c7c977b4", "comment": "Malware payload (Dridex)", "value": "a1252694e33ea5daad11d854d0489b0796f99234a68a2b5ceec416e37fb58537693a21f144c6b379b689db8de13bc04c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291715, "uuid": "92d86d3b-2964-4951-ae1b-dfdd3561dd9a", "value": "5EF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291715, "uuid": "c0ea9a53-64f0-4d4b-b12b-0b5edbbd2cb3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291715, "uuid": "879a55ed-cf09-4dee-bf36-bf251783ab13", "value": "3072:6WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:642IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291715, "uuid": "63ce2c2c-9ffe-4843-bc64-09c4a681d6ce", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291715, "uuid": "dacfde0b-a246-468f-94bd-d082ba13baf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291715, "uuid": "ecbaca19-61cd-4afe-a109-d1bf6c8b00d5", "value": "df7407ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f18aa5-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620324389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324389, "uuid": "adfa5f0b-b7ee-47b6-ab20-294db8bbfc3c", "comment": "Malware payload (IcedID)", "value": "4f9ac7226e67ccf960f2e7f0aa3aa64c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324389, "uuid": "85c62d38-14bd-4e10-be28-b5f84fb0c2f8", "comment": "Malware payload (IcedID)", "value": "4a637cb5c62d469c5d6e293a1e03d5a1bccca0556c58e67b6aab06e1122afbd9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324389, "uuid": "ec2fe385-06d0-4ed6-ad95-d8249684151c", "comment": "Malware payload (IcedID)", "value": "2e58fbe14a618bd0fae85e53971be66cf440b3f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324389, "uuid": "37df6bf1-fa4a-4567-9414-e55875408f1a", "comment": "Malware payload (IcedID)", "value": "9dc975fad3306909bde013b312537ebe7c6e62002e8e31e391d9227981791b92dead7f0ebf6f7564d206ebea852d12e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324389, "uuid": "bca21a6c-3b61-43b7-be21-87b48d64fe60", "value": "61349226C9E8D17DF147A4B6743CDB88C554AE809E218DE7A6D6C812BF138B117227CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324389, "uuid": "935ebe49-0121-4b9e-ba76-2811ef1c418a", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324389, "uuid": "4a53d742-2010-4d9f-ab75-5fd0d016d28f", "value": "3072:/Z+jEoUhhUuTjmhkJU8XV+eDOWedYlGRWMxAeiAbO+yH5wtrPPPPkeU/hLzQHaOl:HlmE9rfwZSueOIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324389, "uuid": "a979210e-6113-43ac-9ab2-cc118ed89659", "value": 244312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324389, "uuid": "a86f96b1-5fbb-4078-a6fd-5a7c88c5edeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324389, "uuid": "6cff4942-ee88-49bc-83b3-2ddfe0df072c", "value": "4a637cb5c62d469c5d6e293a1e03d5a1bccca0556c58e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8389fadc-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262856, "uuid": "3eb337b0-865a-462d-a59d-475a3a649723", "comment": "Malware payload (Dridex)", "value": "ef2ba3b3377e94124ad864e44eba1e93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262856, "uuid": "7c375696-9860-4969-a02e-67bf25c613e8", "comment": "Malware payload (Dridex)", "value": "4ac73f3c16f6be7579114afa56288a7f61e4cbfd536d1dbd63e249bb9ce152b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262856, "uuid": "a008d617-0d62-4593-b4c7-e57171ca11ef", "comment": "Malware payload (Dridex)", "value": "8c9b15b5212507cfae211080612b7c4f6c5f981b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262856, "uuid": "50281fd3-e9bd-458e-9fe9-01100b03f717", "comment": "Malware payload (Dridex)", "value": "78f9fe0065b6d06d680daab02d0362b556dde1855bae06e9c2c3b6886253046f7884f2a797e28bfd912729dedf440570", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262856, "uuid": "3ade4572-0e18-423d-9fc9-de0e6e0c3051", "value": "D3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262856, "uuid": "9e1ccdab-20ed-4f9f-a508-4aeeb3139bde", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262856, "uuid": "c9e24014-7d5d-44d9-866e-1c915d5fecbd", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262856, "uuid": "0024e0b6-4296-4609-a608-127d7b578957", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262856, "uuid": "e6a5e211-8649-48dc-94f5-55f87c1d7a9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262856, "uuid": "478f1ace-c1e2-4b9c-84b7-ed06bafcb5f7", "value": "ef2ba3b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69f0ff9-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291691, "uuid": "522868a5-0f35-469d-8046-f9825037fe53", "comment": "Malware payload (Dridex)", "value": "b0fbc8e21f3155b201ac994c7e211194", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291691, "uuid": "2f05d714-6116-466f-aea7-a39411e08cdd", "comment": "Malware payload (Dridex)", "value": "4b89638f74aed3c3dd276b45aae07067a6312db26b0db121c0b70aff4379311d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291691, "uuid": "526bc69e-e5e3-49e2-8343-2b9ca9778651", "comment": "Malware payload (Dridex)", "value": "7b47c29ad64c7d470e5e8928ddf35fab3a5ad014", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291691, "uuid": "adebafe7-11d9-417c-ada4-d1f1902d3090", "comment": "Malware payload (Dridex)", "value": "15228150bd407242aee0ca01fb0b09cebcb044e71e104b5bbcf2e273d582cd5954835b9088086cb065f74a4c3374014d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291691, "uuid": "a68e8586-7bcb-4ca9-85fe-f25bd81cf959", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291691, "uuid": "45b23177-b91c-4537-8b1d-ce05e489923e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291691, "uuid": "19b67f6a-d1f0-4f81-aee8-e0e2b0b66fc9", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291691, "uuid": "bf6c34ef-bf92-4972-9b3c-e56833885cd5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291691, "uuid": "bba54c02-43c2-4c2a-95e4-ae382fa58a4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291691, "uuid": "2eacf994-e787-46c3-a214-46c036eaf86f", "value": "b0fbc8e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8171761-ae3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620286164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286164, "uuid": "f194db39-a359-4f3f-8b80-3ca42df17d3f", "comment": "Malware payload (Loki)", "value": "94d2b88c5566478d404f0752ba3096db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286164, "uuid": "188f219f-db7e-47f7-b5a0-f4a1e0eef0cb", "comment": "Malware payload (Loki)", "value": "4c0ccfe62aeeec1a02cba19d60f23739c1e368669c47db06f62d5e18ead50373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286164, "uuid": "a60b3338-d58d-4016-ad34-4b2412db718c", "comment": "Malware payload (Loki)", "value": "8f8260172770e324bb2d4edcf2eed554d0e5edd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286164, "uuid": "af660c5e-24b5-4503-90fb-27a138def79c", "comment": "Malware payload (Loki)", "value": "95c8cd14b97f2562b98631c50ca5b7c88fe14b2bb6f8e8e9bde757dea7fb854d2c05f3ee42c51840e030625399e382b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286164, "uuid": "dcc5ccfe-f92e-4a36-a993-ad448de14254", "value": "2C259C2222989924E17B63344166C13943F67E02E676D71D7AE97CDB3B336C0DB6B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286164, "uuid": "11af29eb-fe9c-447d-8c34-7a3e32bf690b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286164, "uuid": "7111acc8-ef9b-4c09-963c-dfcff9314de2", "value": "12288:LmwBuuQnoAmmJg5aKf9nVR4Jm948ykPiqSM:LAfJgcGUCyOiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286164, "uuid": "2d21faaf-5152-4c87-9e2f-74006e2444a7", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286164, "uuid": "2ea5cce1-9255-4f8d-9ac3-4c195e444ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286164, "uuid": "4f415497-4484-4142-a61e-090e6c000288", "value": "94d2b88c5566478d404f0752ba3096db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048254e4-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338664, "uuid": "ac94690f-1169-4ed3-ad06-a30e50b5417c", "comment": "Malware payload", "value": "49ca3bf9a6858d10af8ac692ae0a6118", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338664, "uuid": "f6a8721d-4a11-49be-8651-9e0860b15051", "comment": "Malware payload", "value": "4c76dd2acaf75ba1eabc6b0e50bc0b797e38185b61dfd4e306542923547bedbf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338664, "uuid": "bd1a1712-3b8b-4574-864d-0e719772cb22", "comment": "Malware payload", "value": "21fc2240ab88dd4f0460328d00049d78e8cedd09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338664, "uuid": "20d9858c-ab5e-4db8-ab91-d8e484d02776", "comment": "Malware payload", "value": "e74d54a77f1ce2a7be64c4c10f5b20b6b1c47d194dbf2fa8db4fcfccc83c5cb584c9ecdfba331de4e683cdba76c83178", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338664, "uuid": "49ef8a29-5be4-43b2-947c-f893aa5f8feb", "value": "97F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338664, "uuid": "81eb7d78-db77-4ca0-84f4-096f6b4473b3", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338664, "uuid": "ce164c14-bdbf-4bb1-b685-9a80a3339e86", "value": "3072:BkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:JERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338664, "uuid": "9dbae4d7-9da4-4df7-906b-4a33ce9b3dfa", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338664, "uuid": "b880fc9c-04af-4465-bc62-6bc03a54c3b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338664, "uuid": "3bed2e0f-ec3a-4d28-8311-49c6edf79fd2", "value": "49ca3bf9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897b99c7-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620310111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310111, "uuid": "91af6c3c-c3f5-4aab-b484-b08860453c74", "comment": "Malware payload (IcedID)", "value": "f7de44db0b7db9428419a3ddde377836", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310111, "uuid": "3f4d5bad-b1d0-48cf-828c-9a9097ad99f9", "comment": "Malware payload (IcedID)", "value": "4cf38891a9dbd5d649e39f1bc5171d1015f93727c65a41c281e004378a21a0da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310111, "uuid": "a0b0d929-bf98-4391-8eac-5dfeca1de319", "comment": "Malware payload (IcedID)", "value": "f966842f6c591f5f8daf3e87cf3eb374031af8b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310111, "uuid": "1b121e49-eb2e-42cf-aae1-7d0f9ff07024", "comment": "Malware payload (IcedID)", "value": "f089318b040cc2c6f5a4e9b6549f35891a73f8f3203642857e964a6438661b22193301c2e1200fa0d2bed0ac6d221810", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310111, "uuid": "19ff461b-946c-425b-8ceb-dbb153baf523", "value": "88139E6BB2E0D2F4ED03CE7CD418964D592CE7114099168EF026EFE1DCC7A56264F29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310111, "uuid": "578dc293-d448-46d3-a852-b11f6d4543c5", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310111, "uuid": "9139b1f7-9593-4677-8a9f-4c29d50ea226", "value": "768:pTO1zkQB2hBi3IUwV8Zh3uydpBEt3ChnDoX8w5houu3wh2hm39:IqkwV8Z42BM+nDghouu3wOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310111, "uuid": "5076936d-d785-4bd2-a9c8-88ed1661cb39", "value": 43650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310111, "uuid": "202e8355-0c4b-4ccc-ba7e-b22f1e6ccb49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310111, "uuid": "650f0c68-e672-454e-bbe3-0bbffce47ba2", "value": "f7de44db0b7db9428419a3ddde377836.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470297b4-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339205, "uuid": "087b6962-2286-4ef3-ae1d-929b05a6ecb1", "comment": "Malware payload", "value": "46f0d0e33984e83e1ae68600d11fd580", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339205, "uuid": "fc42029f-9a40-48e0-8581-84c923589d6f", "comment": "Malware payload", "value": "4d661731b15469921615ba62b519c610d9b716e0b35fa59e9f732bf154b75e1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339205, "uuid": "be054cb7-b7f3-4d65-b6c3-4f7ac88051a1", "comment": "Malware payload", "value": "45495cc8a4c51f7bba71c490a635876988373b8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339205, "uuid": "dcee4d46-a606-48b5-a347-b9074be403b3", "comment": "Malware payload", "value": "6990a31e283cf5f440679ad011c17d2c7dbb39fa8a09974ddabc6e770e775e99a6e735d4c16fc05392f503cca1d9fd89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339205, "uuid": "54627dbe-2576-4c82-9b14-d1ac7d1d836a", "value": "D2F3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339205, "uuid": "450a19fe-e57c-4df2-98e7-1017913b9e79", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339205, "uuid": "fc4f6f32-8874-4d05-a2f6-3acde21bb95f", "value": "3072:2VG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:TERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339205, "uuid": "249f56c8-e72a-4272-ace0-9233423fb72b", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339205, "uuid": "d7559fe5-28b6-4849-9063-10d054588ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339205, "uuid": "6604b987-5ed1-4236-8466-0790e28494c5", "value": "46f0d0e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7540906a-ae67-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620304493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304493, "uuid": "1183025f-e87b-4275-9cca-e4b341dfc159", "comment": "Malware payload (AgentTesla)", "value": "3b496a2b2d4375963bcbad7f9f5af754", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304493, "uuid": "6b8fa3d2-9ff3-43cc-bd61-59c78979c11d", "comment": "Malware payload (AgentTesla)", "value": "4d7d74a9894de7e870220bff688bdf8a2649dc0415d0beddbc28be4b58960632", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304493, "uuid": "b5b500be-509b-4ac6-9810-8f86706ce2e9", "comment": "Malware payload (AgentTesla)", "value": "6c647be3814080ee2cd235a60aed8dcb98e72901", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304493, "uuid": "89cdc1c6-4b16-44a1-9479-8c4ae90b3cd0", "comment": "Malware payload (AgentTesla)", "value": "d0a72178a944b1618bcb4a66232ca61b976caf79d3c687d0391c76d80f2a7c92d887d0c03bb6d75311170ce89abefbc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304493, "uuid": "1aaf7764-e298-47d1-ae0b-f0b4a4ed64cd", "value": "CC1528EC761074EEC657DC22DBCE1C15A6202176972B9607932303BD9E0EE57AF384E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304493, "uuid": "4e097bed-dca1-4498-8fd1-28dc03984173", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304493, "uuid": "56fb1838-27ea-41ca-a0b8-d6f8c73636fb", "value": "12288:rk+v02AyoLLoS60/K7yh0sw2+F5oPp0P5/wqDvupDjgpf5yqCPoLWRknK0J58gF4:rJvDoLAswp5SaBhupU5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620304493, "uuid": "560167dd-735b-4bb8-b564-c49a02e00d11", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620304493, "uuid": "72878333-f308-4a46-aab8-5879783c411c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304493, "uuid": "aa0b438e-f210-4f72-bbcc-f1d4226c4713", "value": "arinzex_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f7de82-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313348, "uuid": "7770f52f-6ba7-493f-804e-14bd993dd80d", "comment": "Malware payload (Dridex)", "value": "55a9b6cbc7e46bfe6361d374a0ca565c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313348, "uuid": "7e885b75-c1d5-47cd-96e3-7bf3b57b6d5c", "comment": "Malware payload (Dridex)", "value": "4d81ee25ae38d1046c179d9925de6e9f4f2faeab9d699476966188ccd9583b6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313348, "uuid": "ce1f2d9b-dc37-448f-abfe-dc0392f490e5", "comment": "Malware payload (Dridex)", "value": "ac29628133c119112f3caec8cf4c425021580e6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313348, "uuid": "58528b0d-578f-433f-bdc5-f940a94aa983", "comment": "Malware payload (Dridex)", "value": "cdce03ea40c62bd4e529d03fbd5df11e46c5690912cf4ec5a3648626f4b7e671f13a14d17fbae0b91f5108819e24e866", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313348, "uuid": "6b4a6899-8e14-4d66-ab9d-56aec4a8b907", "value": "04F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313348, "uuid": "f164d236-140a-4ede-a74a-809e275c869b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313348, "uuid": "122e6a92-afe9-4ad6-82b3-af8cf2e914cb", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313348, "uuid": "e5da1f78-47c2-47a6-9403-ebceae77e210", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313348, "uuid": "3d89225c-2821-4200-be2c-e49cd591edc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313348, "uuid": "e563c076-8b79-41db-ae5d-8616c22887c8", "value": "55a9b6cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db30d74-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620316882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316882, "uuid": "1fb90964-31b9-4db2-a9d4-32d32793edbf", "comment": "Malware payload (AgentTesla)", "value": "7dbe517bbe41c23577c30a67759f7077", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316882, "uuid": "231a83c5-d9de-4aa1-9729-f324e24fd5c5", "comment": "Malware payload (AgentTesla)", "value": "4d8be67d05043b333c65c2add7615f5c73b45741d30d92854a883fb0856d67c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316882, "uuid": "8e1b9939-5b27-4368-92ab-d8afd869f228", "comment": "Malware payload (AgentTesla)", "value": "12015978ae5d135890e44af6af07c402e78d2e0a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316882, "uuid": "0246c65f-c594-4e2c-95a6-9a40acaae16e", "comment": "Malware payload (AgentTesla)", "value": "ddc72fc4d2d10d99945431e12d832074540dda51029aa5a8dee068c0c1b700c7e23f98732858e5dfec84c3b327d3c8cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316882, "uuid": "956330b3-728d-4438-9922-70731f3a1c3a", "value": "C8E42343579385E8432229993BD281474FAA9318BD74907EB14BB3DDE760396B33FDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316882, "uuid": "e7bb0eaf-da58-4aac-bb80-703632164ff5", "value": "12288:popgyUN5mxnFIpOkOAsiV2bsvU6/M36XdV1VGQ+WJE+3ptMoAUA5MY1c21e:poZUN8xFI+AObsvUqt3VFc2tyD+ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316882, "uuid": "693b23a3-e28b-4b35-8a12-ff85b319f245", "value": 673954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316882, "uuid": "9db5faef-0fe2-4132-b122-d932b67b9b0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316882, "uuid": "65636f97-d166-41b7-85bc-b99d080f1b16", "value": "7dbe517b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77148117-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270137, "uuid": "09072369-d9f5-43ea-aab7-6ec3f03e1bf2", "comment": "Malware payload (Dridex)", "value": "993539f5021c45e49d55bb08d2f07004", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270137, "uuid": "ce1bf733-f27f-4967-b608-32d67c61824d", "comment": "Malware payload (Dridex)", "value": "4dc092f6957fd2dd09121c2207f10260767b03f246e46c48500d4938bc6f1edb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270137, "uuid": "9b467152-2412-4920-8038-2d76eed1324e", "comment": "Malware payload (Dridex)", "value": "5450e38d75ef659226fb25e082f58453e0064f39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270137, "uuid": "25e2efe6-c9ac-4ac0-8e5c-43d75eb2110b", "comment": "Malware payload (Dridex)", "value": "a6a820a2297850c3ea6627e764dff62ed023bfade97f26570d66e1db6c944446025b19ab685ca8b2f6a647880e244ba6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270137, "uuid": "7501d14c-db6a-47d5-9b40-76eb6b28d812", "value": "A3F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270137, "uuid": "420684dd-cabf-4393-8fc0-f2aa57a09419", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270137, "uuid": "5994a287-da65-462b-8500-a2e9c7a26b3c", "value": "3072:+B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:n4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270137, "uuid": "3994530d-de42-4816-8b0d-7312f53c9337", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270137, "uuid": "5dbd3d6a-3e94-4861-a6d5-8406bfaf2331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270137, "uuid": "d6e5a41c-7753-4342-8f3c-b658abccf9c4", "value": "993539f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f6e3e2-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339445, "uuid": "f5cf9634-673d-4bd9-ab60-c9673088d429", "comment": "Malware payload", "value": "aa87718d2ed8e5a6f4566ee96dc8d1fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339445, "uuid": "ef8d69e1-c87f-41f2-9f45-4764a98f8c2c", "comment": "Malware payload", "value": "4dc29eb929178a626080132ba5aee23aa6cb0b1a12ea691d037ae874e4525d21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339445, "uuid": "2538a356-62b4-4491-b179-2e8f3725ac46", "comment": "Malware payload", "value": "b0c6846a78ffa3b9532e63c783c6cccc6f2f3f1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339445, "uuid": "4fe4473b-2791-4acc-8a51-14ea7bec6480", "comment": "Malware payload", "value": "417338cb2d1566bd7624a071606bce326792caa3936dc1f9944d39c37dc574dae42dff4299e92b8d843e6ca01b58aa96", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339445, "uuid": "e7ba31fa-f396-4418-9e52-f13f453dd1d0", "value": "93F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339445, "uuid": "ee3264f7-cc9a-4d85-a45d-e89fe6f5080e", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339445, "uuid": "a2c4948e-75b2-4aa3-be1b-7e5f6af6c2c1", "value": "3072:xEG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idOJ:RERMVPG6+Y63HoG1QawL40Prx6K4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339445, "uuid": "52dee0ed-19ff-49bc-a198-ef7d528b31e0", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339445, "uuid": "3143df3b-1357-4261-8355-4a19094b7233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339445, "uuid": "5b6dedac-7ab2-4a3d-8d3a-c540280000d9", "value": "aa87718d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3014f2-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262844, "uuid": "b8d846e9-b4ad-4e25-80d9-4a3afebdcce0", "comment": "Malware payload (Dridex)", "value": "378270299798c3e7f45e3e91f2e9c18b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262844, "uuid": "ca4ae3b3-fbb9-4c02-a630-0b9318cb663f", "comment": "Malware payload (Dridex)", "value": "4def5bb73d7a045438a9cdf3de895c3662b074a80a7cb659e712dc811ec0f9d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262844, "uuid": "12cb5124-29bd-4fb1-871f-dd18b636f350", "comment": "Malware payload (Dridex)", "value": "7b8b9f87ee15218c629eba7bc78084924a2a993a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262844, "uuid": "f6445910-ba3e-44bf-910c-b5eb804dda57", "comment": "Malware payload (Dridex)", "value": "af4ad38b50dbd47aaaa6a4b2af1652a51c1ad10465d2474237734684d957f2dd48dc29549c5b659d178de3f73df0fbfb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262844, "uuid": "27e981e9-fc3d-4ace-9ac7-8d6c25c1aa08", "value": "A5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262844, "uuid": "f06e50d0-cb52-4dd7-8c11-195b78fd7684", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262844, "uuid": "45a9355e-a7d8-4401-9b4e-9901a87ab743", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262844, "uuid": "f2770e30-78c3-46da-8d57-80c85d3ad149", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262844, "uuid": "07ab2b17-817c-49ae-af4a-30a1f65f5205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262844, "uuid": "07a6eeab-40a0-4f44-98a2-6a28758458ec", "value": "37827029_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a1bef3-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338778, "uuid": "27ce4d87-921a-4f0b-be08-715df571b00c", "comment": "Malware payload", "value": "bea8a3dc3f8ebcc74e80e72ed6051047", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338778, "uuid": "12ff6e59-0a49-4e9d-9c0b-ff2730c44186", "comment": "Malware payload", "value": "4e2ea438f292ca4cb075cff6ac0ff921d17150d20ea39ca20186689d8ab8203d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338778, "uuid": "e24d748a-213f-48e5-b004-235bc6f21e5d", "comment": "Malware payload", "value": "dffd42ed023a9b42f4ebfe4f6c8296eff10ec6b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338778, "uuid": "0ae69da5-d9ca-4ca9-bf50-1f40da249de9", "comment": "Malware payload", "value": "57f46b0ce636f6ed6147a67cf73eb005859d198c967cfeabbdbc1f40b430cfa6d4a392933e0befd46cd2d991ea4b4eb9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338778, "uuid": "fb4ef0cc-3e22-406c-b5fa-a81a2e46e904", "value": "35F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338778, "uuid": "9a86ba16-8b26-4ce7-8e3e-ae2ccff48b8f", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338778, "uuid": "df79aeb5-a668-48ef-b8f8-8485ac4c7890", "value": "3072:siG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:UERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338778, "uuid": "aa3f595b-8676-4f52-a6df-58a1643d44dd", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338778, "uuid": "61208998-9da7-40f7-80e6-7bf875f22a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338778, "uuid": "6b179999-295a-4978-a2d6-54c9d624e55d", "value": "bea8a3dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0795041d-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331367, "uuid": "cb34b5f5-349a-4fee-8f55-54cf37581b73", "comment": "Malware payload", "value": "8e7e08e05c3b2ed5fd533fe154fbb2c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331367, "uuid": "91d3eedb-9417-4b57-8573-7a09fcc47da7", "comment": "Malware payload", "value": "4e48bb86b308e424bdcde8f29f8e68a337afe4eda2f7c34a0fc6c4047151071d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331367, "uuid": "7264c557-fe02-4a12-a49b-081e34d6ffe3", "comment": "Malware payload", "value": "f2dfeb444baaa7bc145c0f25aaea8fe475ce11f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331367, "uuid": "2f5e03e9-38cc-4b5d-a6ad-5c06eb56e70e", "comment": "Malware payload", "value": "4ae6d208a9745536ef0d2b22e830495f181ab024c9a1d5d08b218e7a6dd906276ba8af73172c66afacd4aeada944e555", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331367, "uuid": "06723413-de0e-4268-bc83-799d3faf2c90", "value": "8EF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331367, "uuid": "4c96b85c-9187-42a3-9d49-ad399f248697", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331367, "uuid": "f771db27-3f70-46f2-825b-653c28f7a52a", "value": "3072:zlG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idEl:AERMVPG6+Y63HoG1QawL40Prx6Kql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331367, "uuid": "0f7ddc10-380b-46bf-bb79-ddd844bd414c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331367, "uuid": "d2a8451e-d199-4115-ae06-e0a90910b66a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331367, "uuid": "fdc142cb-9aa9-4288-bcf7-945ea5f53e7e", "value": "8e7e08e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a2692a-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331275, "uuid": "48484af6-980c-403a-8bd4-f49ef6fb3331", "comment": "Malware payload (Dridex)", "value": "ac22407f9ae76ed2bac3ed04f82ca5f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331275, "uuid": "cc65f870-6b49-485f-be4f-0325b337db5c", "comment": "Malware payload (Dridex)", "value": "4e564092f51d69986fded82e1077bb6bea62cf63ff0e8b4b4d09b4a722afdacd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331275, "uuid": "812f80bb-fa02-401f-9956-8da61a6ea311", "comment": "Malware payload (Dridex)", "value": "90c0d6d54a19a4b1101a84ddb024f8f656cada22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331275, "uuid": "6b5f350d-6388-4bfd-8521-36b696e7dc7c", "comment": "Malware payload (Dridex)", "value": "58bbac35c9c18ddae6e447fa7e805acc8620f87652f3f552c4d5df40d29a937abfe49876ff94e94e9c37509e03268ac0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331275, "uuid": "8f15f5da-905a-48af-9885-e3f3c572affc", "value": "D4F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331275, "uuid": "51b2911a-d0c1-46a4-a589-df39369feac5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331275, "uuid": "0c0cb3bf-d102-49a2-a644-6c2ff20e81cc", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331275, "uuid": "934e06f4-b687-4acf-8e89-97748ef656f4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331275, "uuid": "7d3caf1b-6100-4dc9-8297-e11d42d0173f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331275, "uuid": "990686c2-cd15-46e6-a75a-2379a4f1b387", "value": "ac22407f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e15c58-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259340, "uuid": "195cbece-745e-410d-b25b-b6a9cffe2224", "comment": "Malware payload (Dridex)", "value": "52f56558e3e48812add35c6c9b66bff9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259340, "uuid": "1ec68a26-65cc-4b43-a803-84af66242808", "comment": "Malware payload (Dridex)", "value": "4e75b675994a2bd9e7f0c43a0bc2ca665cea997934b5d8f64734c509a564ad7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259340, "uuid": "4fd14252-224a-4d69-9749-818db4298568", "comment": "Malware payload (Dridex)", "value": "d219d97f0863326f8e78517479d73d60d8b8bd33", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259340, "uuid": "683494c4-7f26-48de-b731-f875867176d4", "comment": "Malware payload (Dridex)", "value": "69280e51419bb5afb9d860e5983edfb7cc26b13e67b602e51275c9b0f9f4b9b3c4c0b69b71b808fccfe7f320ac9deb40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259340, "uuid": "f0994e0e-68d3-4374-a19f-a2844a0a9a4b", "value": "55F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259340, "uuid": "b10a6412-336d-4ce5-80ad-0424ff03aad0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259340, "uuid": "1d495e0a-694f-44d6-b85f-3e9d47f27875", "value": "3072:me45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:b4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259340, "uuid": "46336cb1-6b2f-48de-b1bd-c720c44e5c8a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259340, "uuid": "3dd29521-381f-4dae-ac6e-e23e33253a00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259340, "uuid": "da7bb95e-db58-4c63-88c7-8c1c79893867", "value": "52f56558_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4bb7b4-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338895, "uuid": "1d88010a-841e-47a8-90e7-5e97df7bcd35", "comment": "Malware payload", "value": "83fedbc580b196c581769d02554e7efc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338895, "uuid": "c644b688-33af-441f-b201-5e97fcb25a2d", "comment": "Malware payload", "value": "4e8401a6fa9863f1af4632d48675b9e9affbec2c06862a65d03cb9deacd4f01b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338895, "uuid": "a84af25c-0b31-45dd-8bd1-c200ec416955", "comment": "Malware payload", "value": "8e65ef36ad215de7989630966a17235b1e33ae09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338895, "uuid": "824b9baf-9ada-4ce0-8be3-12001882a25a", "comment": "Malware payload", "value": "16440b02eae44f8222ce8004686cd303181b5564ba464312d68fed49dc9e2b061e6631dbe6c85a53bb488e757d828208", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338895, "uuid": "6e7e7d15-a9da-4dd8-9c62-952bfa695f12", "value": "18F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338895, "uuid": "5a38fd2e-958b-446c-82e8-46c1c0be38f7", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338895, "uuid": "285ec3f2-6aac-4057-b963-bddbf4a02732", "value": "3072:HLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:KERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338895, "uuid": "d64d1cbe-ac10-4270-b001-4ab062fb7972", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338895, "uuid": "9f32b585-e435-42d1-a4ba-1c119cbe6fbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338895, "uuid": "cba58f31-42cd-4e5b-aa8c-c6f71458a2b2", "value": "83fedbc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2ab02e-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338700, "uuid": "ab7a05c1-0475-4ecf-9831-6c0c77eb7523", "comment": "Malware payload", "value": "0a182086f7173379a1a2912015b11d6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338700, "uuid": "24f1ea29-15a3-48dd-8b4a-0ea47cacd239", "comment": "Malware payload", "value": "4eacbb1701088df7b189d65280aa0fcfbac468b3b2bf7838cddcddfa1266c5cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338700, "uuid": "1d62ffbf-d50e-4e3b-9221-e9e995fe4378", "comment": "Malware payload", "value": "9bb4017e46ca251527162d548fe67f65193eb22b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338700, "uuid": "94591fbb-d010-45c0-b108-a03b767a2587", "comment": "Malware payload", "value": "4d4ee1f055c27e8ef015a2ac7eb12f86f2a034be2346b5b5f6cc67ae2adfb520bb09226c9b3b094c803b0fa81ac378cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338700, "uuid": "c5a0f3cd-f603-496a-8ed4-c82105fdbb30", "value": "9DF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338700, "uuid": "49dcbdb6-69eb-4880-8665-dde0976a2e87", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338700, "uuid": "6e1a4eb4-9cd8-4968-a38c-4012e9621152", "value": "3072:oOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:IERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338700, "uuid": "52d535ee-6b64-4819-bdc6-46365ee1e5e9", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338700, "uuid": "97b4d2b0-4b03-46f1-8471-c6a5051ba516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338700, "uuid": "67b3123e-c612-4091-bfb8-e75d9b14d20e", "value": "0a182086_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e7acf6-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331334, "uuid": "a7387810-74a2-4800-8290-a21384acb27b", "comment": "Malware payload (Dridex)", "value": "64e1dbb985aab7cd25fcd98b7f1fe8f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331334, "uuid": "7b3e2ae5-3514-4db9-9f6a-5baeb2622922", "comment": "Malware payload (Dridex)", "value": "4ee40d500fe46fa6c4879aa4d814947211c6fe5ed5fce22eb28af8e09f225eff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331334, "uuid": "93c932c0-6e34-43f6-a3ff-e7abfd13f402", "comment": "Malware payload (Dridex)", "value": "7786e224ec23785f55958044e0b485bb8864ed7e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331334, "uuid": "c6c1ea27-b046-4b4c-b49f-01fa417c857b", "comment": "Malware payload (Dridex)", "value": "45b77126c16ed958b7626a8e68fdcb523166538a732d335fa2c8279deaadc052a11454f77af99d3cd81c2dc76681e1d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331334, "uuid": "f6757975-aa0c-47c8-b357-a5e4eeb3c75b", "value": "63F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331334, "uuid": "e2383018-8546-49ba-8534-29fb9db9fbeb", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331334, "uuid": "b0198e98-aad1-4b5e-a388-bdb0a65af121", "value": "3072:wplG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idEl:wyERMVPG6+Y63HoG1QawL40Prx6Kql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331334, "uuid": "49b9053e-ae90-4e13-88c5-b0ada94b3749", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331334, "uuid": "7217327e-701e-45a9-bc90-e729a115ef25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331334, "uuid": "414225fa-c823-4268-9ab7-8fc0f8d645f3", "value": "64e1dbb9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b414f52-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339131, "uuid": "9391b0ee-a5b9-4768-a454-28006dc1d41b", "comment": "Malware payload", "value": "ee84cc0a7277953393c2a7f53de858e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339131, "uuid": "21eca02e-7ef9-4299-9868-4d50e2044f5d", "comment": "Malware payload", "value": "4ee9db2fd0ab906b5c58fca8acb3fb0475a0bea49c2e623248102a9939363eaa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339131, "uuid": "4e600f7f-bcac-4b51-976e-4dd5f14ed75d", "comment": "Malware payload", "value": "00b342f1a912765f1d9688009645c59973522aee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339131, "uuid": "2105564c-ca54-47a4-ad11-0b89365b98e1", "comment": "Malware payload", "value": "f3ef0c0f3db1ecfeed7a2a0eac5363518ef07a1bc3702e23f7c10b5aa250eee18631094ee931d8e1992a5458cc8de0b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339131, "uuid": "a4139cfe-ebc8-471c-b5a3-e830054c1152", "value": "64F3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339131, "uuid": "66acd342-763d-417f-904e-3e0549f8d5e2", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339131, "uuid": "b0019db8-cc99-48aa-b817-6e834114f024", "value": "3072:4VG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:9ERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339131, "uuid": "71ea2414-0811-443e-b2a2-153e52369b3f", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339131, "uuid": "a351d45a-dbab-47d8-8acc-fc4ab0b43c04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339131, "uuid": "6fc9677a-2508-47b5-8f3e-3201d18027e9", "value": "ee84cc0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cde1873-ae8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620319995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319995, "uuid": "3cc43daa-fed6-4047-9a35-bbec2dbbf5cd", "comment": "Malware payload (Formbook)", "value": "678974f3319aa7cee37024a56cdcd1d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319995, "uuid": "ce35ce8e-f3c9-422b-83d2-70ce61e5eafb", "comment": "Malware payload (Formbook)", "value": "4efe3982ed0fe6a4190cc1acd45542605882230c659908caf3d06c600abc3dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319995, "uuid": "96d6d38c-e1a1-475e-a259-3430e4defed4", "comment": "Malware payload (Formbook)", "value": "5d06b650ab3085b7d5e1714751dc370484cac0f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319995, "uuid": "b3921053-9b90-4ebf-9129-e9fb271d5212", "comment": "Malware payload (Formbook)", "value": "5981745e8f01a100a87c62f04776a71ca2aed7f769fb45c88765bb1f1ff21035a4eaf30519c614ff606f67e8dabde51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319995, "uuid": "b3895e64-c81f-4282-a99f-2a0e08a4f52a", "value": "C2C405F7D31DC8D1DEA625F4620E8EA71A507F9FA4C462D859EDB13BC738161E4E0882", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319995, "uuid": "7da5b165-e524-4cb1-85e6-b40e3fffe1fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319995, "uuid": "f586ee61-deac-48ba-a484-afc37d83fd4f", "value": "6144:NrYSCdLVn/HfoXvXAa5EQJJf0QAP/O4RAAx3cKNiZgur4c40k4g7lzOUOWHK0UnT:SvV/wfwkDU+5AVmDr4A628K1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620319995, "uuid": "a8e41b19-7165-4961-aa51-b5c18d274176", "value": 555795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620319995, "uuid": "6202a2f5-9c97-4fd7-88f6-cbfed4277f3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319995, "uuid": "4cde609d-1b51-4d86-9265-885b8ffcdb55", "value": "678974f3319aa7cee37024a56cdcd1d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fccf75a-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339246, "uuid": "b31dd53f-59d9-45fc-bb84-407168339093", "comment": "Malware payload", "value": "52ae1d9ccb8606af629f519f672aef2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339246, "uuid": "cf6382a9-6ad5-4f7a-9aee-f370b6da1fd3", "comment": "Malware payload", "value": "4f7f63541876b53a3da00f30bfd2be7705779348e1098979630a1df5ad7e5720", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339246, "uuid": "704353fd-206a-40ca-a2be-e0d8badc5cb5", "comment": "Malware payload", "value": "3a5156cfd5f791eed087d0ce114cc88399e14a0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339246, "uuid": "dbad5be8-a7b5-4cda-9b68-709795506772", "comment": "Malware payload", "value": "ce18dc70d522da90b21db63c0b70fac3460ed7b0ef3e8af18f297bc7c2cd94a311592e4bdd21cc82945ba73def890fc3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339246, "uuid": "9e6088b3-e70c-4863-8db1-58fe67749f03", "value": "EBF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339246, "uuid": "9f4ee532-ad5a-45ca-be3c-b2d12f037c07", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339246, "uuid": "14f6d05c-68af-4dc9-be22-db12c4a52041", "value": "3072:+wG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idib:IERMVPG6+Y63HoG1QawL40Prx6Kgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339246, "uuid": "41ff74f0-0ec9-45ba-99e3-e5adfd4ec738", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339246, "uuid": "3a16edd6-2f68-4695-a989-817e399e1132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339246, "uuid": "fd78e3a3-1190-4ead-b4b0-e9f4a925eeec", "value": "52ae1d9c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9632714-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295266, "uuid": "782d4239-edda-4c83-86fd-000076f16fc5", "comment": "Malware payload (Dridex)", "value": "3d19278c6ee8de8996012e582a2052e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295266, "uuid": "5c266814-3a35-4222-9dd1-f01f50679966", "comment": "Malware payload (Dridex)", "value": "4f8948439712dbaa2a60b929786a1fa6e330c6cf50c9d3ad3ac1193bdad101ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295266, "uuid": "76ff6e79-52bd-4762-a141-ff2ca74044c7", "comment": "Malware payload (Dridex)", "value": "116c6c80a2a3be9ecd49c60643ae210da4deb5af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295266, "uuid": "2bcab08e-418c-4fca-a42e-8f1df2cd4500", "comment": "Malware payload (Dridex)", "value": "7848c48405da92620296f8abb4b49a213536223b7814dfbd2d6092fbad68d41c9951d856c4faaea66e606b5d5df8b9e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295266, "uuid": "ed120dd7-b3a7-4c0d-b5ed-97fe0f33175a", "value": "C9F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295266, "uuid": "9b761c8c-11af-4b5b-bc8c-d6d088b4e53f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295266, "uuid": "fb110435-6182-4f9b-829d-55bddc75aa63", "value": "3072:4B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:R4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295266, "uuid": "2fc66567-ab47-457f-a5ab-32f114df66f5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295266, "uuid": "c217809f-5c22-4618-bd62-741edba07b2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295266, "uuid": "107b6dea-1080-4ea7-bcd7-946fb9fd9509", "value": "3d19278c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94aac897-ae3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620286078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286078, "uuid": "c84d6c35-ecf1-41d1-b0b5-388226587c63", "comment": "Malware payload (Formbook)", "value": "0282fb6d3422cdebf88ba2d9ce0831af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286078, "uuid": "bea70cc2-fd33-4b3a-acef-dc8c89608959", "comment": "Malware payload (Formbook)", "value": "4fb3bfa3afd4fd027aff55a6cbbc8c3d92fb5dd84bca9d88ff893928a41b9a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286078, "uuid": "fd99490d-c912-4dc3-8892-539109afe13a", "comment": "Malware payload (Formbook)", "value": "f0c80f1d6ace27df947df38aae7b11ed4b6d7144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286078, "uuid": "c5cd8cad-9d0c-42b3-904c-bc2dc7d57e3b", "comment": "Malware payload (Formbook)", "value": "a6c17d40280bb10aab4879e8e8952d7524c632336d0193de549d2d8b9e3526a9766ca46686be44ac6fb55dc7aca98a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286078, "uuid": "f6c2b7a5-cd1f-4c2e-8413-286b1bcd02f2", "value": "E1F4235127283A6CEB7DDB759620438602F8B247D64ACB2E2F99712C3CD74861325BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286078, "uuid": "d885c3f5-e2b4-4019-be0b-fed499cb0da3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286078, "uuid": "063d1678-e1f0-443f-bd72-9e75e7372e3f", "value": "12288:kMwR0KK4DZin8ctCAj+Fv0qACXUc5PcwS8TaS10S4CGUS8Zt5T+FkQI7IP25U6M+:kK4VinxtCJ0qhSzG0S3GUSETbQI8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286078, "uuid": "627e05dc-6b4a-4a94-8aa5-3554b3fb64eb", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286078, "uuid": "1ae64522-52b5-49c3-94ef-4266bed70d03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286078, "uuid": "a4b5aa59-8c7c-4acb-b6d8-f3babc7f5eeb", "value": "0282fb6d3422cdebf88ba2d9ce0831af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41dd8642-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324164, "uuid": "ec22d79c-8687-4679-901a-a775e42b428e", "comment": "Malware payload (Dridex)", "value": "79a3f15bf9c8e1d7f5526007fe934a17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324164, "uuid": "60bdb147-654d-4f67-ab65-7bf0c158f3b2", "comment": "Malware payload (Dridex)", "value": "4fe4f272686fc29402d3e8129492758b43ada06e45471351fa5400a45dfc4123", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324164, "uuid": "01016417-e377-41f3-9be9-e2de17f1a6e9", "comment": "Malware payload (Dridex)", "value": "a465b804e31149a6fe5af2b3e1d140927da92d19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324164, "uuid": "4d5be24a-3a2e-465d-994e-4a4b73dd5f0e", "comment": "Malware payload (Dridex)", "value": "8cbe27bc71a9dd897e6dbd7b2f57dfcbcf21b6c26fd4965e8d4a6ce81087e41566bf8bba03a9ead2330d0344347a0e6f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324164, "uuid": "a8969ec5-04dd-4f1e-9e76-093fcd76aefe", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324164, "uuid": "2d85c6b9-3e82-4a9b-b8eb-b68d270e9b44", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324164, "uuid": "741a552b-2fdb-42a9-a564-ab1ba391926b", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324164, "uuid": "5a4a0c88-0dbb-411a-aa76-92574f972ded", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324164, "uuid": "1c3e1ec7-db5a-4d42-9fc5-665a34044c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324164, "uuid": "83a17746-6170-45da-b227-6b1b37b30fed", "value": "79a3f15b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f675dd0a-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284524, "uuid": "22ea3da4-7017-4645-8f53-3dd20f6c7cd4", "comment": "Malware payload (Dridex)", "value": "c1c94ceb22c1d90a1ea1b5b9bae66e69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284524, "uuid": "5a14444b-13cb-414c-bc74-cd4942f03717", "comment": "Malware payload (Dridex)", "value": "4fea27f09b5dc4ee38b28c546a4379113d642f5b81c5d319bfbc115edd9eef62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284524, "uuid": "9a2d3970-23b5-400e-afeb-e4206ed0a480", "comment": "Malware payload (Dridex)", "value": "57e45d0b1d8ec2a3c59900d7cc693b30a783fb96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284524, "uuid": "cafdfea5-f8f2-436c-8492-0883fa488b19", "comment": "Malware payload (Dridex)", "value": "d99f114b263735ef3b322bb5f091b68357a9769ab6e8092546973604bfd5113b03bd33b1a4e9b6195a873f380b48a0d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284524, "uuid": "a0bf7ebc-d877-4685-8604-c8eeb4e7c88c", "value": "DFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284524, "uuid": "03b1a30a-a769-4776-97e2-5bbb64ab2228", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284524, "uuid": "f47fda8a-4182-4bb8-93c6-5b9ed4b77ca5", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284524, "uuid": "81508a3a-fd76-4951-89d2-62dfcb0d1eae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284524, "uuid": "657faa61-b59a-46e3-ae09-dd069107d7e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284524, "uuid": "45d3ddb7-d412-4321-b504-58f814f43d9d", "value": "c1c94ceb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1742141e-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295316, "uuid": "34d4173e-e312-407a-8501-30d7186a4448", "comment": "Malware payload (Dridex)", "value": "d4812deffc090d54034b75651547c489", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295316, "uuid": "69061fbb-ba87-4fc9-9d60-58d579379310", "comment": "Malware payload (Dridex)", "value": "4ff997472f6efd472a348eafa2c27b88d1764f1bba064411494aca638f4e0260", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295316, "uuid": "99e5740e-c025-4f04-b582-3f89c3d9ea84", "comment": "Malware payload (Dridex)", "value": "d00bdaf6237477fc18f2f3fe6663b61dc21f80df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295316, "uuid": "52073355-a511-46e3-bfd5-13f6a17bd337", "comment": "Malware payload (Dridex)", "value": "edcf230abcbeb1daa7c4c145aea0926d4c288f0093223923c34058fc309ff114754e685965354c3091db79672d1fbd74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295316, "uuid": "30c6a152-8d8b-47b7-bbed-77bcdbba38e5", "value": "78F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295316, "uuid": "932c9e14-9205-4fba-a317-a964f7a92b0d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295316, "uuid": "64972fe9-375a-41c9-adfb-03804e80b742", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295316, "uuid": "132a3853-de81-4219-a5d6-1fd8703dfb9e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295316, "uuid": "7dcde562-be93-4bcc-a032-7ef7f06445ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295316, "uuid": "ff775413-a5de-4327-a677-0393c9ab7fb9", "value": "d4812def_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85f484b-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273682, "uuid": "4438a293-4ee2-4ff4-98f0-410c7f9e6efc", "comment": "Malware payload (Dridex)", "value": "065becc9d795ad2fb03cd0472fad9ea1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273682, "uuid": "ab64f511-1798-4485-9598-d960490a1eae", "comment": "Malware payload (Dridex)", "value": "5036a90c7633c8532a94c914dc88574c5bfcbb1c7af1af82843794562379f82c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273682, "uuid": "ccef28b5-7375-44da-be93-6b55d6ac207e", "comment": "Malware payload (Dridex)", "value": "c0cb3a75d116ab17f615310c358ef10a71ccf481", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273682, "uuid": "94047a60-7d2b-4152-b1cf-2742b2208b18", "comment": "Malware payload (Dridex)", "value": "ec6e06079d5c90154a441b1ce3d65df5dc7662df3b551570bab8f05b21c73dd2ccc3eb8221f1d9591ab8d4027d6e178e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273682, "uuid": "d0552186-dd62-4905-8812-c6183a82ff3f", "value": "FFF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273682, "uuid": "b9bd9ce3-6d41-4909-aa58-324fc80de04f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273682, "uuid": "503d0b45-9513-47f2-82af-68df607d4833", "value": "3072:+IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273682, "uuid": "1064599c-fae5-49c5-b920-c0cd457eda2e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273682, "uuid": "9d462e75-4b8d-465b-b8af-e79eb3608e44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273682, "uuid": "63ffa307-8abc-413b-80f3-6e8d07cfd668", "value": "065becc9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0eda49-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309769, "uuid": "984909c8-6111-437f-86ec-01808f1657cc", "comment": "Malware payload (Dridex)", "value": "5fc964c1ca6a2b225439eab25ae1d8f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309769, "uuid": "af9cad02-3565-47c6-8dd5-8b64967ac54b", "comment": "Malware payload (Dridex)", "value": "503b31ba6371ff8db7ea1cf22e9e1695980c67f2064281dd6ada3201db113027", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309769, "uuid": "b475926a-6797-4f7c-89aa-6023705d0dc3", "comment": "Malware payload (Dridex)", "value": "2f49c4f7d0101f03a3c68fe06b763610c55753a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309769, "uuid": "0a83b9a5-7abd-452d-9680-b948de3ed607", "comment": "Malware payload (Dridex)", "value": "287451ae04088b1ae3f48138381c7e786162b99c0038ff803112cea36cb631da506af8c15df3ff0340456c14deccdfd0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309769, "uuid": "24368a8b-ac91-45d8-8417-43b33152ba17", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309769, "uuid": "dd32a92e-ce35-4781-bb61-f7572d2dbd75", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309769, "uuid": "76af92f7-a059-4a49-ab82-77181ddf1a7a", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309769, "uuid": "c54b3614-b0fe-44d9-a97d-9f811bc9af0f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309769, "uuid": "5c652595-2b14-4f58-b95c-23daac03615f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309769, "uuid": "e8d17773-83c1-4f2c-9f7a-a6ca65d86dc3", "value": "5fc964c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03eb0920-ae39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284546, "uuid": "21288e91-3ee1-40a5-96bc-c016af89b5f3", "comment": "Malware payload (Dridex)", "value": "b9e3f05ef2b37a7fa7c43f3b3b6b8841", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284546, "uuid": "c91aa422-e251-4aec-9e41-c3d7d6f2d3e9", "comment": "Malware payload (Dridex)", "value": "5055fa35dd27b52de32ab8a4ccb1b91542a70dca42e167bb842bde9fd00a0d46", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284546, "uuid": "1831d2a5-75e1-4702-a1e1-4b4b1801c65b", "comment": "Malware payload (Dridex)", "value": "fe6912948f14a23f11177e5b1d976ef8e77e2052", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284546, "uuid": "4e114a20-1bb2-4ba3-b482-27420c942c41", "comment": "Malware payload (Dridex)", "value": "394cbff50a5c2764c96f84c22bd053f88922d057aff5045fc16330603a1fd3e2cbd27a86ee3609b19cdf2add4e1dd220", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284546, "uuid": "277453ef-d6d3-4541-b8a1-c9f00e066e3f", "value": "63F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284546, "uuid": "d9b8fb86-11e4-4d0a-8a97-1156fd6aac67", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284546, "uuid": "30bc5f2b-5020-4991-95d8-22e3a2c81773", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284546, "uuid": "65faa470-0644-4242-ad59-b29d89d3d088", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284546, "uuid": "fa4ae79e-497e-42ba-abaa-52e0767fcb41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284546, "uuid": "3e9b44ea-8a5f-4212-bf9b-c01b24ceb5ed", "value": "b9e3f05e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb4000a-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620310468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310468, "uuid": "2f4f4b0f-21b8-4db1-88b1-f4956b913d63", "comment": "Malware payload", "value": "31980c9b17f61c5f808cb882e41083af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310468, "uuid": "fc0e2b18-1424-45d2-a578-7a8f555e4155", "comment": "Malware payload", "value": "505af1e265238f48bd732ff8f9c4c0cec133cbbde31fd618e45d6524b19aed73", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310468, "uuid": "75f09e17-019c-48e6-aa51-a3cc7c0aae51", "comment": "Malware payload", "value": "bff8e3bfc7940b8f8e9249e091f3ddb944e6cff3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310468, "uuid": "fd919f17-d423-4333-afc8-3d8e2ae1ad0a", "comment": "Malware payload", "value": "58d960ccef5b4ca554d0955f438e3e7cb4ab05a85d4eb7d74dfc750cd7bee3ed370b10a1d8445c5c0bc784219508fc31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310468, "uuid": "34a83f1b-c726-438b-b31f-8afcf8666740", "value": "F2B47D38FB22D207F27D2370E2A79F28393A59D87264590B42B2AF2D3D7A3D57D15640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310468, "uuid": "a5757368-2f14-430e-b1c3-c1cf09804c5c", "value": "e6becf7802a396786410aa1dfb3fcbe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310468, "uuid": "60603e8a-56a4-4678-82be-76c654538f31", "value": "6144:EcW6U27GIvgzJR+OikTEbuAEK9ZZMXvUTAAsQ:fP5uRik8uW9DMXMjsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310468, "uuid": "34c5754e-d9eb-463a-8de2-519791bbdb59", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310468, "uuid": "11ea0278-4238-477f-9fcc-112feecb2184", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310468, "uuid": "16ae8f0c-4ca8-4794-ba67-e0aaf5b37544", "value": "scr(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2827e92-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339036, "uuid": "4f866775-6f18-4b28-8e4a-b52f6cc0f9ed", "comment": "Malware payload", "value": "dff4937273bb4adf4376dcda3aa52d27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339036, "uuid": "aec9951c-3285-455d-a3bc-1aeec75a0e3d", "comment": "Malware payload", "value": "508ab87370f9f7139623b18d469788cba1a52db982c5add82aa54a99f3f4a46a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339036, "uuid": "3e3bfc0f-8414-4970-ade1-2df1876725a1", "comment": "Malware payload", "value": "319c4ffcecb795303e2ee040bbca616bb473945b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339036, "uuid": "e4e2d6f6-b5bc-4fa5-b374-87da2eaff3d1", "comment": "Malware payload", "value": "4789702cfd129cc558ce8c73428d9540176279b42c953562b6646b91b54fd029caa3b79c271e1c78975b258dfc687a56", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339036, "uuid": "bc572af9-8df3-404b-ae6a-dabbbce7d65e", "value": "05F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339036, "uuid": "f564d4fa-919e-4958-ac44-1dc2fa47ac24", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339036, "uuid": "85aec9c8-3c79-4fbd-ac36-9975a2b29889", "value": "3072:6B45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:c4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339036, "uuid": "35c7f2ac-1fc3-4bdc-a014-7f59e665b650", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339036, "uuid": "c6a7173f-deb1-49ec-881b-00ff628167f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339036, "uuid": "0ad08221-f6ac-4bd5-9082-6e88a3d6f4a1", "value": "dff49372_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c877a65-aebd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620341469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620341469, "uuid": "fa6d1182-2d2e-42c2-9843-4ea87ce2d327", "comment": "Malware payload", "value": "b4ade44965a3a1f86cb1a3f277b3e49a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620341469, "uuid": "97b314bf-62ac-4f61-b7bf-3ece6c3b8f4b", "comment": "Malware payload", "value": "50903890fc8feea3bec7acfb504250b996fee1ee15b0a1c9902ccbec8baf6c1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620341469, "uuid": "14236118-88ed-439c-bc14-5751aae108a3", "comment": "Malware payload", "value": "e968b238beeb0eeae66f34d54643456a63be0b22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620341469, "uuid": "20bf4dab-640a-455f-a7ce-5bda2b0c8fb7", "comment": "Malware payload", "value": "0d609ab143bd23d888b390084e5a7d38e198af8adf13f16a3dcdacf84097218c2b8db131b889e1c50bdbf829db590499", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620341469, "uuid": "1170b7b3-63e7-4260-93b0-72d1a3d15d39", "value": "BDC21EE7B6D6AC45CE59037948A787A06717FC215BA7838B3389F7161FB1BC08903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620341469, "uuid": "2d126a3e-2226-4afb-b7aa-28b2501add5b", "value": "768:ePpRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ0Wp:irk3hbdlylKsgqopeJBWhZFGkE+cL2Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620341469, "uuid": "e6cbcebc-58f4-4f9e-93c5-947c9f489670", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620341469, "uuid": "e5377ca8-255e-4034-814a-872f9cc91bf4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620341469, "uuid": "b0d23dab-7842-428b-8e7b-f4e2d35fd13e", "value": "SecuriteInfo.com.Trojan.Malware.121218.susgen.29069.5786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a1ff9-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327648, "uuid": "421659aa-fe17-46f3-a9cb-63976180c8d2", "comment": "Malware payload (Dridex)", "value": "994c77538ec8d71a42c7bd1dad723924", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327648, "uuid": "7c985bb6-a216-4ee9-8028-95c630187c94", "comment": "Malware payload (Dridex)", "value": "509c5e88d956f0bd3efac48f59045f3c5e4f1e358bcc4d8d794c73d1f41a5593", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327648, "uuid": "1f15664c-8156-4d18-82fa-c9b715b41a38", "comment": "Malware payload (Dridex)", "value": "b571a575c2f483baf9fa2a5aabb9dd43b3130300", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327648, "uuid": "a5ba9a14-8ac2-4852-823f-c5c4107f8c80", "comment": "Malware payload (Dridex)", "value": "82dfc57d53bd1868b3a87ec88462c44b06829093c3e4f046de6072e4f43d3c61c5efe3abeb7a9d279c1a21ff3f885291", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327648, "uuid": "0ceb5ad4-1429-4d44-abd5-3cf2cbddea71", "value": "C3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327648, "uuid": "c20b1a0e-8de7-4296-88f6-46fc8c2f7be2", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327648, "uuid": "84ed969e-8bf5-4017-a64e-46915bfefc28", "value": "3072:eA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:e3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327648, "uuid": "a343e58a-5b6b-4d77-aebc-6a29f25956fa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327648, "uuid": "eba35166-fc54-497c-9a50-d27be3888a06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327648, "uuid": "5b51ee49-a418-485d-8f9c-87fa4865422a", "value": "994c7753_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7908e5-ae65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620303812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303812, "uuid": "21cd609d-a3fa-4980-9d74-7e66cc258c03", "comment": "Malware payload", "value": "3d3d87b9e90f3120de380be8411cffd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303812, "uuid": "634e6af7-8169-49ec-8483-d7480b54b8a9", "comment": "Malware payload", "value": "50ea078788cc95bb0d43243715721fe8a70e354f4b8eae9b9f27e6425c7e353f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303812, "uuid": "78cbaafb-794a-4246-a868-b2869809dc54", "comment": "Malware payload", "value": "673de5cd873e7a9af7078c9750c552f79c348dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303812, "uuid": "87777e1f-f19b-49e2-b4c1-fdfff2e92f6a", "comment": "Malware payload", "value": "b0200d1f13add8a52f620fc4be8d76a7eec2671a6647546bc03a15bdccd59ac91d642d56c3e6f85499b18876634551bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303812, "uuid": "5c8b6c26-7dfc-4850-9326-204683b143a5", "value": "3BC38C41F3E141F7E9E5053100A7666E9736A6389724A9F7C38C3E529913AC0AA3D3ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303812, "uuid": "04c2ac21-497e-4eb6-8614-2528e1278ccc", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303812, "uuid": "b6a37051-1e53-402b-9eae-4228a354e409", "value": "3072:27DhdC6kzWypvaQ0FxyNTBf5++wQXMmAIo:2BlkZvaF4NTBxVMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620303812, "uuid": "338518d9-7e59-4523-b3ca-7597526ab281", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620303812, "uuid": "27e3ffa0-f30b-46cf-8e41-669289c13244", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303812, "uuid": "31f8f931-3e7e-4e06-9244-cfec67a7c2b1", "value": "Internet Explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0dc7f3-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339349, "uuid": "9f69ca53-8498-499f-8fd2-85ee1792561b", "comment": "Malware payload", "value": "fa8c7dfd96ec4b65542f641b5da17ef5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339349, "uuid": "7cf304ef-6cb0-46d3-9bee-9124aa3435d4", "comment": "Malware payload", "value": "511464d2d047524850bcca24628f46cb5730b13db66a3658d00448b16c1306b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339349, "uuid": "b47ad2bc-cf25-477b-92f6-6871485b3896", "comment": "Malware payload", "value": "a4507880d4d78d65df2eafac217c0f0cc5a71f71", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339349, "uuid": "6fec5dde-062b-4200-936b-85959a54293b", "comment": "Malware payload", "value": "11e3d98d00cb30ae9e912d479dd739ea456e58dbda29e279aadfa2b185af3cd65593797718dc3e3cd8cc99bc08063825", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339349, "uuid": "6e60a622-a375-42fb-866d-0f010762cda7", "value": "9EF3E119C18FDD2CFE80E8768A9B7D1E361253C4DB15D989C0CAE93D12EB833BE49915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339349, "uuid": "6ab8a61e-3c3c-4696-9046-4222d292daca", "value": "28be32cdaea89fe5b9aa51049f1ef9fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339349, "uuid": "31b6fd7b-ac46-4e9a-b78e-c15e5407c368", "value": "3072:DaZGUO4UhdV+ul929CahrwJsDGlLB36cJzNLOYk8ePaNjNV64apsZdJdfRY:EGzXV+ulmw6DGlx/zlOYUP+NV64X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339349, "uuid": "d7c12c7a-e59c-44c1-95b5-a68f2483035e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339349, "uuid": "11f79c54-1a4e-4f78-b394-f5943a74d157", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339349, "uuid": "9a3ed9b8-260c-489e-9a71-2aa5e07b2c8c", "value": "fa8c7dfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdd7bbb-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277313, "uuid": "556edd42-555f-4081-bd60-e31838882631", "comment": "Malware payload (Dridex)", "value": "08f1129bc0bb9c01fdd05526d5be039b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277313, "uuid": "6cd0bea7-540b-43ff-a1fd-cc62d20d6ebc", "comment": "Malware payload (Dridex)", "value": "518556dcf3cecb6d5edeb609301326c491c88076aa115b015bcf9db7a7ee0f91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277313, "uuid": "2432544e-00b4-41d4-8964-0e9cb2152e0a", "comment": "Malware payload (Dridex)", "value": "d13352406db64cbeac53b975be06ff42311305a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277313, "uuid": "dca63d9e-331e-44a6-98a9-b3bc3e66e29a", "comment": "Malware payload (Dridex)", "value": "87904dd30a57943908e1aa2a86d21599ff476c351b2b051bfec49c88151ffba0dc38155b6d05515d9c13495a71d4d3b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277313, "uuid": "c6ff430a-500c-4841-987e-d55c1763c6b7", "value": "D7F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277313, "uuid": "6908125a-0626-4264-b40b-476f05325b03", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277313, "uuid": "ab421fd3-892d-457f-8b89-f0bd3a428004", "value": "3072:BA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:B3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277313, "uuid": "49b25524-2011-409b-bedc-509981fa1adf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277313, "uuid": "1003fa04-4463-4d75-9f7c-e2c1320a635b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277313, "uuid": "a9fb96da-15cb-4381-b0e1-fd349e8c4dac", "value": "08f1129b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd453d5e-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338571, "uuid": "377e2c9f-55e6-475a-b653-51a579234d67", "comment": "Malware payload", "value": "e0d555481de3842c2f4332cfedceaba3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338571, "uuid": "8e4fdd02-d337-449a-8613-93197dabc006", "comment": "Malware payload", "value": "5256f72911b5353d29f7b6236c7246a589c040d29f1ddc215acb5ac92c1c3446", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338571, "uuid": "2f55c86d-557b-4a66-b0ec-07bcf28033fd", "comment": "Malware payload", "value": "28fc59bbd1e27e8b272963acb1e1fd41cb8667f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338571, "uuid": "b724bbef-c639-48b1-a3f7-db8421f03302", "comment": "Malware payload", "value": "c273a780b6b52c9356ba979e44f4be08d1c64226374d34d39b4084998552fac1e3283805c4e70b5070083fa7624f72dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338571, "uuid": "33b32dee-7630-486f-8ad0-f032070f7010", "value": "C3F3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338571, "uuid": "4e8d402d-dfcd-4d32-9a71-2861c371eb78", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338571, "uuid": "45a2614a-4885-4541-b407-a27cbbd141c1", "value": "3072:ZjG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:AERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338571, "uuid": "f2e37d89-8403-449b-9b42-c6f67de4f310", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338571, "uuid": "5848ebcc-2726-4f23-9a66-0d0d42bdcaec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338571, "uuid": "bbf90d81-df56-4c60-8dd8-66e5b38695d8", "value": "e0d55548_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8050c2-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280938, "uuid": "21119f9d-e396-48cd-b918-26c5749c878f", "comment": "Malware payload (Dridex)", "value": "ce910c9e19853b2c98147a2ba9b97e03", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280938, "uuid": "48bac9e6-f11b-4ac7-b993-cc6aa83daa26", "comment": "Malware payload (Dridex)", "value": "529edadd5c5f8160737a3f92f4b47effb5285d6d368ef0fb71127e8a9dcb72c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280938, "uuid": "cb86122d-1b9b-48e4-b728-6b8d7d97b2d9", "comment": "Malware payload (Dridex)", "value": "ea7c8d8dcab8e786bba7a2de26b338234466b599", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280938, "uuid": "cdeaec0b-1a3c-4cf7-9592-8998507c9a2f", "comment": "Malware payload (Dridex)", "value": "aa0ff635778a9fe72af958942f89d0c080f7a03e295d997bff8d83afb8040fea0422728cce25dcf28c47724188aecdb5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280938, "uuid": "87aa4f1a-e892-4776-bfde-397180615a62", "value": "18F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280938, "uuid": "f8ae8c31-918b-48cd-bb2a-4dd0b4ee5af1", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280938, "uuid": "a2cffb71-5a6c-4cba-8eca-ad1b213fa784", "value": "3072:8B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:l4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280938, "uuid": "a117ee36-da04-4261-91c6-17eff608126b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280938, "uuid": "0607a62a-2902-4bd6-9100-86a6b8798ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280938, "uuid": "226bbf27-63d5-4af7-a2b3-057fc081fe46", "value": "ce910c9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b653b890-ae6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620307609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307609, "uuid": "5d6ef153-9a27-46b7-a80f-486a0e6c0be5", "comment": "Malware payload (Quakbot)", "value": "038d5ebbac4343a62694150daf23e9dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307609, "uuid": "b24cc3a2-735c-4400-a9a9-b557bc52eb77", "comment": "Malware payload (Quakbot)", "value": "52c0aee9b9ff77ba3579e080302ea115cf784a62d95bcd3892760ab91ea12679", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307609, "uuid": "f89daa61-0abc-4021-9923-daa001ef41cb", "comment": "Malware payload (Quakbot)", "value": "7f884b072695a23f0adff2c9333aec56a291a747", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307609, "uuid": "57611b55-cc37-43fa-a43c-b8264c6ac1cb", "comment": "Malware payload (Quakbot)", "value": "7c6376598029460fcdabf3cf796c3290507151c1cfd8bd5c850a5a44d1cbbe3364d68d4c29c3aaa7f062288b69708983", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307609, "uuid": "0177a3da-9952-4425-a5ff-ee4f4f91bead", "value": "A0B39C07CC095AC7C11E93FE6D075DF96E0E1719D8D22FEF40221F8A3A656631E4B1AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307609, "uuid": "05b70dc3-7037-4527-b464-7ee99d37ff7f", "value": "3072:tgQvKINbjvw548LMb/oqKO8NnS8+60Kc/A+:4AbT648LM7D98Np+ER+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620307609, "uuid": "2ac0dea2-70e7-4cd1-904c-d811f42e9d17", "value": 112057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620307609, "uuid": "d2eefa30-3ad9-4356-b076-5b5e41a3d5c3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307609, "uuid": "77230edf-3a5c-4ed4-9f24-1686838a3a59", "value": "Complaint-832793896-05062021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4455b812-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339200, "uuid": "a4ff1fec-8390-483f-908f-4305c2c2d17e", "comment": "Malware payload", "value": "bb50a2f431b59fd5ef9bf8ba32215d9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339200, "uuid": "490cce7c-6dfe-4429-babf-948221e9ae3b", "comment": "Malware payload", "value": "52d808cb6e15f8143425e2c789d7a1f048a0e6dfe979d3a9e1a27b993f6fbefb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339200, "uuid": "d9fe0975-da46-4d1c-a474-eb74d7f6fcdf", "comment": "Malware payload", "value": "89e15927fd84ab01ab3c3a23fe5b15336a2092e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339200, "uuid": "5ce93195-a822-4ca7-8a37-7583847a69c4", "comment": "Malware payload", "value": "a2d6235ae0eb11d9842b8ddf8e19bb1182d437fffb47c9edf5b6db8a65401201d4a4559b4e09beb95e5859c929ac56f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339200, "uuid": "ff71f8a8-de22-462f-8146-dff47829cbdc", "value": "87F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339200, "uuid": "9aa2fab5-6964-446e-b37b-2f36320f1043", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339200, "uuid": "b68f4a23-a27f-4e3c-b6d4-4a9f5a6ed0d2", "value": "3072:zhG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idKI:sERMVPG6+Y63HoG1QawL40Prx6KoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339200, "uuid": "60dc4b15-d2f6-4b9f-9b76-9d93e95b289c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339200, "uuid": "8c425063-298a-4abc-bf8a-74bde9e92245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339200, "uuid": "c0836dcd-78b5-43ef-87d9-968fb1f7b8c0", "value": "bb50a2f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fef508b-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262877, "uuid": "438c7cc1-b7ce-4b36-a787-c5ea93b4f3bb", "comment": "Malware payload (Dridex)", "value": "845242f6b6ce61c914bf265234724310", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262877, "uuid": "6ea7d9f9-1d0b-44bc-b11f-542e1a2d780b", "comment": "Malware payload (Dridex)", "value": "52e4988677f9409d1df6e0a546f9411fe4c39508c49f5bf47cf28488c7dafe05", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262877, "uuid": "2c58d020-53d4-4918-9911-83f08dd7c9fd", "comment": "Malware payload (Dridex)", "value": "a5ead53ce56b01212479a32b295a7a265688e2bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262877, "uuid": "f588b625-32d5-4417-b96a-36a51a5fdf8f", "comment": "Malware payload (Dridex)", "value": "8f9428706eda8a4167e89546285143b8a9ed027fe1c25ed69e5ba8ebbc383bd1c132d607d30c2dff69d617b8b8bbcdfd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262877, "uuid": "c1f950ac-9dad-4da0-b0d6-b8a54e4866b0", "value": "69F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262877, "uuid": "4db5fa0d-c630-470d-b1ac-cd14029cc806", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262877, "uuid": "29591350-97de-4c4a-9c2f-2727039ad067", "value": "3072:2lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:2lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262877, "uuid": "ece6725a-e97b-44a4-9a67-6be7d4ad318f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262877, "uuid": "c2e64dbb-c486-4bb1-ac8c-1d4b29bf11cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262877, "uuid": "0cee2086-3131-4dfc-a62a-45666fa29003", "value": "845242f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46868e5b-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285087, "uuid": "11f8de5d-c280-493f-988d-847673145ee4", "comment": "Malware payload (AgentTesla)", "value": "c851fa03860af2a5b1e6453334d4018f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285087, "uuid": "0139a648-e7de-4225-a030-3d9427a0bf97", "comment": "Malware payload (AgentTesla)", "value": "52e5bfc17c58835ce78566516223801a6c101ad1c13ff4b3b39aa96e4ad6d11f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285087, "uuid": "e12b4b26-1216-47ff-926e-cfe733390cf9", "comment": "Malware payload (AgentTesla)", "value": "f299f431e8b51de32153cce164cd091008f3bcbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285087, "uuid": "cca409a4-c6f3-427a-875c-98a5c7fa0ac4", "comment": "Malware payload (AgentTesla)", "value": "a11b74f3c028bb9c5e0e609e5d9084676f14196afaed0dcf67b49ac6b62994796673a5a38b4367b76926f421df6da73e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285087, "uuid": "9e5543a4-c667-466e-8242-e34b168db270", "value": "B8F46CBC755469F0E35B5E23A3CF0C0643651274A93BE90A8F6013FA1A57F173E3998A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285087, "uuid": "591d2258-7f72-4194-8073-e3c57d565a4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285087, "uuid": "51abfdc5-cbf4-4761-8368-c6ef0f91f365", "value": "12288:FooLLoS60/K7yh03SEYhN25BYiuMyyz7w3j1pf6WkbTN9lLjkywex0bUGicjC:FooLA3SFPiYiTyR3RpCWkbTN7Ljkex0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285087, "uuid": "62415113-28ae-4795-9bbc-536edb454b19", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285087, "uuid": "4a4f3924-2069-4d3d-8359-60d9e66abd20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285087, "uuid": "59ea470d-ef79-4830-9d78-e4f226768046", "value": "R321190593774502111113-05062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9690ae-ae2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620279330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279330, "uuid": "87dad3d2-e089-4704-a01a-bf87dda206fb", "comment": "Malware payload (AgentTesla)", "value": "f66d6a3bc255d5a9b12ad74baa7973b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279330, "uuid": "3a63c46a-9b51-431b-96ff-9a40f3f42014", "comment": "Malware payload (AgentTesla)", "value": "533324db5b3c14b6912167bffd9c956a24ca280a8ad88449da1b9da0bbfbb26b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279330, "uuid": "f1ee15a3-2924-47d3-a996-8caaa15f5dc3", "comment": "Malware payload (AgentTesla)", "value": "42506cfabaf34bcf9fa321217564c698db7bf41d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279330, "uuid": "d2778902-b3ee-489d-b772-707e368baa23", "comment": "Malware payload (AgentTesla)", "value": "fbac0ab15a9aa9f001327a58f322b63cd71e1252eb7e74254590e3995804d71717f7fa4daaf3b72542c93fa6190e7957", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279330, "uuid": "ce560516-d736-4961-b45b-aedbd772f968", "value": "7535AD2252988A24E17B637440A6C13947F67E13E276C75C6EE97CDB3F336C09A67213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279330, "uuid": "98193629-34c1-46d4-b118-de736d256201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279330, "uuid": "5b881079-f295-46f1-b4ce-f5d4e53b0047", "value": "12288:fWkOR5BInoQ8atUGUoi8Ky4z/+mBbB5qScLA2P0ZoPhm2xaikTvM:fSR5Fat3Uoia4z/+2HWs2P0Zso2xpkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279330, "uuid": "b78a9027-84ff-4419-8291-31aa89ddfe20", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279330, "uuid": "300f61bf-3d25-409f-8d5e-a63fe8dc9e6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279330, "uuid": "0f82f3c0-2c83-4b24-800f-fad6ab116723", "value": "26033710 HBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ccdcd6-ae6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620307445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307445, "uuid": "0124feb6-ec01-46da-a531-8827c977729d", "comment": "Malware payload (AgentTesla)", "value": "8c74891aa24f0efdd2d6132a3d8181cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307445, "uuid": "8123e478-b82c-414f-8af5-49aab3e31335", "comment": "Malware payload (AgentTesla)", "value": "53552c199d5a14b5efbf737f58d6ea1458837c09dd3401adc5f5a81e39d2c5b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307445, "uuid": "36be019d-6dde-4607-830c-0f9c377580bf", "comment": "Malware payload (AgentTesla)", "value": "f26cf91eab993261988b71c36e22ab9d926f8b32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307445, "uuid": "551d8bcb-4358-4c99-a647-7013d30af994", "comment": "Malware payload (AgentTesla)", "value": "d21560d74f6e0b2a21c17a9dc20c4609bcb6bfbfa056e43ea02854c16e7a44d32f23fc0286c79889b38549f8fe9b0f4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307445, "uuid": "64df5715-ac60-4e70-893d-ab4d687663ee", "value": "3E61F6398A7889A6CE5713F2D1B4FDA807D2F25353C90181336EAEB40B1B7244B269A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307445, "uuid": "06f917fe-d8dd-4424-9fbb-fcf521616239", "value": "48:c6QpI6yRnA99c6XrYjZDUwcjUSlXiQjSOeLfyRKVOS92PFznBcVC5sKPRSJ0+3+3:c6ZN1jbjUiQjLej2FznBcVG0nUZ2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620307445, "uuid": "453785e4-8b92-4d58-9904-4df88f70b795", "value": 3368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620307445, "uuid": "dbe163bf-3ac7-42a5-a805-deb0b2590e05", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307445, "uuid": "7ff53a80-02d5-4f50-857b-fcdf600396d8", "value": "PO_scancopyAlignright - Copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4420483d-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334905, "uuid": "bba0bcc7-3e0e-4f32-83cb-8ea23b8d2477", "comment": "Malware payload", "value": "e1f414bda2469a0b8d922cb2ce40c843", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334905, "uuid": "debd7552-a10f-42e6-aa1d-652afd10f4e0", "comment": "Malware payload", "value": "53c38a1efedec28a8706f46ad995d4206bea2f08c0a69624dc9aeaca92a50d77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334905, "uuid": "78e6b87a-52c1-46cc-ba11-cfe5ed6b91eb", "comment": "Malware payload", "value": "478dc6812c76e5c405335f2c2084fbdbf40fb7a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334905, "uuid": "9cab8259-bab0-4bb1-9e45-15386d83147e", "comment": "Malware payload", "value": "435ad7ed9062f4f272edd9b593f99d7b74aaeb50afd51667b247dca218aeef2ea1d59d492574c5f649a20687bf43ebe5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334905, "uuid": "5463d525-4ae3-448a-ac03-54e8ebf840f4", "value": "64F3D088CBB3E4E6EFB3937866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334905, "uuid": "13c2e5e8-4b80-46c0-b99d-bb7cc1880b7f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334905, "uuid": "daf957e3-f75a-494d-b1e8-2d716007c037", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334905, "uuid": "5bcd0c7b-44ef-4a11-b235-71aa46c9a578", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334905, "uuid": "c6c7f0a2-d7a5-4e82-b2cf-11a06a2a3aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334905, "uuid": "87016b0f-13fa-401b-b5d3-30108801dba4", "value": "e1f414bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b674c6-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288338, "uuid": "41eee3cc-f358-49dc-a78b-809a88a49932", "comment": "Malware payload (Dridex)", "value": "efaccb0a29931720abc81d839e0a0e34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288338, "uuid": "ed844d43-5847-4638-9659-3989a1ceb041", "comment": "Malware payload (Dridex)", "value": "53e504a7109640389b113c10fc173568872bfa5cc1ebe1d8ae7fb3e54af64f71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288338, "uuid": "018894b7-20df-4f9e-8739-cbcc7874f02e", "comment": "Malware payload (Dridex)", "value": "9a7f9c21b77a80f400d391ea9aa75d4cf0561cf1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288338, "uuid": "82764255-f31a-45ec-98f2-21f7fc46c58a", "comment": "Malware payload (Dridex)", "value": "afaca5c5b2981277c2d3d40ece539cd0330e121bcc51f50022d7b7c45140a29ac49a4810ab2b1b8888d20074bcffbdbc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288338, "uuid": "f811d056-4e8f-45dd-a682-dad519d898b5", "value": "4FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288338, "uuid": "974bb48f-5e1b-4691-962b-423767bf1a7c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288338, "uuid": "e95fc599-ebf8-4ab4-ad24-b59feba57869", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288338, "uuid": "dd97b886-512a-4e35-b61a-94881ce0c933", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288338, "uuid": "f4eff286-d31b-477d-b135-e16668c4f121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288338, "uuid": "4e8c9e87-a97b-4350-97bf-973ef2ee7e89", "value": "efaccb0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd2b6f2-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270091, "uuid": "85881724-34a3-4f88-b1a2-30d06f340109", "comment": "Malware payload (Dridex)", "value": "92c4961118a83b99b4bec3a391c43612", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270091, "uuid": "4ce67b58-d838-4eb5-8c24-4970ca84f017", "comment": "Malware payload (Dridex)", "value": "53efa53536578bd69d1f5d3f9d2c9819e1083f29cffd31fe913b625420ae0184", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270091, "uuid": "236645f2-1e6e-43cc-b191-07a65133bd30", "comment": "Malware payload (Dridex)", "value": "9378d6af764063acf7515e1d0c50cf568fc84e85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270091, "uuid": "3c651c7c-7755-45b6-b60d-171cd866e9fd", "comment": "Malware payload (Dridex)", "value": "132002e48cdf03fd8ac35376970978eaff875e4227e1630a1df197a380969ad5ce3984700a4b19f7a31d655c07dc9fd9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270091, "uuid": "2dba82ee-9cce-4644-b24e-4e07aa1ff6ac", "value": "77F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270091, "uuid": "c17a173c-4149-48f6-b214-d429973efe83", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270091, "uuid": "5c24c6fa-b261-4f33-a872-004bf3e2ff35", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270091, "uuid": "bee9edb7-4768-46d4-b559-7a131a24a9e9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270091, "uuid": "3ca6fa1c-48c0-46bd-be73-4502f43a8f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270091, "uuid": "1b3b0d5b-62cb-496c-b11b-ea9aea5368e0", "value": "92c49611_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03f094d-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339435, "uuid": "0183dbac-c7e8-4b8b-b3c3-a46a21827cfd", "comment": "Malware payload", "value": "ff38ace443832c6520d7574a2fae8b3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339435, "uuid": "f9f46b95-a1a2-4f7f-9434-11068f8d4a26", "comment": "Malware payload", "value": "540e72e43fabb939a42d0737e0dfeeedc68b5063327ea7be0dafe23379bf89cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339435, "uuid": "43bb7810-24c8-48cc-8ec2-493bdddaa387", "comment": "Malware payload", "value": "98c874d380d34084a4402e2dbf4111d0c5e18cfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339435, "uuid": "fbab4fb4-d3b4-48d3-ae84-9e4f1b72b17d", "comment": "Malware payload", "value": "a16d248471e8f346fff5277cc10a99507b31956c686e4e3bc7ee269f928d5567e2952a807f0115d98e9052150aeb7dbb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339435, "uuid": "b2d1c784-b5f5-4c35-bb0a-f4ac7d31566c", "value": "DDF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339435, "uuid": "b265b8b0-5764-444a-8761-306f5d50a213", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339435, "uuid": "494b89e3-cfe2-42a0-9d3d-b5fea326f52a", "value": "3072:iwG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idib:0ERMVPG6+Y63HoG1QawL40Prx6Kgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339435, "uuid": "cd14e572-1bd2-4647-b427-6218aacd830a", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339435, "uuid": "667116c7-428a-49d7-81ab-4a145a301795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339435, "uuid": "0f30bf2b-2754-4ea2-9d2d-c914fcaf63ae", "value": "ff38ace4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04193e95-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342099, "uuid": "95a5d1b7-1af4-449e-aa7e-41ebc3963305", "comment": "Malware payload", "value": "a3f192e282d91b37d6ae16d6de50906c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342099, "uuid": "2ec4c9c3-d352-4732-8a25-a1d0ac73b731", "comment": "Malware payload", "value": "54483ff26898be461c14b94dbe6ace94f080af73384b730af277f7ad6ae9d111", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342099, "uuid": "d733a02b-e5e9-46e2-b3be-88d25f101f55", "comment": "Malware payload", "value": "7e161a0c7518a1ef0cefba08128aa04ac5df6d22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342099, "uuid": "0fc6534f-89c6-430b-b448-2ecd28e88d34", "comment": "Malware payload", "value": "3e2c4cda8e0a131e145dbaddfb64a7809d8303619bc64e4ea2916027c41212efac7fe15d83a9821f3189753028c37db4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342099, "uuid": "8b952f20-7108-41c2-a671-1f164c0862af", "value": "E5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342099, "uuid": "a3719f5f-6d68-48b6-a2d1-f4636274a2a0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342099, "uuid": "67a2d4e1-3bdd-4296-9414-592e6212f064", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342099, "uuid": "d0f78fa3-cce1-4f0d-ac5b-3e2da49a206b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342099, "uuid": "28014d91-4678-447e-986f-8524cbf9567e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342099, "uuid": "3b1b598c-1ccc-4923-ade2-644b3449f3af", "value": "a3f192e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6366f434-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327656, "uuid": "029e5bb5-aac1-4ba0-92e0-947768c065b2", "comment": "Malware payload (Dridex)", "value": "0fcf2c5aed926157de348ab8f16d4a9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327656, "uuid": "df0f8e64-8830-4fef-bd5d-0d1465d44249", "comment": "Malware payload (Dridex)", "value": "5493f7ceaa22706f087a0073cdbba7dd22fd751629c969626682199bad750078", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327656, "uuid": "44ee6372-a11e-4ff9-9048-00dc88957ad2", "comment": "Malware payload (Dridex)", "value": "69f7a24e228023b1feb430e78f419500b2274e29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327656, "uuid": "90522530-8d5e-4380-82a0-db8e1fa80d4b", "comment": "Malware payload (Dridex)", "value": "f3b51ca47bc46c84bd36c8fea06af87a66ccdcb8029ed5f283701e39802adcc89447de18268b29103379cc83c91b17bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327656, "uuid": "e6169100-2b4d-435d-a71a-99461d416d3f", "value": "7AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327656, "uuid": "0393143e-8a4f-49ae-9f05-fbdfcee0fac6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327656, "uuid": "85582833-0969-4a4f-ad50-9805c9db4582", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327656, "uuid": "6c52c333-203b-4f39-a4aa-ade4d602196c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327656, "uuid": "029ef87b-425b-4ffb-b68b-829c4b6db4d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327656, "uuid": "fe74e280-befc-44d0-a5ce-070b0c8962a6", "value": "0fcf2c5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4acfcf0d-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285524, "uuid": "68b50007-f4d6-43c2-870b-f18e1ced21f7", "comment": "Malware payload (AgentTesla)", "value": "7bb7849507bf7e7130b1e747ccd285ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285524, "uuid": "a21bd54d-21dd-4d7a-a8b7-38a22b2d1b45", "comment": "Malware payload (AgentTesla)", "value": "5518cbb71e01049a79133666076e6b0358bb2713e1790ee8a459fb7b67f7d9b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285524, "uuid": "ba5c3a50-f8ff-469f-a514-ae0099415110", "comment": "Malware payload (AgentTesla)", "value": "7d53c60051770cbb8b012f7d60b47d26d1ff5406", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285524, "uuid": "0c4cfcd4-656c-4e67-9046-c0c5cafcd194", "comment": "Malware payload (AgentTesla)", "value": "2682171fb6cd7e31fa06dd0b979edca2cacdeb6ab719c4c840ca9c7134ac03ec666653f79c7b9f95249ab4a9346c2b99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285524, "uuid": "b3aecc3e-8434-4c57-9e84-4e98dde45baf", "value": "EA35AD2212589924E17B637444A6C13987F67E02E676C31CBAE87CDB3F73681DB5B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285524, "uuid": "ae81b034-17fd-4336-8021-7341c36593b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285524, "uuid": "a99c1a20-dd7e-4304-b1e5-463ec04a7ea5", "value": "12288:S/Ep4QgenoPMTdT/0hG8WWREG30sDMKCoqRvfTd6cO:+2EKyhG8WWRlMvfTd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285524, "uuid": "ac82d673-fce6-449d-a662-cb89768aa830", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285524, "uuid": "d3768977-4eb9-4453-bb40-5bc63f34d8d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285524, "uuid": "3b927a6c-d616-4e81-aecd-dcbe8940997d", "value": "PO#110090059-BH0124 REF#SCAN0217252 EXW HMM SO#GHE0080947.xlsx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ffa2d8-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339072, "uuid": "c4ac1784-3668-4839-a992-5454e80b8a93", "comment": "Malware payload", "value": "c7833879e445a4a889dc1b8edb8d7bd6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339072, "uuid": "d13b7d12-4db9-4608-8d1a-0b2ca810ae7b", "comment": "Malware payload", "value": "5556cfdf7f6b890e30ad87db5f0b2fc8975aa79af5eebd85c6263915ddfbd61c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339072, "uuid": "de9fa788-2142-40f5-8ed3-c99722f9f71d", "comment": "Malware payload", "value": "81aecffebaa9aed18ac526642c5f9602788c6a1e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339072, "uuid": "e1a2b246-a141-45e0-9ab7-2675c23e3146", "comment": "Malware payload", "value": "b50245cde225836dc84e7c85cc93a08c0629ede9249f4721f8b2d6aa9d6ba874bb3c04630e3c28cc2356dc829aa6740b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339072, "uuid": "697f7856-beb0-4e1a-8f2e-74ee4d53f246", "value": "40F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339072, "uuid": "9a7df9a9-5667-41c0-b93a-5e6ee098d4b7", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339072, "uuid": "ff7d88ef-14f1-484d-862d-383a98cc45be", "value": "3072:NEG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idOJ:dERMVPG6+Y63HoG1QawL40Prx6K4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339072, "uuid": "fd8105aa-3e1b-49f3-9c9e-c25f52e4e44b", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339072, "uuid": "8223afb6-e787-45cf-82a4-ba994cf3e594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339072, "uuid": "c447e236-6ca7-4366-a9c2-c27d380ae37e", "value": "c7833879_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be395fb9-aeb2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620336828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336828, "uuid": "e658fb0e-0394-4cac-bc71-62b02878d4d2", "comment": "Malware payload", "value": "533cb697938d37415621dc5f9bceb790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336828, "uuid": "82242ce3-0698-42f5-9d4a-83ad03cd65c7", "comment": "Malware payload", "value": "55723b0692a6a372b7e0b9c24a3339715271f39d9578daf62e84a657f72e69d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336828, "uuid": "7bdfdb95-238c-440f-8e3c-8e1462d501f5", "comment": "Malware payload", "value": "25203bdb68db9b44bafe3227683b9e574c73a203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336828, "uuid": "bf045f1f-269b-484e-ba4c-17c99914ec9c", "comment": "Malware payload", "value": "08602ad958e514fb73b418a3dcbc809e0cc388b4953e54583507507fc053d6443278bde9701ec4642e63006094dccd3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336828, "uuid": "68f95c86-12af-491e-8573-7b6355543baf", "value": "0645BF125148AE24E47F27368965C53993BABC13DA72C51E6CE87CDF7AB3B80D522307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336828, "uuid": "a3e868ee-961b-4d91-83ae-ad1ec007ae62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336828, "uuid": "06c8d6ba-7d06-4a20-aedc-25d857bdd815", "value": "12288:WD4Pgy1M2Apng7HKJURSop6xbXQPxxbg7PXDby2QoLpGhufT0MU:NVA4GUg/jQbgLq2QoLpGhiT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620336828, "uuid": "8d8c62f3-f495-44fb-83cb-dd6c7611c76f", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620336828, "uuid": "297daae8-607a-4aac-86c7-f822c7ed7ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336828, "uuid": "e50e7f4a-79bc-44e8-a23c-25943df83ff3", "value": "PurchaseOrder-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92ba1f7-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620310727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310727, "uuid": "5b472036-71fc-41c1-b924-4bc5850febde", "comment": "Malware payload (RemcosRAT)", "value": "390e87a9700a9d35c4042fb52cb59ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310727, "uuid": "cfcfa87b-3073-4467-9d26-ba9ab704da07", "comment": "Malware payload (RemcosRAT)", "value": "562d8f8c0557824cf0f95d646e61d38822ca8b661173f89c5b601cd1f4c4a824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310727, "uuid": "27950fd0-3370-4d55-b1d3-d6c9792f2cb0", "comment": "Malware payload (RemcosRAT)", "value": "b392394cd99600367d800a1565b35098a45d8fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310727, "uuid": "0156f7a2-6053-4c50-8902-337690f01090", "comment": "Malware payload (RemcosRAT)", "value": "816a0284f91839f1dbff09207fc312eaffe3c13786da2446d7bd923ff845962845462ffcff2308c68e3b4abe42765c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310727, "uuid": "67ef0f2e-023a-4bac-904c-54b3aaa0ee99", "value": "77C4B8D1F15088DAED6B09F2BD2BA53024D7BE9C54A4410C56ADBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310727, "uuid": "d3aa5232-d207-41fa-acc1-c89668919b95", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310727, "uuid": "d193a1e0-4af5-4d5d-adfb-75eebf8d10b1", "value": "6144:49X0GPop9ORETaiGpZdVuEW2P6fc/3ZFkZK+brbDNWtHzQ:O0LNTaikZrW+3ZF5+/3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310727, "uuid": "325cccac-6161-4fbe-969c-65e958d5b3f6", "value": 559312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310727, "uuid": "b3de9800-e2aa-446c-9f5c-fb69679e8ef4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310727, "uuid": "29b16729-7a26-4068-b204-8ed485e0dfa5", "value": "90800000900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2a05c0-ae14-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620268831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268831, "uuid": "f7cbed93-5d4c-43a0-b90b-d0d18736079d", "comment": "Malware payload (RemcosRAT)", "value": "3b36fe43f9384fcbdfe4e1072890dd97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268831, "uuid": "a770a454-4298-42a8-b5ca-a9df8a8cbb75", "comment": "Malware payload (RemcosRAT)", "value": "5644ffdefed81871ac28af49ae9bf45eee20fe6742da2b07f2c71badac020c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268831, "uuid": "c814647a-0f9b-47f2-906b-07959059c49f", "comment": "Malware payload (RemcosRAT)", "value": "6acaffd1dd94af1f93a625158a6cf96797363d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268831, "uuid": "d9de0d97-c554-4deb-b667-0806d9207986", "comment": "Malware payload (RemcosRAT)", "value": "18109e4a11c436b322af307c53281378cfa6660434a2e2189a32863493493101d6e003d2b279b3b6f89f20023a76db93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268831, "uuid": "db6a94ed-ef33-4eef-96bb-f3a801bc9edf", "value": "EEF5E70A65F5BABEF1E61A240F89E2671B0F77E46934F93C04C577CAC35511A8AE6330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268831, "uuid": "d4712dd5-4a73-46d1-a9c6-cf6d21a8f179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268831, "uuid": "007c423e-692a-4cba-b714-40c764657ff1", "value": "3072:xLGzBa8q0ZTfkTTSK69IXUIFtLLk4+6UUdZ:xLGzkg7yTh69tSdp5dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620268831, "uuid": "8f230036-df4f-4f65-b811-741a21f6cb4d", "value": 3455488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620268831, "uuid": "66b17fac-72fa-4cc1-a6cf-a8440515646c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268831, "uuid": "e538d73c-2516-4789-8c2f-7a1c3ea4ed17", "value": "Factura Serfinanza023854786775241209783648129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc41054-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620266765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266765, "uuid": "cec8539b-3c23-4520-acf7-7e146b82be12", "comment": "Malware payload (RemcosRAT)", "value": "d3125370ba418b71a02b9365db6929d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266765, "uuid": "7314bc27-3ce6-449c-b484-076cc3dc7c80", "comment": "Malware payload (RemcosRAT)", "value": "566f71be697a18778afe097f9461ef1fa7f6fbf0cf634995561e971814eae319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266765, "uuid": "5cc6c16a-7a4f-465a-939c-7f1fa58d66ea", "comment": "Malware payload (RemcosRAT)", "value": "6b8430a8b5bd8965bbac50feac7255d631d41f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266765, "uuid": "ac1ca547-0bf1-4b18-adf6-7ce36da93c43", "comment": "Malware payload (RemcosRAT)", "value": "a1dc67ee648beed7abc4db489847daf2e9f7aed555ae8dbfbb0bcb1fa4eac0dd7155929f21ba9cc0ea35c6bf840b0036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266765, "uuid": "74c0463b-3525-483d-b696-975489c58a5d", "value": "7BF50CA476F1C48E78F1BB545BD526C8004FEFF132302698BB2A9761573A9CB59E43B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266765, "uuid": "eb5117f0-421b-4b85-a485-9a66bba19c8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266765, "uuid": "6bf8c0a4-d55e-43d4-8637-ed2fa312e4ff", "value": "3072:1RqoWgaMoWNVGaZqCAjXylyUyea4bE1tU3ypi3SsdP5Wp53U3kEPgWycyT8Lni6c:1b7yTh69tSdp5dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266765, "uuid": "47ea8d77-bdcf-48cd-9bb7-d72affb55b1a", "value": 3420160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266765, "uuid": "79a4618f-ba78-40be-8d84-9dd9f88f7701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266765, "uuid": "893febbc-5960-4d9d-840d-71f3974b3b72", "value": "Factura Serfinanza038612482397383420891150743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1167b0d-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338578, "uuid": "28d6332d-61a6-4412-b3be-3b8076bdb48e", "comment": "Malware payload", "value": "9bbfdd41f2652f5fb9621434119998a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338578, "uuid": "67c86ad8-9f3e-41c0-8ea1-2ab94bb26c7c", "comment": "Malware payload", "value": "5686773a0e41210b112c46369c3290d4e4a9a24e80034117c838e5149e06f2c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338578, "uuid": "a8f39844-e3d3-42d0-a5a0-be533bf44d2c", "comment": "Malware payload", "value": "f737473a87d3fbee0813bf714113dfd6442362d3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338578, "uuid": "f30dae76-59b4-4705-933a-ff90563a8142", "comment": "Malware payload", "value": "58e5dc5632312970fe1366d249186cbd71733f25a153a371a631c5a982ae049601221ce462e9a68136ba096577bad019", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338578, "uuid": "756d1c3a-dd5c-433e-ac88-e30ffc170b0c", "value": "8EF3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338578, "uuid": "539d050f-27a8-4bd4-9da8-a68499a6c6f7", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338578, "uuid": "603d0c53-ae60-4dd7-918b-f87668ca3f8f", "value": "3072:wkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:+ERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338578, "uuid": "434b6e66-807f-4055-a9a5-0f08bb7a0f30", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338578, "uuid": "dcbc4b96-54b5-47ba-b3e4-612533339b48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338578, "uuid": "a63042ea-1023-4f5b-9490-3e1babce1486", "value": "9bbfdd41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e612e484-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331311, "uuid": "7a047c5a-5820-4d1b-aaa3-023fd0eedd67", "comment": "Malware payload", "value": "8afa877ebb03807cf472a056e41f9549", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331311, "uuid": "74e64c5e-aae1-4b42-8636-4cc7b1615dea", "comment": "Malware payload", "value": "568d3421f2d1b192c8650541e51ec80da47d751fc9ff393f71de2f2c5f8ee9a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331311, "uuid": "5e915cdc-8d0e-42a1-aa65-1c9d7d0564c0", "comment": "Malware payload", "value": "6946ae3b4ff6d8a14de4e2965c438d9bcb0c5fdc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331311, "uuid": "8a4ce7a6-c4eb-4c5a-a181-1b40e32f7633", "comment": "Malware payload", "value": "f09ca9f6ca24b57edbe8cc75b0db08b216d386ea97eccf7f3bc780bd50527ac3574c2a3635ddc45b00f48fbb09205077", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331311, "uuid": "03eb44c5-1b0a-4574-b45a-0f3074d29886", "value": "2FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331311, "uuid": "2ca08447-5c69-4548-b18c-91fb6e805c11", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331311, "uuid": "b44c64ad-f273-4b04-bb40-6f36eef27de2", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331311, "uuid": "c0cca2ce-e309-4c05-b3ff-ef6055464c7c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331311, "uuid": "1b854e4c-9757-47ac-8014-ee36721d8106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331311, "uuid": "28b438e8-c1f8-43fb-a695-c809be7b9fa5", "value": "8afa877e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6edcf6-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339211, "uuid": "f6f5a837-e8cc-4b00-a81d-b4fa7709b627", "comment": "Malware payload", "value": "b57d3ce4978ff386432d9854abcb184b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339211, "uuid": "35a5f63e-52dd-4c43-98a6-ff65fcf27663", "comment": "Malware payload", "value": "56c816894d3d330d4d3bf55c84137d784066d521db4ae947138e52291494197f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339211, "uuid": "da561b13-28c2-45e3-b1bc-68a1e382693b", "comment": "Malware payload", "value": "d3d45f216774023856f50883b30214602a236c6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339211, "uuid": "ad5cd351-0144-4da9-a6de-45cbbc0186fa", "comment": "Malware payload", "value": "ed2e645a1cadaed0f26cbc5f0e67a0d8d095a86d4058d3f6e5ed6f6a992650c3679ea4317a6679fbe102aa584611520a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339211, "uuid": "be68e816-d03f-4de1-842b-17e7c97d33ad", "value": "6BF3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339211, "uuid": "818c1e70-38f3-4af3-81b2-87c5bb8def60", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339211, "uuid": "f1b8e90b-9aeb-4385-abce-075723beeb8c", "value": "3072:zLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:mERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339211, "uuid": "85d7d4d4-62ab-40d1-8d29-5d6de0a73d31", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339211, "uuid": "bff3d3f3-aa5c-4754-be0d-23f2d0d74242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339211, "uuid": "c92c769d-d914-482e-bb1d-ae0db59f7c43", "value": "b57d3ce4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08543fba-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313330, "uuid": "f4223ed7-1ac0-45fd-9c27-685d5e2834f2", "comment": "Malware payload (Dridex)", "value": "efe104d279bd2684879f9024bf6591a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313330, "uuid": "1b8516d7-74b8-4b3c-af81-5786a74dfa7c", "comment": "Malware payload (Dridex)", "value": "56d55146f27ce2efd4e93ab19f5d5d8bf315a57b5f1b9d9ee7047307a58a507a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313330, "uuid": "c714c18f-bad4-4af5-a782-987a5544af65", "comment": "Malware payload (Dridex)", "value": "72e93ab0f1e31f25620168b4111f11fe2640e5da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313330, "uuid": "d8300313-9242-4958-a0af-b2aa00e1a7ed", "comment": "Malware payload (Dridex)", "value": "36151a1a727ac22d0a8f45663cd38e661eb489ca809f058397e18cbe0ae34894ca6f8750212c2911ebb9e5cfa743d8d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313330, "uuid": "6014268f-ac99-4d23-9390-e54842bfa996", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313330, "uuid": "e982b615-c874-4301-aced-b22b4c1572fb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313330, "uuid": "0eb588a8-c673-4963-9c1e-a87df0d78f46", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313330, "uuid": "6a4f974e-74bd-4d79-9298-2779941436fc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313330, "uuid": "8ef016e3-309b-46d6-b4c0-5d462273a4f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313330, "uuid": "53efc313-ad1a-4f1f-84ef-f21a8549da80", "value": "efe104d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28e558b-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338929, "uuid": "8d497e91-8887-4b80-891c-63b1d780edc9", "comment": "Malware payload", "value": "7abbf49ccb7b02e73ccb57505417e090", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338929, "uuid": "61d9252e-2352-4e05-a627-8efc818ead15", "comment": "Malware payload", "value": "56e1561c0f51229dc3fb04e4ce50630c91e44c188d239b399d40a81499649dad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338929, "uuid": "4a1a059c-d6b3-4eb4-8483-e4da0dcadec3", "comment": "Malware payload", "value": "b5cc66a91bd516e85765e9cc2734068a01fd8dc8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338929, "uuid": "8e45db0b-f22c-4356-9b3d-c75d0fc3eecf", "comment": "Malware payload", "value": "40f8c2ec504e5773107aa7f29c8fbfc4ace040f25335d54e8f5f81665c78f64749571ecbd694fdff6f133a195f6a0597", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338929, "uuid": "d3e2ac43-ba05-4f3b-87df-9849ec855441", "value": "E7F3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338929, "uuid": "79336d20-8437-461f-9b67-5f81cffafa26", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338929, "uuid": "e4ff2d20-4426-4f46-921d-121088955ba3", "value": "3072:TVG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:QERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338929, "uuid": "784a4ba0-6d19-4c6f-bcb5-661c4e059d4d", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338929, "uuid": "37b2aedf-78de-4ad5-b40a-61c3f65f58c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338929, "uuid": "91434b49-f6b5-46e1-ad6b-f5cfda562e6b", "value": "7abbf49c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2dcf99-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288080, "uuid": "133a6ab8-f103-432f-a9d6-45ed3ae38af1", "comment": "Malware payload (Dridex)", "value": "28f9fb4eaf4ac3d88498b91b3c7e4d66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288080, "uuid": "a13262c5-f851-4b81-8354-add5c1bf2d0b", "comment": "Malware payload (Dridex)", "value": "5733858de329ceb4074f4cdb654cc776d07ef58c23fcea20a7931ad0330382b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288080, "uuid": "add17645-64e1-4d86-bf7e-f57451f8d176", "comment": "Malware payload (Dridex)", "value": "a34583fd5c40d5d04164fae92d6e6fa8682ec589", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288080, "uuid": "3c31bd26-42a0-4500-bd63-4fce5fff9c56", "comment": "Malware payload (Dridex)", "value": "38aa63794085254a6031536f61699ac2e22a58b69b6d84e7e425d79413c6de5ce372fbd182eeb2a23c152379bc11c5f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288080, "uuid": "ed2d5c52-c2fd-4807-8be8-a19839631a79", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288080, "uuid": "03694aab-ca18-4034-a494-7ead44a8a3de", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288080, "uuid": "c68b43c6-329e-4149-8eef-fb0cf9d1d271", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288080, "uuid": "ff2a0ba9-9297-4d23-aa9a-1423e20220d1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288080, "uuid": "1069699c-9ccd-4020-9d0c-2611e964ea4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288080, "uuid": "5d45edf5-f954-43e1-a6ec-b18988599f60", "value": "28f9fb4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b9ab60-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320489, "uuid": "818c1660-8bff-4a6c-bf05-dc63da12ec33", "comment": "Malware payload (Dridex)", "value": "8f23d771a653079943a3b9f92d38ae3b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320489, "uuid": "bedd8271-3093-43d5-a877-eb5b2b450300", "comment": "Malware payload (Dridex)", "value": "574c55c4f286b7811f85c8bdd2e270b1522100c4c8a7bab7f50f3bb136fc3a83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320489, "uuid": "bc14457b-8d52-43e7-8dbf-a111ccb9668f", "comment": "Malware payload (Dridex)", "value": "88179b530c85f0cb6602e9ef0af3db1e7c6e07cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320489, "uuid": "1848e584-5271-410a-9465-bf5f936091e8", "comment": "Malware payload (Dridex)", "value": "3a18133a75832ad3c516e68b7d1cc737fe3276c12faa68ee265a4fb70515f3ca99c325e4020910b8f13cde33b38db5ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320489, "uuid": "2b73c8b8-c201-4f54-adca-bfa4848e8b4f", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320489, "uuid": "8aa5a83e-5c6b-4259-a8f4-2c866258b8ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320489, "uuid": "f6cf4a13-4ced-4706-a23e-8646a7966e35", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320489, "uuid": "8890ddec-0b89-4193-95b1-855ab9cdb307", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320489, "uuid": "f4f8d23f-1409-4c10-9fae-ffe5aa3ae8dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320489, "uuid": "85e4c58a-2b76-4405-8d5b-3b4c3687c535", "value": "8f23d771_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbb4a26-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620310037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310037, "uuid": "92adc9b5-a5ad-49a8-aad2-5440e3f6142d", "comment": "Malware payload (njrat)", "value": "0880d7c3264836b832c0b00fb263028a", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310037, "uuid": "fd2ab3b8-eaa6-48d2-b3c5-f5ec605e551a", "comment": "Malware payload (njrat)", "value": "586d1a857c5a8c41192992c4eb6cf61810e5d7289e761369ff2ac25f173d052d", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310037, "uuid": "e69332db-94e4-4fa0-876f-33e45dbb45b2", "comment": "Malware payload (njrat)", "value": "1a987e80013f3219f88d6a2f108e5ea599fffbd8", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310037, "uuid": "7b0178bf-e78d-47b3-a034-c5033320dd9f", "comment": "Malware payload (njrat)", "value": "1c5b1e1b252bc66e5158ce5831eb7f1bfabf6e18cc7c52ec15ffbc2ec71ddb3a8fd7dcc4773d14b9339601f5a9f17e45", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310037, "uuid": "f42f2aaf-2794-4359-92b8-4b46f6bd2a27", "value": "9F745BCE32979EC7C54408B5A593C13C03B3ED976272E3863C71779EDE612AA4B926C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310037, "uuid": "e54e9694-0815-4164-9bd5-47499dcfda66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310037, "uuid": "67ff85f7-191a-46ac-9272-38b451ce92a1", "value": "3072:YX+cFkdvMIqD02vu1i3OJramk4JEj3mL6aG0A3QcxA9eKJ/xr+VBFaI1YIYihee/:DrE3VWkoEG0gORKJZrMBgkSOG9iO2RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310037, "uuid": "6f2668fb-0b84-4279-ae73-0d671867ee7e", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310037, "uuid": "cd72db3f-c03b-4577-8809-fdf6509c5e00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310037, "uuid": "d5c21e3c-2b25-4283-912f-7ecec2dff15a", "value": "ahmad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d251a6c2-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284463, "uuid": "a2d1caab-22eb-41cc-a298-82c926e84c8b", "comment": "Malware payload (Dridex)", "value": "35d2d3933d71ff4ba704cf59aa2c9e9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284463, "uuid": "25ccdecf-f32f-4f31-abe6-0130a5e60d3b", "comment": "Malware payload (Dridex)", "value": "5893d61a44f034cf38bdafd9059b7beb1f2d75aca58b3271340815802e876947", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284463, "uuid": "8d09c143-6e67-4a5a-a6d2-39a81953052b", "comment": "Malware payload (Dridex)", "value": "1a7a081b9596a4b49b1b84a1ae0f7a8172a6947c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284463, "uuid": "da7b831c-afaf-4092-a1c9-bf41bd9351ff", "comment": "Malware payload (Dridex)", "value": "22c0120fc34b6d66de13e5ed09ce0acb75182c0acffa62477170b053ef953ca67eba4247f710640854f34b8f4a120524", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284463, "uuid": "2c821b38-ff47-4f72-bf06-32d57daf143e", "value": "C9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284463, "uuid": "d89a94f0-4089-4a70-a8bf-2429b9e17608", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284463, "uuid": "79c962ce-4142-432a-98b0-dad79b02c976", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284463, "uuid": "49b90aee-3ca0-4268-800b-4802b34af31b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284463, "uuid": "7a3118eb-925d-4e58-8bd9-9d91be111671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284463, "uuid": "655ba5e5-4e7b-49d3-bf03-37a34bdf02ca", "value": "35d2d393_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71158eb4-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316942, "uuid": "89b500bc-ba7a-43ae-82a9-9ac8a11821d9", "comment": "Malware payload (Dridex)", "value": "bd901a76b4fe72ef3ce4d9ffbec2ff1e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316942, "uuid": "864b9dd3-d6bf-4294-9f09-e6d5b63cf364", "comment": "Malware payload (Dridex)", "value": "58a085e0c9a57778c4fab205b68f53c3368b15f11d85a95cd4570952463fa86b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316942, "uuid": "574cf775-1c00-48ba-aed9-9d4e9885499d", "comment": "Malware payload (Dridex)", "value": "d227a2fb9ffc04609d4f5d82247f31de38e4473e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316942, "uuid": "eb880b64-627d-4771-b5a9-211d4ca494b6", "comment": "Malware payload (Dridex)", "value": "912bc0c33e5162d57fbeb9f9c606bb344a75f86f545ee977b4d22229136284a1d00eed240ba78fdf9ba7a8bee95091cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316942, "uuid": "55e9b7b6-f448-4538-b888-1949e5836426", "value": "69F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316942, "uuid": "89422ee1-7f51-4016-8333-82238df65255", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316942, "uuid": "8f6b174e-6697-4022-95dc-b301730d9b36", "value": "3072:Qe45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:V4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316942, "uuid": "eef3f94d-2d51-4f7e-b0a4-2f15e06c680a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316942, "uuid": "30112333-4743-4148-9e6a-b378970f6bb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316942, "uuid": "2c513695-c809-4706-a2fd-3716e4b1c848", "value": "bd901a76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a6dc53-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309784, "uuid": "c265c2d7-5655-489d-ab54-4551af49cd66", "comment": "Malware payload (Dridex)", "value": "78401ed6f4545924dd97be252679c17d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309784, "uuid": "75c7473f-4ee2-484a-92a1-563ff6ecd023", "comment": "Malware payload (Dridex)", "value": "58c895d1316e68593fd335132a078d4e6ffac714116db648ca73a5eef61a7d2e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309784, "uuid": "ecf84bd0-7205-4293-8710-9998cc5f2c71", "comment": "Malware payload (Dridex)", "value": "6d69e9202b486da3a310d1a2cf8e78cfacc835dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309784, "uuid": "a834d20a-fd2f-43c6-b511-500d9af994a2", "comment": "Malware payload (Dridex)", "value": "ef6c936d3f4e7fbea9f66ef1d1fa3268eb8381b0152ecb89bed25d5f9aa4bdfc4a6b45d884ed67f4433462c26cc9d9f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309784, "uuid": "256c7f78-8755-4a4a-88fe-ad1493c30700", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309784, "uuid": "ad6f3db1-d183-44d7-9551-7020cf8661d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309784, "uuid": "f1b28fd8-e602-47db-bdf3-119843c5a2b6", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309784, "uuid": "4b6a9f52-8a9f-453e-8a84-5fa8a6f1d260", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309784, "uuid": "b249f762-bb76-4d98-a753-723f8174d0e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309784, "uuid": "4962610a-8837-4393-82bb-7ead1dd53c0b", "value": "78401ed6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18489248-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338697, "uuid": "098ea00f-61c0-492e-934d-f1872cb1ab81", "comment": "Malware payload", "value": "8c9df08c500986243c054b598496443d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338697, "uuid": "3aa46083-aef2-4975-8868-ed6ed4d6ba10", "comment": "Malware payload", "value": "59b76067cdcdd75a25ffecf2f4f688d21971b0c742ea2b2e432c994e15bde514", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338697, "uuid": "2a195c99-cf04-4254-871f-595837249177", "comment": "Malware payload", "value": "7230bb2e9fbd5a1c824cb1a47b0a891d6e3d04b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338697, "uuid": "66f1744b-4a7e-4e99-90aa-b3c82c008480", "comment": "Malware payload", "value": "41d985a56770ef4e71592dfd83156edc09bdde4ac16326336274a8b2413b5238d3420ef306731387d591eecebed3497a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338697, "uuid": "03e3e92d-75d2-4551-91ec-317f93d07f68", "value": "36F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338697, "uuid": "355a073b-d426-4625-a008-4618564ec593", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338697, "uuid": "c8338e24-319c-481a-b908-9b298ba685fa", "value": "3072:POG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:9ERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338697, "uuid": "fb2a9674-0819-4954-b753-e986d2782e81", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338697, "uuid": "b83785f1-c654-4ea2-a203-ddac24c59493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338697, "uuid": "9a873227-fa13-4a64-84bb-81d903704107", "value": "8c9df08c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c6bc6f-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302477, "uuid": "55c9c506-81c0-46a7-9024-127f8930220e", "comment": "Malware payload (Dridex)", "value": "c46bd0aec3e9ffa28d62952e09f84d88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302477, "uuid": "bfebb128-af75-48fe-9cd1-8a185bc51800", "comment": "Malware payload (Dridex)", "value": "59d2d04d575ffb3b8c1973716a988e0fb5bb9cd1c177ced441ad19a5bec2b9e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302477, "uuid": "88a46494-b5e3-4fc7-9aaa-b948af2f4649", "comment": "Malware payload (Dridex)", "value": "c82e1e4be170332a6e82ac50867046ff4f35da90", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302477, "uuid": "5cef2bff-cebf-4e26-9ffd-c26681c653fa", "comment": "Malware payload (Dridex)", "value": "b66177d72deef71054b7a27b44364d4b04ae8f3500c25bf8987b47ebd38481d5263ac9e719c61a0ded90aafb96a87167", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302477, "uuid": "baac056e-9ab0-4588-99dd-506928b4295e", "value": "1EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302477, "uuid": "5c6099c7-1ecc-4d5a-b610-fa5e32015681", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302477, "uuid": "2d55bc16-27fc-49fd-aafb-3fc80582aa6a", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302477, "uuid": "ff3c5ba5-77bf-4f0b-8a35-78dc7f36a13a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302477, "uuid": "0c8ffa8c-5e80-4232-a543-fbef47d51696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302477, "uuid": "b673ad7d-3d36-4bba-af31-9f8ff3d81dac", "value": "c46bd0ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96f9683-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262920, "uuid": "a7d81aa4-75a0-4ddf-b530-15f37589b6dc", "comment": "Malware payload (Dridex)", "value": "d96a75259a6deb27481aeef02a2825b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262920, "uuid": "0d569e08-9cf3-494b-bf12-08c33da6df6a", "comment": "Malware payload (Dridex)", "value": "5a1ca1593c09403c191606aaf400060810d803a509115077727ecab6cf655b34", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262920, "uuid": "0c8c1dbe-17d4-46d0-8e51-656e178e66ca", "comment": "Malware payload (Dridex)", "value": "57429fe67b908a7173971444a0cece09affb90ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262920, "uuid": "bbd2781e-2bce-482e-b383-c76661e265db", "comment": "Malware payload (Dridex)", "value": "a9ddbb742a7f71e6ff80eeabcd057f73ea17555fd1ea16decd91e6d40a2fc2c11f0bce2bb4fc636c94fe00b8e308a81f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262920, "uuid": "9bfe574e-3fab-43c5-99f5-5ab4cf5a0054", "value": "80F3C085DBABE87FC44A35399471DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262920, "uuid": "ecdf8818-8a8d-4763-8e17-d2b76f902ba0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262920, "uuid": "f7b33349-efaa-4250-8147-cc629792f3ad", "value": "3072:ee45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:D4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262920, "uuid": "de4c7390-3f42-4b9e-ba37-50dfff76e80e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262920, "uuid": "b3ba192c-1841-4018-90cc-c7cb374581f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262920, "uuid": "e8cc4025-2854-4fce-b724-db7b3b1fc672", "value": "d96a7525_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732cc39a-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270130, "uuid": "2f03bdf5-e35c-46e1-b5d2-51eab9a626b5", "comment": "Malware payload (Dridex)", "value": "3895ddd59be6f18811db4f17a35e8daf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270130, "uuid": "dbb77754-e368-4718-9b0a-355c89e4feed", "comment": "Malware payload (Dridex)", "value": "5a25f3e86878b617b9c561a826cf36d79012a8b5c47dd8b81c7629ebe8233944", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270130, "uuid": "d7de14c0-7ce6-433a-8f47-a93943f8e640", "comment": "Malware payload (Dridex)", "value": "079a332129cfab0126fa1af57ed8b740a08ffd63", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270130, "uuid": "18a97c8d-13a7-4381-8c97-f492cb60faca", "comment": "Malware payload (Dridex)", "value": "cff8bd0c7c893159d095af325eacf25bdc27412c7d88e9406b3a391722e0c4911747f07770649441c38e6f6e788e0bf4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270130, "uuid": "eb097ee8-e039-4267-af66-53527ef8b39e", "value": "8AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270130, "uuid": "3827eef1-65b9-4d16-8194-c532c5de0744", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270130, "uuid": "be234702-c08d-4803-818d-26155757264e", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270130, "uuid": "82483e85-dc4d-4899-9e67-c09879f3ea31", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270130, "uuid": "f67628b1-71fc-4afb-8669-63fd2bbda176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270130, "uuid": "cdd05349-5f6b-4593-930e-1c57ed395032", "value": "3895ddd5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912219d7-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262879, "uuid": "2638c2cb-cd17-4db2-9aa2-f62247017836", "comment": "Malware payload (Dridex)", "value": "92a0a0cd6534f21e44526e36c93f1486", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262879, "uuid": "72b87cea-968a-424d-b11f-99612d1a3c09", "comment": "Malware payload (Dridex)", "value": "5a40b6bdc41d81988669336106b196d5bef5788274f6d56721beccc239c13c9d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262879, "uuid": "6a0c75a7-ab7c-4671-ae0b-71ba64d06d2c", "comment": "Malware payload (Dridex)", "value": "ecbdaab378680c8e473db26037413d909fb0267f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262879, "uuid": "85262178-8e13-401d-802e-44708cce3eee", "comment": "Malware payload (Dridex)", "value": "5373695863fa3829957c5832cfe117357bde6e7e4b3340c85eac5a13f2655205465f3f7713512e7d68b6b6f8a94128b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262879, "uuid": "a0dfa63b-cdfc-41c1-90e0-e8f2f889ac4f", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262879, "uuid": "a9e3f895-cace-4d3f-96b8-a76e910dc069", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262879, "uuid": "c4e0dc21-f22c-4c35-b82a-ee8db42b51b5", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262879, "uuid": "7463359e-192d-4c6e-8226-bf294207883c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262879, "uuid": "a23645f9-6b49-4016-a6b3-5164f59f56aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262879, "uuid": "ce35c58c-08c1-43a9-8561-0ff3912da1d0", "value": "92a0a0cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b183f0f9-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262933, "uuid": "6c44d85a-b13f-4037-a968-a032db4d8fd0", "comment": "Malware payload (Dridex)", "value": "bd8dd84c02a58bb3679244659d1d8f9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262933, "uuid": "87cdb884-f5fc-493d-a92c-fcca1245400c", "comment": "Malware payload (Dridex)", "value": "5a41b1f60d42400478024e34a991795c6b78b2e1b22443d8cb72cfd2c22ac59e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262933, "uuid": "8d4ec491-ae60-4939-a088-7447cd1a7edb", "comment": "Malware payload (Dridex)", "value": "610f59328ca8cdd9603cd01b5dbdfd319826ec0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262933, "uuid": "bc4e1572-ed89-486b-b390-59787bcc59d1", "comment": "Malware payload (Dridex)", "value": "c0e363a719e4e0fa055ba775705762704ac703ac8fe284403d6bc46d43ed946d2fec1983717e22c3f896a9ea67604d0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262933, "uuid": "652f5cd5-3f1c-4b97-a930-4ec1fabea7ec", "value": "8CF3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262933, "uuid": "1ebe4900-f348-4901-8b67-98dc8fa4d1d3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262933, "uuid": "65b3e078-d8ff-4b67-bb65-bdab5ba93f07", "value": "3072:mB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:/4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262933, "uuid": "4a28c98c-489e-46c1-9117-8a07588ba1bb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262933, "uuid": "1c947976-f769-46b8-ac0b-a2cfc90d2308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262933, "uuid": "eceda6ae-f165-4e0a-a366-9fcf3fc09472", "value": "bd8dd84c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8cbcb9-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339432, "uuid": "55fb9f7e-449e-45ae-b891-c31d917c497c", "comment": "Malware payload", "value": "88df6dfc9d12a27b14db00085d46ce90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339432, "uuid": "dc90c451-7ada-4b1e-bb66-37afe6142a17", "comment": "Malware payload", "value": "5a5da34342c96f2894328ea398fbc66544df595435bab5114df5262531c772dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339432, "uuid": "3b707b98-9e6c-4fb0-afb7-a38c674aba43", "comment": "Malware payload", "value": "7c086e27677f2a938993f6f43638b61a1661f09a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339432, "uuid": "04aa3071-270d-4462-8599-2f012ca489b2", "comment": "Malware payload", "value": "21b811e48470824a605c29423525bac1e472b7cb56766a45a705725293f4d65032f2dae223fd70b9043b21223ff61f8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339432, "uuid": "73708ad1-4883-43fb-bc26-a600dac9ca91", "value": "9BF3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339432, "uuid": "282fb518-d073-49c8-a98a-c047484f5d4e", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339432, "uuid": "59a79762-a5f2-48de-98d6-22b4cf6f8b4c", "value": "3072:xkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:ZERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339432, "uuid": "c6dd453c-3f52-46e3-b57c-8830efe46a26", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339432, "uuid": "47ba1ed2-1b20-4df7-baad-3d6de31949a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339432, "uuid": "05e165e6-a598-4cd3-b802-836186e73a48", "value": "88df6dfc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e7c50e-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338827, "uuid": "ac0f4433-f44c-4453-8ba7-22962d045640", "comment": "Malware payload", "value": "6aab2f1df15caeb31d9c5f9fd74531d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338827, "uuid": "14c33007-cff5-44e1-85a9-9049e6a3c809", "comment": "Malware payload", "value": "5a759d8582113f7f424258af27a8b2c5c8c533edd098d613346f10801530b3f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338827, "uuid": "19e7ab63-d3ba-46c6-b4c5-801ecf46a860", "comment": "Malware payload", "value": "606a4748e66cd39b6d6bf4dc4acd3e021d0e4bb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338827, "uuid": "cf865bad-96bf-489a-b5d4-84b1a9fc44be", "comment": "Malware payload", "value": "3a9f730e5cc21cb42382229fa29a4509d841d4c3eb23b196dcd2b5458e4834aa5abb30b785b044e040cd4f9bac306488", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338827, "uuid": "52d55d7b-e892-4cf3-b4ab-086766c7ee65", "value": "D4F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338827, "uuid": "787be59f-27de-4351-be23-169e9540e64c", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338827, "uuid": "655cc6c2-665d-4984-b6bb-e0b0fbd704fd", "value": "3072:XkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:bERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338827, "uuid": "407f885b-ac4f-4a21-afcf-9dff78b1031e", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338827, "uuid": "c6e208d4-4de8-47aa-b02c-e4f41a4e95d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338827, "uuid": "e3046c58-84c0-4dce-a25c-276d8029bb4d", "value": "6aab2f1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb38034-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331270, "uuid": "81914e8d-4c49-415b-8624-8ca605e40d92", "comment": "Malware payload", "value": "d481854604d6b4e5d3f41b3bb9e0dadc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331270, "uuid": "083035b3-fd72-4494-a14d-82706cb24952", "comment": "Malware payload", "value": "5a82a4987365faf0212bb7cc22a5a9da41988286427080ce583ce6fe8bb0b236", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331270, "uuid": "b539e4f2-0edd-4882-ae5d-9b3343e998ca", "comment": "Malware payload", "value": "c04a0eb0c50dfb44e48c30445236ce3e7162a41e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331270, "uuid": "75aa7152-ed6d-4336-872d-494613600f18", "comment": "Malware payload", "value": "c589caae2add170fdba8ca6be7c6a1bf9d06651b950cf352b6ae836e9058cdd3d1718bf5afadc2cfe6a96496fd9d65c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331270, "uuid": "d5942125-45ca-4637-a908-d0eeb6ad116f", "value": "E3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331270, "uuid": "5ae05fc8-a05c-458d-9bf2-c8e8690f66f5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331270, "uuid": "20851220-eb8b-463f-894a-98c6e1ceed4c", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331270, "uuid": "c4d78f07-6376-4774-8f64-966f9ef6ef1f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331270, "uuid": "cb1fb143-7703-4b0e-83e1-db73fedeb21a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331270, "uuid": "231fd871-f8ae-4010-a4b7-426f5d51f0a2", "value": "d4818546_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c18521-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306111, "uuid": "170ff6dc-b863-4e90-bb31-128a646b6294", "comment": "Malware payload (Dridex)", "value": "0819ca59fd194337b974023c7eb50e14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306111, "uuid": "8b7a5a04-68dd-446a-a0cb-f75cb42e6a07", "comment": "Malware payload (Dridex)", "value": "5a89162f24c4d1b333a0c04d0829a5c80fa42ca44a564bb3fe157ae784a6fcb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306111, "uuid": "cbcc2289-be72-479c-8243-3edc54cb52a3", "comment": "Malware payload (Dridex)", "value": "998a7fe3d68dadb88ca6f39c009a280f747f65aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306111, "uuid": "135f992d-54bb-4c05-becd-4d72aea626dd", "comment": "Malware payload (Dridex)", "value": "1a15c95aa624cd511e57d9744c13c893d3ec5de9cd1d3b64d4ad3c8347c932592794e05c2d9a4e99077703f810272161", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306111, "uuid": "ff5f0713-6d2e-41d8-b095-9dd97f071b2a", "value": "93F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306111, "uuid": "08540f2f-ebce-43b3-b4d9-07c2b5b3d3cf", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306111, "uuid": "cb6b9425-c89e-433f-97d9-1da1199b3201", "value": "3072:fiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:UeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306111, "uuid": "b4c57390-1745-4b0e-b846-b0ff5cc4b9aa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306111, "uuid": "45f90651-cf5d-4e16-8acc-e4b1ae4c96ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306111, "uuid": "351a865a-ca25-44c5-bd01-0e5cc1255284", "value": "0819ca59_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f669a1af-ae2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278511, "uuid": "60585a84-9c62-46b7-9cf4-51dca203ed0d", "comment": "Malware payload (AgentTesla)", "value": "842d4718a8f2596dae1ee3cf395c93ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278511, "uuid": "77079bf2-7ab7-495b-ace1-be3e8dd81196", "comment": "Malware payload (AgentTesla)", "value": "5a8b5199de9f08c65f9b34eb97b375722d4c3d04e583001b6e41114b5a495770", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278511, "uuid": "1bb740f2-1090-4c41-a34c-f62f3c0e5be0", "comment": "Malware payload (AgentTesla)", "value": "5ce3dda157bdd4b434a0a5c2a2059eb6407e3666", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278511, "uuid": "50b83ac3-aca2-4767-b3df-acd4f144ec39", "comment": "Malware payload (AgentTesla)", "value": "9f95ff81a4f4313686fc7641efbdfec8373d338dfb5c23b95934d2d1777521cdb1a12eb6cbce75cca072ea035e9f72a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278511, "uuid": "f41d8fd8-13b4-4ed2-8776-87fa789d5f3a", "value": "17F4027C62891792D92F677D3878C4001BF0B62E96A3EB0A7FE021BB1B77B514611763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278511, "uuid": "e8dff7a0-b9af-4fd9-af65-0e995a51a4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278511, "uuid": "50317957-0e53-4af9-9dd3-3956a6e6e73c", "value": "12288:jmtkf63q67/1y7SKVPpE7UXiKhVPmDJM3g2jegLjUtx/14t5l0v0xBK+UeD8M:+b1y7pS4XiKhZH3iYUtxcl0vwKED8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278511, "uuid": "6f542719-1ae9-4f4e-b16b-e626532171ba", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278511, "uuid": "c97fb0f2-c378-427d-a57d-7cf29c6f7215", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278511, "uuid": "bcf2f03b-6c7b-4a49-9694-fe32f76d2bc0", "value": "Payment Advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff450b2-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339112, "uuid": "c4c42bd0-aca8-405f-99b9-f89b2551b51d", "comment": "Malware payload", "value": "2fed9eb0ce7ad3e2c0bfcf687bcf7137", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339112, "uuid": "e1be213b-5cea-43ca-94a3-2ef08a2f7419", "comment": "Malware payload", "value": "5aa0481f7afdbc6f64f874ec963bd341dd622b7ca9f57a529a44bd89a546aa70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339112, "uuid": "d67c998b-cb96-4e5c-b523-09bafd83567a", "comment": "Malware payload", "value": "62b7b99021235797d173795001b6d515d408bfdd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339112, "uuid": "4ba66445-3ab4-4dc1-83f7-ab74a321aab6", "comment": "Malware payload", "value": "192f7327cf9a25f03680f756330ab56dc8a381c7efec07c094fe6daae3d9391d85587a8abf875d9dc0ed0bfde31c6f06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339112, "uuid": "e308ca47-ca66-4d64-be3a-e35aa43d4c6e", "value": "00F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339112, "uuid": "c92901b6-b786-4c97-a17b-0e0bc9d1d503", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339112, "uuid": "54f0addb-1c0c-4db9-814d-2ea2f586483b", "value": "3072:1LG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:MERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339112, "uuid": "90f6f154-ff79-4c3f-bc22-dea9e6f4f44e", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339112, "uuid": "db299348-7e19-4513-95bb-9d5e22305536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339112, "uuid": "1a448799-26e8-43a9-ba5c-8bfd226e9eac", "value": "2fed9eb0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1017312d-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266528, "uuid": "6f027463-1bf0-4487-b98f-bcb845398dd3", "comment": "Malware payload (Dridex)", "value": "a629e31b4cae26673ffa0050170813de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266528, "uuid": "599ade77-77a3-4733-8280-715817816b9e", "comment": "Malware payload (Dridex)", "value": "5ad6fb27b66c838234d3901e41ba5e380e9a21d195ee405dedfccc1d270a69f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266528, "uuid": "a016bfb2-474b-4db6-9120-a308b771c9a6", "comment": "Malware payload (Dridex)", "value": "b6ea8cb6e0ed49182a8de08efa67424e0f8abc70", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266528, "uuid": "3abb37a1-ebd2-4b1f-86a8-bb2dce12b832", "comment": "Malware payload (Dridex)", "value": "97f8dd8b656406199ba69c1e54e79cac9c257be5922b2df14587794f3b52abbd62cb9db0969437d1bc6f62e3fa52148b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266528, "uuid": "53f348bd-6f7c-438b-bb52-3a68ffb19ade", "value": "93F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266528, "uuid": "405ced5d-23fd-4e36-88c2-00c9c402d85f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266528, "uuid": "9b0bc2f7-b71b-4c86-9b4d-fb329208fd1b", "value": "3072:gzlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:gzlo0gw4ZMypZp45g51aXotOxwVeXm7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266528, "uuid": "204d4894-49fa-4ac2-b526-fc36eb578031", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266528, "uuid": "004f24c7-edc7-44ee-b010-0ee17e9e975e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266528, "uuid": "12b08340-0638-4d9e-acec-c405973e5cb3", "value": "a629e31b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50df78f-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620281005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281005, "uuid": "54da0deb-bd18-4242-aa37-49bc4c070a91", "comment": "Malware payload (Dridex)", "value": "06f6f6fc2c2fee47738da89d8efa81ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281005, "uuid": "c78d17dd-906b-4887-ad3f-7944d2a149d5", "comment": "Malware payload (Dridex)", "value": "5b6fb8eb899355292a7d1b23ae34187839ee2cceccd215cf48700912828e6942", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281005, "uuid": "708f6131-7c57-4387-afa7-3717cf2bb31e", "comment": "Malware payload (Dridex)", "value": "079d6a7644a1fe0560061d194e681fcf9b45b4a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281005, "uuid": "7d9ad31d-b62a-4b0b-b096-4b96831916f2", "comment": "Malware payload (Dridex)", "value": "2440b21d441231d593efa9af2d121a93979458ce8275cafedb51afa54f1c2209547af943327fdd881f0a85318503df63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281005, "uuid": "5245b8de-f682-4d51-bbb0-1fa89d93b6c9", "value": "03F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281005, "uuid": "056e4742-d634-4227-901e-29d4806a8d34", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281005, "uuid": "631617cc-3a20-4c6c-885c-838e197b774f", "value": "3072:Te45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:C4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281005, "uuid": "63d00cef-5c59-489b-9855-5b0d5c31f7f8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281005, "uuid": "9e420459-a05a-4df2-b459-6f27fd9a645c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281005, "uuid": "1b8f0dd9-a287-4023-a6d2-1bcac97cf71f", "value": "06f6f6fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde1da1f-ae9b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620327056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327056, "uuid": "41cbb881-e4f9-402d-96be-c905bb6de420", "comment": "Malware payload (IcedID)", "value": "8ae6c114f166c8a2cd94b76baad829b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327056, "uuid": "8a96d127-6f02-4166-a55f-1a601758c2d8", "comment": "Malware payload (IcedID)", "value": "5b8ad88dcdeaab887007c06eac46b38f8a36165f144b3a8b383dd154594e933b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327056, "uuid": "fa44f91c-737a-4f4b-baad-2e456a5c7e33", "comment": "Malware payload (IcedID)", "value": "7b0f86d06abccaa983f45cb59f8beaf3db4cb454", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327056, "uuid": "fe238b4e-bce8-4c1f-b5a8-282344bc7d9f", "comment": "Malware payload (IcedID)", "value": "23dc51b8ca3d49197ce32ea205eb0e6df7696379ec03fe805987e1d17cbfa03d040342e48cf594601b2df4b53ba44a9f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327056, "uuid": "63a43c29-1cd1-4b27-a97e-0d234a048937", "value": "CD346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327056, "uuid": "72444bc5-4a48-4138-9b67-9414c6309869", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327056, "uuid": "2b68b46f-72f2-40e6-9635-783c0a4dc1b5", "value": "6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888Is:dJJLaU1mUGduNzGSijExi3oomlnG9PSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327056, "uuid": "3f69c46a-66c6-472d-bf27-f5d1056c6334", "value": 240216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327056, "uuid": "1559b12b-2412-4dc1-b744-a3e8e0c88e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327056, "uuid": "5496963e-5e90-40c7-b04f-2be0d44d917e", "value": "5b8ad88dcdeaab887007c06eac46b38f8a36165f144b3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9146f28-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291722, "uuid": "ead7352c-7a08-4050-8b1c-f6c93db1aa76", "comment": "Malware payload (Dridex)", "value": "fa3ae2c315fb6aad466a02073e0e89c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291722, "uuid": "d13ea946-b55a-413e-ac2d-102804f6dad8", "comment": "Malware payload (Dridex)", "value": "5bc0e760440b46b8ee4e56b2ee963421e5520de7bdc6532c02c4171ba6ee09f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291722, "uuid": "d36a1411-4919-4539-9528-9f08a7968673", "comment": "Malware payload (Dridex)", "value": "f6d02bb945710968b87d24d8b632a3a2109dcf28", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291722, "uuid": "ef4f70c2-b259-4408-b085-27b35bd49514", "comment": "Malware payload (Dridex)", "value": "813eec6dc56f3587655a82c21f42bc91cedcf155e04a5cef34f3e556f24fb1c1f66aa1f3cda5698550c22c8676ffea12", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291722, "uuid": "b84cfe2b-c943-4be6-a7e9-564e91175706", "value": "ECF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291722, "uuid": "2347ac43-bbb7-4839-b3e2-94fca5c48a4a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291722, "uuid": "d2ce1367-2add-447b-929b-79fb6bfec5c1", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291722, "uuid": "1c74a87e-bfeb-4cca-b573-b677957cf8ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291722, "uuid": "954baab7-2e9a-45a9-8a0c-f0d19b782871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291722, "uuid": "f018d06b-7ca4-4f58-a7f8-a8e433ad75c2", "value": "fa3ae2c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec48673f-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266468, "uuid": "7b172a91-0833-43e3-a0ff-2baece3f519c", "comment": "Malware payload (Dridex)", "value": "26b842ebcf936d64223551423655dec4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266468, "uuid": "e628ad97-7972-45cd-8214-b557c54d0553", "comment": "Malware payload (Dridex)", "value": "5bcfeed510951fb058e7cdbb67f30296085134425ea3dae6d426b08374e1fcc6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266468, "uuid": "41ce064b-6e3e-4c7f-96b2-74b14f760935", "comment": "Malware payload (Dridex)", "value": "296a483f23566b1bef29c2ab65779067423c7608", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266468, "uuid": "4fdead5d-c678-4d8a-91e3-f5b69f116903", "comment": "Malware payload (Dridex)", "value": "bae97add1a6516ca316ef421f5d3ba146086b1528c7e52bf2dfbcbdff9f1ce8b595c54045e134c85de6079611b9af144", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266468, "uuid": "0d867207-dec9-44a5-ac3f-5320d1b642f0", "value": "22F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266468, "uuid": "efc49e18-8950-4243-a8fa-c3ad3475943a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266468, "uuid": "7d9ec221-6a15-4e15-803b-47dfad5a4024", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266468, "uuid": "7429477d-158a-44a7-99e3-438d38c36c1d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266468, "uuid": "2915ee66-e359-489a-818b-82ec422f0d1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266468, "uuid": "6145d2ca-5a49-409c-879e-1405310a2e08", "value": "26b842eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a2eb10-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338954, "uuid": "00e8b711-f094-41e8-911d-1ced23f713b3", "comment": "Malware payload", "value": "a211b430fa50078ba162e94f22df7157", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338954, "uuid": "95596c1a-d6d0-4a78-9a20-7750e2dc5066", "comment": "Malware payload", "value": "5bda8aa98a6dbeabf79bfc7999fc0dde3dc3dfab50647112ee69d62db26e7617", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338954, "uuid": "20c546f8-26c2-48be-9f9a-dbcbfecddcf0", "comment": "Malware payload", "value": "bbc37ca67c1570d8951575f809c56b7c929d0688", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338954, "uuid": "3aeb44e5-b9ae-4f7e-9f61-042572ba7dec", "comment": "Malware payload", "value": "76f667fa7faab5f2cfcd5e864715e59861fe0704823ff732c46bd4bca1ad6d6f97584fe57a36f3e32e3e20f0ee57bf24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338954, "uuid": "230cce53-5c9d-4617-8d41-6157ca60c38a", "value": "5BF3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338954, "uuid": "027bd1c3-6aa6-4676-88a4-7f4c952708a9", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338954, "uuid": "56b88f1f-69e5-4400-9e7c-5fa3cc25401f", "value": "3072:4VG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:9ERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338954, "uuid": "b3b3cfe9-6e2d-483e-a692-1580afb6e6aa", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338954, "uuid": "1c8e396c-08be-43bd-9c86-ab20a700ae73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338954, "uuid": "d809c980-bcbc-435c-839e-cbcc33c2e3d0", "value": "a211b430_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39171bc-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284492, "uuid": "cf20976d-754e-4b3a-9bea-52c491df38fc", "comment": "Malware payload (Dridex)", "value": "6934fad13a84c5539fc084a58b63d74a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284492, "uuid": "c1922a5b-9e8b-41a9-a9ed-6e0aa1baa275", "comment": "Malware payload (Dridex)", "value": "5c023bce7f9f608c0e2ae30602d428a71d57877f9ad706487e3e9f740551a446", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284492, "uuid": "a41a437a-754c-4ba3-913a-2b4616c219f7", "comment": "Malware payload (Dridex)", "value": "4fed015f0e40f01e796debb35b8a6d51f728a58e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284492, "uuid": "7c73a6c7-fcc1-4a2d-81d6-06924787f4bb", "comment": "Malware payload (Dridex)", "value": "69a8d853db84909c307b00aafea1eebcdf0706204c814ac253195c1444cc049803577931a9c807fd094717637b13d77a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284492, "uuid": "dc42897d-5848-4de4-8ea9-2d48b058baed", "value": "0DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284492, "uuid": "f89dbf84-c2d3-4df1-879c-0294a567a456", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284492, "uuid": "b25b99b2-24d9-4493-96ed-d5b4d91f4b21", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284492, "uuid": "dc6add56-8956-45b1-a160-da449a592531", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284492, "uuid": "35524306-5f5d-4043-856f-18eb796193d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284492, "uuid": "47b02e43-5772-4598-bed0-ccd630616af9", "value": "6934fad1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb99e438-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291726, "uuid": "722ac43e-c31a-4b34-97b1-e8f90b768b0d", "comment": "Malware payload (Dridex)", "value": "55bbb603d9a97d371887f91b565d5b62", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291726, "uuid": "d2d8f775-b0ea-4eb9-86ab-b59bc3a49c51", "comment": "Malware payload (Dridex)", "value": "5c2c3ab4a1415d1c9d5c16d34cc4b6bcedb6b3d5ae9ff5e3499799f36fbad3ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291726, "uuid": "5a405e3b-c7ec-475d-96bf-e7a5267b613f", "comment": "Malware payload (Dridex)", "value": "3326dd024b637624b11a6a0ecdeb82731dbe3840", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291726, "uuid": "2a552494-3ed3-4099-a362-f696649d2603", "comment": "Malware payload (Dridex)", "value": "1a6a06e18bed06589476d3a924a0708b7a65bc43069707b1a8d5ff2d78b4f078b22774dacf2c07708f55bbb38ec33875", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291726, "uuid": "207082cb-fd5e-46b8-817f-70cdae1d7816", "value": "A0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291726, "uuid": "7c5d5dd0-1136-4f44-acb1-299bddac079c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291726, "uuid": "cada8dd2-b27a-4df1-9aec-f925d1345556", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291726, "uuid": "652776bc-b15d-4c26-a981-06ac1992b67d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291726, "uuid": "7bd63d2e-da45-4080-b43d-57492b1b72ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291726, "uuid": "13a10223-1f5a-4019-8a9c-fd9f13792522", "value": "55bbb603_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc87886-ae31-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620281177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281177, "uuid": "8fd94329-0550-4597-922e-7ea5733a7241", "comment": "Malware payload (NanoCore)", "value": "19eafbe1ec98322421188f676550cda7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281177, "uuid": "4ecec8a2-6dca-4179-9631-0a5a97443768", "comment": "Malware payload (NanoCore)", "value": "5c53bb5c2d8a2d54637df1f9076b4647518a9609a80ad3b4c1bacde15c154e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281177, "uuid": "48749f04-292e-4209-9edb-24c2f4ecb27a", "comment": "Malware payload (NanoCore)", "value": "70d284a7d88fdc8a3ac9df1b0aa9e7bdd1be1535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281177, "uuid": "795d6fc7-b1c3-4a55-99c5-5a593301649c", "comment": "Malware payload (NanoCore)", "value": "5c5399b75798d0dd4d5411591566259da489a62dc10c384cb5c4f9d2c980eca0030ec603a854bf224ad9b329e9e20fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281177, "uuid": "eb191390-b9dc-4737-95c8-c3ac76f8f57d", "value": "7665EF22528CA924D17B23748526C13947F6BC13E772C61D6EE97CDB3B336C2A667213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281177, "uuid": "40ab085e-2589-4e71-bcfb-61e9f4ed6720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281177, "uuid": "313229ad-30b8-424d-9384-e1cddc68f2c6", "value": "24576:O2mJH/zZtum0T3Y+NGUSF/raEGm+lg5zzq:kZtt507RNGLjaDlg1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281177, "uuid": "a705c6dc-bf30-461a-8743-51abab26b5cb", "value": 1542656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281177, "uuid": "006b179b-2711-4afc-bfa2-8ea538a0c102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281177, "uuid": "ac807773-1d7c-4be0-92ff-1e9bc6b8b8e7", "value": "19eafbe1ec98322421188f676550cda7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc53602-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338651, "uuid": "fd925f76-3bca-47a4-8d72-8b161686c3a1", "comment": "Malware payload", "value": "c6ded5ed934919db8b75eea6910d1781", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338651, "uuid": "55fb1b9d-7d55-429a-b254-854a5d618c0e", "comment": "Malware payload", "value": "5d3c1efbc50370aa4ed701974e2467ad07b37ca43d8188f6da3d22ea8468c3e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338651, "uuid": "5de1dc31-006c-4dd4-a2c0-2029699f32c9", "comment": "Malware payload", "value": "4fbda22f223957ba52a88baceb9c0144a559dfd1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338651, "uuid": "03e76272-78a7-4db0-9b81-8c6e9ad03471", "comment": "Malware payload", "value": "c5254c6c581cd2e00d2b36c20777dee267d8dac3096fc46772c9186d5fa4b908661fd48f32eabb7aabf09ffe4c826325", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338651, "uuid": "2a98e72d-c2e4-42f3-993d-f6b870b5d7cf", "value": "C2F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338651, "uuid": "30fe46c4-7f9f-40d9-b0d5-1adf70e04f0e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338651, "uuid": "7fe2c575-8e38-4442-b45e-baa3eb65c153", "value": "3072:dB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:74KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338651, "uuid": "66f32cd9-4542-45bf-87b1-23cc727f5b18", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338651, "uuid": "9573ea8d-1138-4970-9dba-6cb6929846d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338651, "uuid": "701a2738-1fbd-44a5-8fe1-35beb8023b14", "value": "c6ded5ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3793aec-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295256, "uuid": "bd18c969-8f3c-4990-9641-e09c4b6a013f", "comment": "Malware payload (Dridex)", "value": "ea81b328d0af87563681baf2ea83e271", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295256, "uuid": "68c92b03-3633-458c-b677-c6049c0eb7bd", "comment": "Malware payload (Dridex)", "value": "5dc76a66be50d55ff916609555674c8dc51e03e0fa951686d903d4fd289df104", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295256, "uuid": "e8b9856a-033a-4910-acaf-0e0bf0f9b2dd", "comment": "Malware payload (Dridex)", "value": "d5af54eba9c35e7026092a4f6d465ff8a3592200", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295256, "uuid": "1b513d0f-802d-4fe4-a167-99ad4fa88ad2", "comment": "Malware payload (Dridex)", "value": "015db21527e24a1d88b101d4b7c84f0211dfaaf40c17290a4a9bc1b7711fa540fb4617f3d9d4693a74a8bfd47953b1b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295256, "uuid": "e1c5e9d9-6c63-4b99-990e-8f7041883425", "value": "96F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295256, "uuid": "42193bc9-5f44-4fa0-bdcf-20b10ea792bd", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295256, "uuid": "60736b99-c64f-4203-8e5f-b159840eb61a", "value": "3072:ZB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:c4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295256, "uuid": "efb5282f-0e90-47dd-a626-2a9be911a76e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295256, "uuid": "ec911139-433b-4fca-97eb-509d69225a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295256, "uuid": "9a0d82a6-9d9b-42bd-a939-7f651a7e1899", "value": "ea81b328_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bdbb16-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342105, "uuid": "087c86ca-d7c1-4de7-bde9-1537c3092b77", "comment": "Malware payload", "value": "88bd20c411be56f35caafd519cd488be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342105, "uuid": "932f3dec-d77a-4953-a4ce-33d972e779ef", "comment": "Malware payload", "value": "5ded0a945bd09f7666a7273fb0861c6b65d090c4983d17540dff2c67a3be94d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342105, "uuid": "45fac640-64cd-4494-9d75-358bd4e2d177", "comment": "Malware payload", "value": "5d97e46632bbe25bf91beb996a0f5993db8dd67d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342105, "uuid": "53c04d19-e5c9-4c3c-97b6-9011f7241b6d", "comment": "Malware payload", "value": "5da921875a5fb6268302ba250abe6ebf6f7c6ee6e396500170edf68ab7d30fc37912d594a21b6b98bdc621c64c40a549", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342105, "uuid": "2d9680d6-efad-47c6-ad05-1975302f9a25", "value": "65F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342105, "uuid": "f91a86f9-94cd-4022-aa69-2fe08e2653ef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342105, "uuid": "b766b50c-7cda-480d-a314-5087598a9eb1", "value": "3072:0IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Nc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342105, "uuid": "b0dc3afa-8073-466b-af12-c26c89981584", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342105, "uuid": "d8cda8c6-3081-450a-9b6f-fac1c18e3ac2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342105, "uuid": "c867a302-c105-4683-b3cf-4a815e6fe8e0", "value": "88bd20c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a183ee-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339117, "uuid": "ab90aa8e-0f04-473a-90c9-4c1631e203f8", "comment": "Malware payload", "value": "4ab24ff6bdf7350fd2a661c39bbb2bd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339117, "uuid": "0c016b49-0155-4c0f-b88d-f8db7784a876", "comment": "Malware payload", "value": "5e0f5eb1a4170f7ed96214ce985494fcb5ac194e9aa067c6b4ea1dada267f215", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339117, "uuid": "46c9839f-9e51-4042-81ff-caee8498663e", "comment": "Malware payload", "value": "020ba9d618da02a0fb24d87b887585173f2d88ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339117, "uuid": "31f00513-82f9-4b6d-867e-5edfb8df5611", "comment": "Malware payload", "value": "f963ae2bceb6ef1c74bedec5dc4a16cbd0e5485b36484303bf6d03f4fe1cd43dc603d9dbfdedc7aa0c09b3e1ae783945", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339117, "uuid": "c2a36811-8bf2-4379-bfac-6e812e5cd9c0", "value": "89F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339117, "uuid": "e184f5fe-956a-404f-8707-fd6a2a49f668", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339117, "uuid": "3fd1f2e2-00f3-4bd0-960d-34c081e3add9", "value": "3072:QkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:eERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339117, "uuid": "a304506a-e063-4df8-8348-506b024549d9", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339117, "uuid": "c6f2e724-c4da-45c5-8a8b-4a1017f533b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339117, "uuid": "dc76be2a-2a0f-40f6-a8d4-027d31ccb095", "value": "4ab24ff6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24034157-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334851, "uuid": "1c6b6e26-031d-4853-a5bc-d4dc614abc01", "comment": "Malware payload", "value": "70d7dc920407abc73f89f408219de0a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334851, "uuid": "3d06d44c-2256-422d-8183-48491f3a3b71", "comment": "Malware payload", "value": "5e2b2b8a867993e0fe8f9ed0cfcd5f18166f0904251edaf3249b39938c2440ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334851, "uuid": "d0fe0dee-aee7-4cd1-9245-14bf852af91a", "comment": "Malware payload", "value": "53f1730f3c5b509eac5d0f6f9fc6719aff15b543", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334851, "uuid": "406ad9e9-6691-403c-aad6-9af4073cf212", "comment": "Malware payload", "value": "eb167a707d5613f5d48027f9722c69455ccc3a9f6d2166aafd9aff24b2c588db74de2948df0c6d20d6710322c3ee58e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334851, "uuid": "bf2a2ca6-fcd1-453b-aa3a-83036fc6ec51", "value": "95F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334851, "uuid": "04b0fcaf-5b93-4bcb-8195-ed6d7956a9e4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334851, "uuid": "ce19938c-7e37-484a-a78f-1cea899f6e85", "value": "3072:5lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:5lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334851, "uuid": "656f9e49-f8b5-4c69-b010-b6c487ecf3e9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334851, "uuid": "1576e9ad-fe8e-402a-9506-ec09d693913c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334851, "uuid": "f65960b9-af65-471f-be99-145455abd889", "value": "70d7dc92_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efeccca3-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295250, "uuid": "7f95c9f2-e529-4359-a70a-ab86d36a2fba", "comment": "Malware payload (Dridex)", "value": "b5a93b45e90c444ad9c292430a75f970", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295250, "uuid": "87ec7772-d16d-448a-928b-2def147c5d8d", "comment": "Malware payload (Dridex)", "value": "5e3eed5ad80edc32e861ad3be4c8e3c01552384ea982422053c4620662780fbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295250, "uuid": "e388fe41-c323-4c1f-b497-75fad0b7cf8a", "comment": "Malware payload (Dridex)", "value": "388e8dc602e0bc62970a8ccf1bc0bd725ddd8af9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295250, "uuid": "8e66cb61-1e49-4225-8a6b-9000860b66e4", "comment": "Malware payload (Dridex)", "value": "b646c81de42be60281ec71709e95ef9f1f1d0f3622a6333b96978e13302b44a2ac1c034a036e29efa80cd7c73db93f23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295250, "uuid": "39cdbf47-d452-4d8f-bb47-1d82b4f17e78", "value": "CFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295250, "uuid": "b6357d5c-e390-4a5d-b65e-f45046f3fd47", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295250, "uuid": "fc095004-5071-472c-ab9d-bfe1e81858a0", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295250, "uuid": "07296ab8-e06f-4066-8394-056e34a10387", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295250, "uuid": "0ee2437d-418d-49ce-ac64-0ccda1b3c909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295250, "uuid": "4d42d9ba-53fb-46e2-b8d5-92c4fdbac517", "value": "b5a93b45_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0becf3c7-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342112, "uuid": "08a1c328-ee80-4a20-aab0-6b75f29e8ccd", "comment": "Malware payload", "value": "5cd40daf02990dacd6acd9b3cb280180", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342112, "uuid": "8f80a17f-b303-49b4-8e68-85773767831e", "comment": "Malware payload", "value": "5ea9375c7b97c217b911abb7e905daf37df7a2c3f4595adeee3b97e4c5525d86", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342112, "uuid": "149038ed-6c95-496f-ba49-4a575e1c396e", "comment": "Malware payload", "value": "a971d2d98a323308b5748484bbf63cee14addd5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342112, "uuid": "dc99add7-79b5-4a09-a07d-99862f01a179", "comment": "Malware payload", "value": "d43e1d4742789e6a7dec298de0a4a76da539c664f7829f0a7dce0a5fee2c7dfc5bca9dc4ada7120c681bbdfa2db22d14", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342112, "uuid": "e9b4eee5-acf7-4a5e-b1a8-b496c3f49cdb", "value": "29F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342112, "uuid": "cf6355e2-e09c-4051-8526-985b4b62a61e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342112, "uuid": "64c6d477-4a07-427a-b92f-60fa28b4b692", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342112, "uuid": "35867b13-e61b-4690-bd2d-3bc8c033ed52", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342112, "uuid": "b3ee2573-8c0c-47ff-a7de-0830ae60c11e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342112, "uuid": "5be0b46b-d246-4449-92c3-82a776cbcb07", "value": "5cd40daf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8be5ee0-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338966, "uuid": "1504540d-0fff-4f08-a87c-81a2fe973502", "comment": "Malware payload", "value": "ec12ccbaabf0f871a95f0da559259527", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338966, "uuid": "c3a684c2-4198-498d-a40b-dc32eff08c98", "comment": "Malware payload", "value": "5f4c0abbf3c3ea32cf035ced9fcc411c6139d233a9c45959eddffd331b19bfbe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338966, "uuid": "1736e043-6f7d-46ae-822c-58a7e817ccc6", "comment": "Malware payload", "value": "34501d559436b32364d2019a0127fa7dc6a61b48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338966, "uuid": "af732c22-42e3-440b-85a2-73d61099eef4", "comment": "Malware payload", "value": "8dbe45968c9d45f73be0579f03898a56095e058a5fc36951fe35cf586276b06404862091c2522480a411a7b5ee5cdf2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338966, "uuid": "b6507c94-4de6-40c2-af5d-c5a2dfc0b1b8", "value": "5BF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338966, "uuid": "54391da7-0a88-4052-82ec-8b046beae468", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338966, "uuid": "d0fe4f61-f7df-4084-9ab3-0c768fbb36a4", "value": "3072:JiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:bERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338966, "uuid": "d8a57dba-47ce-466c-9f7a-6901cdb185d5", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338966, "uuid": "d8a12a7b-74d4-4915-a397-fa0611a4079c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338966, "uuid": "b5132519-8d50-41a3-a293-d9e6928e8849", "value": "ec12ccba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30a05b4-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339467, "uuid": "bbdc62cc-b147-47f0-a963-ddb0dbd3c2af", "comment": "Malware payload", "value": "a13799610911fae2e72778fd412a7cca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339467, "uuid": "0ab3efdc-8dbd-49ce-a168-bd9aa50c2ea9", "comment": "Malware payload", "value": "5f59d27e34ee803766d9f941a38239b4355e7b2b38494f52e841f51da6d3d9de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339467, "uuid": "8b593d60-5ae2-4afd-b4b7-69ba196d3383", "comment": "Malware payload", "value": "56737de17fff7994ea2630a460b89a23860a7e00", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339467, "uuid": "256e9898-240d-4775-8850-394701d01e62", "comment": "Malware payload", "value": "292e40e6f1382d1e3764a086131d59ad7a8814984f3b9e269923cb71841eb67106d0fab941b65f04b4a407b24da04bf3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339467, "uuid": "f705d804-5535-4db8-af3c-676a2d001204", "value": "E3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339467, "uuid": "8b9a9584-dfe1-47f2-b789-622e4148c6ea", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339467, "uuid": "c9d41540-67ca-4563-89f9-000c78bd1a30", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339467, "uuid": "daf9c600-be8c-48b7-a789-d33aaaba6239", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339467, "uuid": "ae5b873e-e70f-48c5-acaa-4b786b26a57d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339467, "uuid": "5ddae29f-b332-471a-8835-561ab817eee8", "value": "a1379961_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1906786-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273671, "uuid": "490f5db3-9a40-40b5-9ea2-6a5ca1eba372", "comment": "Malware payload (Dridex)", "value": "431ccd404d327814a8f6b1f095c76f03", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273671, "uuid": "9d52ba74-6039-4cbe-b7f9-c84bf0317809", "comment": "Malware payload (Dridex)", "value": "5fa58e599698600139328143a0cca92b22fb24802828dab3413513d2efaff82c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273671, "uuid": "283e0929-fa9f-425e-9c70-3a516dc93a67", "comment": "Malware payload (Dridex)", "value": "96c06e33e35aa14cfdf54d111b512516d92e6bc0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273671, "uuid": "8d990ee8-8837-405d-9698-7b53565599e8", "comment": "Malware payload (Dridex)", "value": "13b7a901c31bd39ea0835376bb1a52742c5a72cfb006ab89f3d0533ce2e44ef6e1d043eb0188c9316df1b3d340c63e8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273671, "uuid": "00ab7a86-e244-481f-9ed1-d2ebbed05028", "value": "24F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273671, "uuid": "5fc6c6dc-f2bb-4871-9907-3fe1a1a55845", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273671, "uuid": "ef419a32-e5f8-4f52-8cd2-cbbaf43cd51e", "value": "3072:1XiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273671, "uuid": "dcd5eb13-8117-4f97-ac7a-33b7b23868c6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273671, "uuid": "080f05e9-2e0e-483b-86b0-7421dff30f4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273671, "uuid": "2dcc35fe-0123-4235-a380-0991128c5830", "value": "431ccd40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9636ffd2-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288228, "uuid": "d493484b-09e9-4792-a2ed-20143d8bddf1", "comment": "Malware payload (Dridex)", "value": "6c533ef4f71224a392b28a2faadd6e9a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288228, "uuid": "8e83a26d-0ce1-46ba-8865-0ca363840387", "comment": "Malware payload (Dridex)", "value": "5fb79518c9a003c9e0ca00d97808c105b9b705dbe0bec17eb23e00e951acd961", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288228, "uuid": "f1043781-00ec-4f65-84c3-59bdaf1e9994", "comment": "Malware payload (Dridex)", "value": "e9fae91a808113eb390632dce1aca6581b61bf13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288228, "uuid": "fba6e411-0796-4b54-981c-92d9cb775426", "comment": "Malware payload (Dridex)", "value": "ac2741a49f54c95e9a3d92ee78ae4a1c56bd935fe78f36f7f5713a4645a47b94cbe87f854548f99f23d4b0c071b51c77", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288228, "uuid": "15767575-3ad3-422b-90d2-cc9f795077c9", "value": "C9F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288228, "uuid": "7cf356c9-59be-4514-a3c4-31bac5005518", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288228, "uuid": "3f0aef2d-1e4c-491a-b960-30b2643ca59e", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288228, "uuid": "92f2cb07-5abd-4d91-8bba-124e4361abf4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288228, "uuid": "0dcd967a-addd-4b6b-833c-64a61df4fafb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288228, "uuid": "9cad0a30-b6f7-4980-b5f1-422964340309", "value": "6c533ef4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793f7c46-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280878, "uuid": "a2322669-ebda-4707-9de8-e9bf723269b7", "comment": "Malware payload (Dridex)", "value": "4188e11a1eb10f7624606a85d0a64c73", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280878, "uuid": "49cb1dfb-f38c-4c8c-92bb-8ba2bbf8d2aa", "comment": "Malware payload (Dridex)", "value": "60108a716a83685f57fedf06083d41557ff0496a0174bfa23be5df952d6e77ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280878, "uuid": "aeddacf6-f27d-4ecf-ba98-f278d278110d", "comment": "Malware payload (Dridex)", "value": "81ec92dc93248fd89031e3939201d695d04b28d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280878, "uuid": "e584f1e7-88ff-4799-a58a-df9e24feebf5", "comment": "Malware payload (Dridex)", "value": "4a6f18c576c75ca159a7c494d13743ef3b654526825dc003a95dfccec6ebcb022af11eeddd04868284f3d66e59e162ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280878, "uuid": "e047ec77-5b4c-4a39-a965-3e183b2fc46c", "value": "20F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280878, "uuid": "9547ded0-ce3e-4c17-8b22-d17db33eda6b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280878, "uuid": "95de58b4-94da-47ce-943e-c944d94f015c", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280878, "uuid": "4adbeca1-bf0b-4f54-bf80-2b2108dc42e7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280878, "uuid": "8ac0d698-0749-473a-9e84-fb8dd86a6680", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280878, "uuid": "b31858b7-cadf-4f2c-8e14-af14a32a91bc", "value": "4188e11a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a725f6b-ae61-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620301925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301925, "uuid": "c353fd23-cead-40ab-823e-ed414dd3073f", "comment": "Malware payload (Loki)", "value": "61a76418efe0fa69274f19e4ee92587f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301925, "uuid": "e10cea86-c76b-4161-9797-3b60c7c3e184", "comment": "Malware payload (Loki)", "value": "604b83be28f2553e9db6a338a3a76c3c361d7ac61f475ff218f9ef440687cbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301925, "uuid": "8c966eb9-4f92-4d33-aff6-20aa7a852159", "comment": "Malware payload (Loki)", "value": "7d4f4d13d8517bc0840c886413f0b3a7609ca5ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301925, "uuid": "86482c76-5e6b-4a70-b17d-9759747a2beb", "comment": "Malware payload (Loki)", "value": "b046e51800a1cc7f510d0b78c844a8bb65289fe816c0fd03cd355dabd5783681417b634a2202b51813d3a3c799ac3cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301925, "uuid": "e967d2af-8ec4-4d65-b6b3-e373e6f3e28f", "value": "39E45C0017E45B97C2AE43B9E198E63573F5DE05A28AAB8B690BF9F53F7339144009D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301925, "uuid": "c5ad625a-99f2-4fb9-b539-e5492ae244cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301925, "uuid": "3e6ed201-bb6a-404e-9830-ee79fd8db33f", "value": "12288:QL1fxhwL8mLAHefRIZtbVqrTwqEZU2wx9XEgh6K+y:QZZyJAH/ZtxqEZBwx9XEgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620301925, "uuid": "fb1b3c54-38c8-4a87-9a75-12ad55354102", "value": 662328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620301925, "uuid": "915ec99c-b7b2-405b-80be-4f8ad68c087b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301925, "uuid": "f5bcf153-8769-4128-b867-a0c5b5052e7a", "value": "1037854100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6b8ad8-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259359, "uuid": "b11b6c5b-9012-452f-8c2e-b2dbf9e5d56e", "comment": "Malware payload (Dridex)", "value": "c231be55b5663b3c2c8b7b42be31533a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259359, "uuid": "8e29a8d5-5c90-405d-9ce7-b30f1cd71613", "comment": "Malware payload (Dridex)", "value": "60735e2dc59e90c92042df93a38590929cc4a79f6c83d4d9a93a82c511399dcb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259359, "uuid": "01f38899-e767-4bff-b629-a5644fea5300", "comment": "Malware payload (Dridex)", "value": "0f3494d66ed0d7044312090d96e2ecd3b3b37489", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259359, "uuid": "5c32b0ad-5bcd-4c04-bd25-18818fa49a8f", "comment": "Malware payload (Dridex)", "value": "13cc7f7895350fd723b632b721309fb532c1722e3e254f06f5a6dbd42dc4ecf25c4d5894c540fc272236d0830227429b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259359, "uuid": "a89cd276-a773-4d4a-80c7-e537415799c0", "value": "BDF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259359, "uuid": "24cb80d5-d630-46ea-9a46-c695a61859c5", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259359, "uuid": "c603b7cd-a142-4608-b1d9-ec73962c2926", "value": "3072:FB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:o4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259359, "uuid": "51777a32-316c-4efa-b3aa-2a4b1e271c5a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259359, "uuid": "ff4a1691-6fad-46b8-a5df-3f55ecf368bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259359, "uuid": "4b9c21cf-62de-4694-a05a-ff88ad0159cd", "value": "c231be55_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d485f11-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620316962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316962, "uuid": "508367a2-68af-43e2-9332-c16b4f1e196b", "comment": "Malware payload (Quakbot)", "value": "4870aa6d666016c3667317a492450607", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316962, "uuid": "c5ad584e-8d24-4ca1-a8be-595c3b65bdff", "comment": "Malware payload (Quakbot)", "value": "60a71e6de4c107f1f2e7ddec59cc37e07a2a770f7635184202fb6d852c3a929e", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316962, "uuid": "0b3537cf-fd17-412c-98bd-d198e5a52c5b", "comment": "Malware payload (Quakbot)", "value": "f5b74a37c0d3e16026ed3b2f28d1cc7df4d77512", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316962, "uuid": "eefb7320-f351-48d8-9a6f-c227ce503aaa", "comment": "Malware payload (Quakbot)", "value": "df603e6f38eaa926277ba199ce2386e098d848b3a065fbb1d0e22201516c979cc39adef65577255deea2a8e5307cb31f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316962, "uuid": "d41769da-7a3b-4bec-a381-04e14c51ccab", "value": "1BB39C07CC095AC7C11E93FE6D075DF96E0E1719D8D22FEF40221F8A3A656631E4B1AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316962, "uuid": "b1a05c55-4178-495a-898e-b46eb1f45ec0", "value": "3072:tgQvKINbjvw548LMb/oqKO8NnS8+60Kc/A+:4AbT648LM7D98Np+ER+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316962, "uuid": "0f90137f-8eb7-4432-a679-07fbb0a1ef24", "value": 112057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316962, "uuid": "dc195c45-f8e7-4014-9202-0a641d5eed18", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316962, "uuid": "9b4c0dcd-4158-46b0-bf73-112f40d6aa07", "value": "4870aa6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353fc8b1-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338746, "uuid": "675a4379-a26b-4f21-b0e6-1b03e8113282", "comment": "Malware payload", "value": "f3ce1a5d2d3fa34c4a2e086fc462125b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338746, "uuid": "4947e4b1-89f7-406b-8804-4d3c5e4dd8b6", "comment": "Malware payload", "value": "60a8c7b30472ab45245ddfe9f895e137c7e8cf1812d98627fc6eebe7f6a8a385", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338746, "uuid": "5b798088-a276-4282-8f03-d5267b4dd16f", "comment": "Malware payload", "value": "2456d73bd4f1230d0bbe20968821a4b3bc38976f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338746, "uuid": "66091aca-9286-4bb8-8c65-357e1dca45ae", "comment": "Malware payload", "value": "ba9a9adc86732e06f8ac1ed1aca55c39cb03a0bcc5c6c6d34313846842f575957bd229460f2c7f3c88d5bfb8f0cf4849", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338746, "uuid": "b3f2157a-1699-4649-81a9-d9d0e81a6608", "value": "15F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338746, "uuid": "79759c0c-6de1-475f-abfa-ffa010150722", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338746, "uuid": "18ce1725-3b7a-40bd-b2cd-9cbc5a6e86ba", "value": "3072:AOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:gERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338746, "uuid": "3052c0a9-0301-4b19-ada1-9a98ebb9a938", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338746, "uuid": "806df6a7-44d6-43ba-81db-74a7f507da25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338746, "uuid": "23161572-8de6-443f-97bb-991858cbeb15", "value": "f3ce1a5d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369c0747-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1620288067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288067, "uuid": "0c9d3b7f-c431-4aae-8887-13c4f997e1ba", "comment": "Malware payload (FickerStealer)", "value": "3029ed0d72a57ceb45b0a2d341db05db", "object_relation": "md5", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288067, "uuid": "10bf63b0-371c-4983-91d5-ce7f7e15f296", "comment": "Malware payload (FickerStealer)", "value": "60ebc66ef9521f8ee3fcbe54939bb1f71bd6902ad85c57bfa32d4573f9454f0d", "object_relation": "sha256", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288067, "uuid": "194e4808-9aaa-44a0-9980-11e0fab8b0a4", "comment": "Malware payload (FickerStealer)", "value": "a35c2b814a9b8e7288123747a6ff75d028c28b59", "object_relation": "sha1", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288067, "uuid": "31ed8f5f-1c0e-4272-8951-387667991a92", "comment": "Malware payload (FickerStealer)", "value": "3dfc2d91b5dff497d2b934135906aa68c55bf97e7e854e4783ad5470f06eda74077daa6ede77d417dd437f981a4b2f50", "object_relation": "sha3-384", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288067, "uuid": "a1880c47-1209-4ce6-b6db-e7c1f874a3ce", "value": "8584BF30B690C034F5B752F889BA827EA53C3EA1EB2550CB12D526FE16346F5AD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288067, "uuid": "2556c1ef-e971-4120-8894-86d4390d5df6", "value": "eccd8454bdaea67267cc8192a6bb73fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288067, "uuid": "82e350c7-1bbb-4694-9028-e6252344f2a5", "value": "6144:1b3oIpQEuVOzhChu0u7BXRh0rDpohjv5Liedw4pq564ioGMgQQqi+BT6ctg:BoIpQEwAhCE7Lh2Dpohb5+m7oGMuq5OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288067, "uuid": "eb8fb97b-a4b7-4893-a5a3-1d8240246ead", "value": 399374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288067, "uuid": "758cc97c-266b-4ead-b456-98b0855c2540", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288067, "uuid": "d01097b9-9ad4-4012-bf2d-7a1b2551a362", "value": "3029ed0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3815eb7e-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338750, "uuid": "34068e79-7738-43e9-96d0-4219da331cb9", "comment": "Malware payload", "value": "6ff054bd014d89c54f166156a67594a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338750, "uuid": "21c7767b-b1c0-4153-b1f3-b77028fa934a", "comment": "Malware payload", "value": "60f4b033b853d657c1585e3e316df58363ed191c5e028778b6a6c500ef107257", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338750, "uuid": "8093f0d4-7880-4a69-af1c-a81540ffc55d", "comment": "Malware payload", "value": "1b62f26737cf108ce32a6e334363cf974b37feb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338750, "uuid": "a00083a0-5b74-4ee5-aaff-2df3d8ef0763", "comment": "Malware payload", "value": "5dd5e826c72212fd4c0b65feee5fecef7abf04514345965b8ae96e3a2b1f707a42c9d645a6a17ee18eb49d4705b0485a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338750, "uuid": "25c3d4f9-39b3-4d5f-8db9-a9eb772fef55", "value": "08F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338750, "uuid": "0cabfae4-e439-4a14-8361-3d78aec514b8", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338750, "uuid": "99bf5be2-db37-43b7-87cc-0b5b77d4cb08", "value": "3072:JjG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:QERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338750, "uuid": "9f34d7a0-cede-4cf1-a32f-743e5caa8517", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338750, "uuid": "ab416eea-4dd7-437c-bfe8-6d0e87baca2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338750, "uuid": "1c4ae7cf-6c4d-448e-8662-b44b9e045a7d", "value": "6ff054bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b89cad-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284499, "uuid": "dc26ff66-5a75-461e-8705-c6f8cd604623", "comment": "Malware payload (Dridex)", "value": "8007ff84b8ea5af3c7b80fbe5f000a06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284499, "uuid": "70847c4c-4ec5-4361-b902-3c473a9c996c", "comment": "Malware payload (Dridex)", "value": "61003367101c1d421386ab657e6cab6e2da479f5a06604e48c6c0fbf3187efd4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284499, "uuid": "2f33648a-a2f1-49f2-8ee3-25d1754e79b1", "comment": "Malware payload (Dridex)", "value": "da8d54948002810e9dce0b4d37c81406252ad829", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284499, "uuid": "027a250d-a231-4285-93fd-5f43f4f79849", "comment": "Malware payload (Dridex)", "value": "501c5e6c7c8ca473ed2ef111dc01366efe9c17f66c4dd1b45267b75ba189f497160753722afa315c80ed9dc5fe4033bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284499, "uuid": "71db3ef1-3574-47cb-b2c6-80844dacf0c7", "value": "25F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284499, "uuid": "20721a35-41cd-40b7-9a0e-3793ca3d602a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284499, "uuid": "588a6ca7-352c-47c6-b48c-b1142aab1c57", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284499, "uuid": "cfdea94c-0667-428c-9932-6f5e2a2ebe64", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284499, "uuid": "27024174-0ed7-4e4e-83cc-e6898635a0b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284499, "uuid": "89dca788-9231-4867-80ea-b7e5634a638f", "value": "8007ff84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b5ca08-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262938, "uuid": "965a3ed5-e539-4ead-82f6-8bc49e05bd11", "comment": "Malware payload (Dridex)", "value": "e311fce78159334b800177d4872b72e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262938, "uuid": "77016606-77e1-41af-b2f8-751b9eae46f7", "comment": "Malware payload (Dridex)", "value": "61208de974cfb9427e8ba9b9f45b8ca589d1315599d63f210716b953dd73795b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262938, "uuid": "b7ab64e6-2fea-46f6-92a9-1250e0b0c9de", "comment": "Malware payload (Dridex)", "value": "19bcff5ac33541aff8cd8de5ff8f72b388e28116", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262938, "uuid": "9ac72d1b-aaa0-4df6-9f65-125aedbd4abd", "comment": "Malware payload (Dridex)", "value": "a86eafb9f62510c5a556abfb87a9ccadb0946905a15eec9591d4dfe1f126f29358a2cc62e18d0471c5a68ff6c386d08a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262938, "uuid": "68bd91e8-7de5-43df-8c46-76c263a91940", "value": "A0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262938, "uuid": "93f2a85b-ba49-4000-aa61-5bce73c01587", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262938, "uuid": "7cd4d6e9-d3cc-4608-8e7b-2164f5368d26", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262938, "uuid": "ec2e3305-17f7-4b7a-8de0-578ddd8fcc7a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262938, "uuid": "ab1b668c-e2dc-4d28-a108-b7bc17d22cf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262938, "uuid": "6a6b4a2a-d14a-4460-9fc9-c15194b478e6", "value": "e311fce7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b443663c-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273675, "uuid": "86005a45-4380-48c7-98bd-00540b2243a7", "comment": "Malware payload (Dridex)", "value": "640bc8f5537d4de3fc9e259b42492ba5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273675, "uuid": "b263c2ea-ba5f-414c-85f3-c6df12c65891", "comment": "Malware payload (Dridex)", "value": "61a8b6433fdeff459dcdea1f48a666fde32ade012d7578b5a7a16a9bc8d6247a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273675, "uuid": "47da43c4-9eb3-4408-9cb7-34d01d87467b", "comment": "Malware payload (Dridex)", "value": "56e2bf6a2dca8bfd0ce93956dd6e4aaa297aa934", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273675, "uuid": "9ba35dfa-1c38-4542-9325-be1cdd5701ee", "comment": "Malware payload (Dridex)", "value": "832c5288f97501e0ca0ee533e3173e559f818ba94c57b93c753587358176a486ce4a922baba58fd60b09b4b39de95252", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273675, "uuid": "a5e74287-93d6-4b28-870f-b435d3f613cc", "value": "1BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273675, "uuid": "35a57642-e235-43ad-a8ba-6aab83898145", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273675, "uuid": "8e5ee674-8d02-48f3-a10f-5de3773f064d", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273675, "uuid": "1890d876-39d7-4bf4-bfce-b40a4c2dfb25", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273675, "uuid": "f22934c1-de72-44a7-ab50-6bd4ccf73f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273675, "uuid": "fcefdaea-9bd6-4cbb-b3c7-6111d9b4b2f5", "value": "640bc8f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d925ace7-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288340, "uuid": "73680f82-8e15-46ce-9a3b-c1792f422fd8", "comment": "Malware payload (Dridex)", "value": "6dc7ae125bad74731c5538c609a240dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288340, "uuid": "c7a7e442-7889-4766-b59d-f2c5495ec584", "comment": "Malware payload (Dridex)", "value": "61e29697edcc8a35f9df42acfce5e12a8c64bc441a918ccc9241f66dcb6b9803", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288340, "uuid": "7aaedefa-1cdb-400a-8ab7-56f27ceb8439", "comment": "Malware payload (Dridex)", "value": "a06e7652fe67d8f75bdf396e21069b0e66d2a4eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288340, "uuid": "48513ae7-beec-46c7-8792-c7595bc28417", "comment": "Malware payload (Dridex)", "value": "e0063209c847ba0212add2a63a1e1bf6bd978731446fd10e531215ba066130ff201443e327d6acc1bb5294e7ede2d5f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288340, "uuid": "5f768016-bb62-48d0-ab2a-8ec2a8236ac1", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288340, "uuid": "d1ed15d1-4a40-4c18-ac9b-ec53a934ada2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288340, "uuid": "77ea446c-c7bb-4c36-85f0-5d43b9655423", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288340, "uuid": "a89f92eb-7876-4a22-92a5-b159bb91eec1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288340, "uuid": "d2be5645-11b7-473c-9117-afdaf9675689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288340, "uuid": "7fb0d013-7364-4810-96b3-985e3f6e72cf", "value": "6dc7ae12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a6b96d-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338830, "uuid": "55bacd63-60b5-4727-8580-6f58842fcd53", "comment": "Malware payload", "value": "90a04b293d49430bdf6b16b87fa8d446", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338830, "uuid": "816c73b7-79d1-4fe4-972e-af896f6174a6", "comment": "Malware payload", "value": "624386e2258d39835c392c8b4156027f173faa8c577b503d8eda33d7f53322fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338830, "uuid": "c2e75a3c-68be-4724-b105-0a1aa98dfa9c", "comment": "Malware payload", "value": "a02dd1f40e4f47faf28656607bc735747afb94f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338830, "uuid": "d83ee99d-32e7-4711-843a-4fb2ba6de010", "comment": "Malware payload", "value": "620e8309d15c692fed3636b9d525a389e9888905583958b8a54a9da162747a5bd429ed2fb8d7b845474b34ad4f0a50c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338830, "uuid": "ed7d9c43-133b-412e-9b8c-64676de6514b", "value": "FAF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338830, "uuid": "f9522c3f-1524-4efa-a92d-d262a9791904", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338830, "uuid": "5628ab3b-5ee8-41e9-9f01-681459d51a5e", "value": "3072:XiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:hERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338830, "uuid": "6084d964-e482-4fd2-82e4-39e06da9b615", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338830, "uuid": "53be6306-14cd-4985-9060-f71e238ebd6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338830, "uuid": "d7d57346-89f7-40c4-b6e2-28d0209f9848", "value": "90a04b29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2084a8c1-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620309934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309934, "uuid": "16eb2362-80d7-44fc-9b69-55cc2b42ae78", "comment": "Malware payload (RaccoonStealer)", "value": "a3f51e0d8c86e66c1e67d2ace44e5e3f", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309934, "uuid": "0f962639-b950-4f8d-a467-95392d20341a", "comment": "Malware payload (RaccoonStealer)", "value": "624b7ae8befcf91dbf768d9703147ac8f9bd46b08ffe14a75c77e88736bf07d0", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309934, "uuid": "2713f0c7-379d-49ec-b95c-cc44328d9106", "comment": "Malware payload (RaccoonStealer)", "value": "571ffa0cb9e23d918595789805f883eb325a9633", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309934, "uuid": "838e0e2b-79b6-4aee-8365-d6d8987b5094", "comment": "Malware payload (RaccoonStealer)", "value": "d3b9e34a2a9055a7f15b3ff83cce1b85ac065aa0daa3d6f851acf9914c4577de33e023d0e09ad7706bd0033462b9ccac", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309934, "uuid": "73953f0a-fda0-4be4-bf75-13f6dbaecca9", "value": "83D4F111B180C079DC7715764925D7B09E6EB86613211ABF7BDC3ABAEF382D1732234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309934, "uuid": "45160a70-fb4e-480f-bf7a-a82f18a65ec7", "value": "f7ec5170de034aa3644c4457a2b957d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309934, "uuid": "d1f767c5-f08a-427f-96ad-e3a233bfb1d8", "value": "6144:obcFVmBz4/dGXLKzqTf44TZTS3t3PxKXEEKjCJ6QwrfWnIme2W3f7N+QY0YX8jGf:oAFVpdGRf83BPyREGfIngwYyGpczmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309934, "uuid": "cfb3d343-7f35-4823-be0f-3331043f6b8d", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309934, "uuid": "cf61be04-6a94-4595-9f1a-b4b654dbc4a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309934, "uuid": "0db869ce-20ae-4b7f-9ebf-8ed61b69eeb3", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0efcb6-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620285154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285154, "uuid": "ac3711e1-f963-445c-a906-5addb7904c7a", "comment": "Malware payload (AZORult)", "value": "41a8eefc3266fe55a90e522a016f54d4", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285154, "uuid": "fdd78855-6966-41ed-8033-37295353d867", "comment": "Malware payload (AZORult)", "value": "624e5509cedfb8121623c45d583c18e8fc351bf881aafb5c2de521fccba60240", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285154, "uuid": "60604f23-fd4e-4da2-873e-12c2636fca65", "comment": "Malware payload (AZORult)", "value": "a3a931064476409dd4114cf01668860ad5dab37c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285154, "uuid": "a925831d-1f19-4840-9abd-97cada0366d7", "comment": "Malware payload (AZORult)", "value": "ebadad184276fd2e51d275f722ce8201f75ee0e437959d6ff60351a50fba3d37ee90d5dd4e5a80e3c88ca2e725ea7f59", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285154, "uuid": "c7fc7345-84dc-431f-9a86-38c0fa065c22", "value": "5934E09531A0C4BED94205724D91D4A6BBBA5E1E6AD4264BB7F07F7E383F263810F213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285154, "uuid": "a93f1bdb-6d76-4c4d-8bca-e83b7324a3ce", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285154, "uuid": "929eb095-64ca-450b-884a-443f361e576e", "value": "6144:QPX1GsRaD9txmLq9zdBkuPGYuw1U6oyE5:WaD92L8oUPuwCd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285154, "uuid": "9301ce47-9ef8-4f6b-8bda-b9e75f7b22a4", "value": 241955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285154, "uuid": "d5510f5a-85b0-415e-9c88-b577e61960fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285154, "uuid": "52a44eca-149c-4b56-90b9-220a75dc8e87", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc22ee95-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295271, "uuid": "b64b3ff3-2d9b-48b6-a1c3-7e967c6e9674", "comment": "Malware payload (Dridex)", "value": "de576f89b9ca093261e2713ad4f7dab4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295271, "uuid": "194c84d8-a011-49e6-a87e-a134f18a46bd", "comment": "Malware payload (Dridex)", "value": "627a4315c33310b4bcbae28e575160f4e9f3bfb964da827244373116af309138", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295271, "uuid": "ace0bd4d-6f96-4c5e-bcfb-a02cba57d281", "comment": "Malware payload (Dridex)", "value": "ee05f491ad1e1caea83eb9cf945205dac521cee6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295271, "uuid": "c4b8417a-7258-436b-895e-7ae5c164889e", "comment": "Malware payload (Dridex)", "value": "0225ed1d8660a536f0d9707b2822b1a3f2f7f9b86deb2102a07a66e05309b657541792f15b11a37009feaf1b26c6d3ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295271, "uuid": "b14d612f-190d-4f1d-b3b8-be5efc0dc882", "value": "59F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295271, "uuid": "19a75365-b02a-4ef7-a754-4a383becbd13", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295271, "uuid": "ede5ace7-ca81-45fe-8a21-6ebd4ad4fd34", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295271, "uuid": "74b18149-a908-4a49-b509-007758160810", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295271, "uuid": "95166424-c729-47dd-9daa-12888df2b730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295271, "uuid": "886792e5-b7ed-428c-a978-70b1880acba3", "value": "de576f89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb25c301-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309791, "uuid": "9c2de9a7-483c-43f8-a934-0fe639fbe4e6", "comment": "Malware payload (Dridex)", "value": "192b2a929d3c130fe6ec53eef3d23560", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309791, "uuid": "4041af94-877b-4d8d-94d1-6b5f3b6d04fd", "comment": "Malware payload (Dridex)", "value": "62a6f202f204c39de68c4aaee1b58c6200c81e1948ef4b3c613673906c453b1c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309791, "uuid": "3039a2da-d9b5-4c27-a481-3018b2ff9284", "comment": "Malware payload (Dridex)", "value": "0cdf37abb553a1002cd54b0b7ac613f499e7c9f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309791, "uuid": "24438742-43f8-46b8-a545-5804631e1db6", "comment": "Malware payload (Dridex)", "value": "ad079595161f791f3769ab138ce3c38518b33fa854953948741fc2d5e8372f223b01dc3f3a3c88b49270980110c42608", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309791, "uuid": "fb2c5360-4ee3-49f0-b5b1-c1aeda8aa4b7", "value": "C1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309791, "uuid": "75e24a7f-08ac-4b68-9476-6ad68ab34017", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309791, "uuid": "19911c52-bbf8-4849-84d7-f9cfe4ecaee9", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309791, "uuid": "deb1a6e9-0135-4b80-bb91-132df6c950f5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309791, "uuid": "5d386a27-dc5c-4de3-ade4-5128509801fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309791, "uuid": "de7c2768-2d0f-46b4-a58e-70bf091c5566", "value": "192b2a92_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d6b3a5-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620262892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262892, "uuid": "9a59474f-0c90-4686-ac9c-d6cd7bbee0fa", "comment": "Malware payload (SnakeKeylogger)", "value": "3e2415567e8a31a1e8994ccccf77ec2f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262892, "uuid": "fd4fbaae-8981-4417-994a-2b3c0190abcc", "comment": "Malware payload (SnakeKeylogger)", "value": "62b89cf9dc23a0e8a747f61c8d97c43c833ce3f7ef600515cd4afb8cff38ca74", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262892, "uuid": "b8ca0784-81f0-4313-8def-13227b03f8a6", "comment": "Malware payload (SnakeKeylogger)", "value": "dcc790a44035516da0912938fee5b362534a2043", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262892, "uuid": "03b263f7-46f5-492b-92bb-99207325d566", "comment": "Malware payload (SnakeKeylogger)", "value": "b254c1a5a700ea38d4bfb79ff698bbbf5885ee47e773ee84e2411cd28c9ccbd6934a3b3a319e9174465a5cc8026b87c0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262892, "uuid": "21afbb8e-0b6f-4681-97bf-6de929c7f2b0", "value": "B4C41257B65CA79ED39A97B234761334C7A8DF5302456A09FBE1FE6E113228CB8072C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262892, "uuid": "f489bf10-4898-4ac5-b732-64389c882709", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262892, "uuid": "c2839122-673b-4cd3-b821-a7f706aef9cf", "value": "12288:LEVwbQQvMGprcOGB1JCCddIsEAsU6ym0EihEgm2d:LhbLEGpAOGDsvMsU6cFhE92d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262892, "uuid": "b4c6cdfd-9368-466a-80c0-ccd7b61c8298", "value": 581163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262892, "uuid": "692c37e9-8518-45a5-90ad-3a92b83776b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262892, "uuid": "9b88bf0b-ed40-4ac0-8c76-005d2fc3113d", "value": "3e241556_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c235ef93-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302475, "uuid": "37413010-4bde-45cd-89be-15590f5390f5", "comment": "Malware payload (Dridex)", "value": "3533a8d00ad6e127558e776387c8207b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302475, "uuid": "2ad30801-69fa-4984-843f-9176ef1a04e5", "comment": "Malware payload (Dridex)", "value": "62ffd8a9a56a86c2f7915c7d99c28844b0c9980af25bb1bed3c86358dd43d3f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302475, "uuid": "5ba0e903-d09c-4478-bbf1-849b0d370154", "comment": "Malware payload (Dridex)", "value": "8029bd38c6762ff30d909f2c3eeb3017e0d9de8c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302475, "uuid": "353d2ffd-22cb-42ba-98b3-c086503b63a7", "comment": "Malware payload (Dridex)", "value": "13da84a66e5e817decf868f4d38220e6e90676f2283eed23b49fc621a05864d24cd12d6b6cf95c8cb663f3b8adaf17bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302475, "uuid": "7af3486b-9e49-41b3-a12e-0c319ed83918", "value": "83F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302475, "uuid": "a312f69b-38be-4815-9cb9-a795449b0ecd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302475, "uuid": "19b980c2-5254-451e-99b4-2052c33f23bb", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302475, "uuid": "d85435f7-8a69-4c3b-99a8-6aa6f3d79d0f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302475, "uuid": "a5687e18-f6e4-4230-a8d2-47b356fd69a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302475, "uuid": "cfe564eb-ef40-4c8f-9d63-481275ff6ab7", "value": "3533a8d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cd78b3-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620310192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310192, "uuid": "05ec16ca-1b7e-42a4-b800-494cdb4bfc6e", "comment": "Malware payload (IcedID)", "value": "5c0b0feb91abf356951d511794e1f291", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310192, "uuid": "d87d604e-756b-4793-9e70-753e62b58250", "comment": "Malware payload (IcedID)", "value": "6336738df1d9a6bf7e94996c8283e6963b41dc3bc9ef93c25653d887a36041b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310192, "uuid": "06c9bed1-a11f-4835-9773-0abc65623bd3", "comment": "Malware payload (IcedID)", "value": "f576e67a99e4907202aa8d867673fff7c1d1a2f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310192, "uuid": "7240acde-ad09-40b0-8b02-da192f5a452e", "comment": "Malware payload (IcedID)", "value": "0e6e33f7c269901a1fc7b93ed5ea824646ac5922bbf2659f94800a535071ebf40c7e0a643f53fd1d32679f139e752678", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310192, "uuid": "f884d7ee-7939-45d0-bffa-ee5db858b494", "value": "C1139E6BB2E0D2F4ED03CE7CE418964D592CE7114099168EF026EFE1DCC7A56264F29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310192, "uuid": "638b71ec-e0d8-48dc-97da-7339a8d98f9e", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310192, "uuid": "d127ca8e-b9d0-4df6-aab2-9d2c872d8323", "value": "768:pTO1zkQB2hBi3IUwV8Zh3uydpBEt3ChnDoX8w5houu3wh2hm3e:IqkwV8Z42BM+nDghouu3wOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310192, "uuid": "b07896b4-61bc-4a47-af1c-33f1b7372954", "value": 43650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310192, "uuid": "305ef424-9779-4f26-b32c-aafdaf406b9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310192, "uuid": "4d0157a9-93be-4158-8fa1-bd7a6f87ea63", "value": "5c0b0feb91abf356951d511794e1f291.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ad4be0-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339441, "uuid": "2daf29ca-4a83-44ba-8a43-d3369e9a3275", "comment": "Malware payload", "value": "7626ff05c85f15e43256104e12ab51e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339441, "uuid": "8d143fb6-539c-43d8-a598-8826ad47cb08", "comment": "Malware payload", "value": "6339394c3d659656e26d64a4e067902e515f562c0e421bfcac7c6309fcb3994b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339441, "uuid": "44f3b7eb-4905-4991-93ee-cf31f52bafbc", "comment": "Malware payload", "value": "857509ef1d1f54c1d1f5ec1a298eadd5fb69e76d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339441, "uuid": "b7bccd0c-458d-4717-a23c-3b756ba28979", "comment": "Malware payload", "value": "6521668899cac9a6888ce138d2c6131686afceec78b22289a9ea5542587b7de23ee1d87f61bde1445cbe5b3ae98f01cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339441, "uuid": "0078bd9b-fa73-449a-a602-1e0a3ffa26c6", "value": "6EF3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339441, "uuid": "8275fd18-8246-4e3b-bebc-224cf40d6429", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339441, "uuid": "d7b6407f-67bc-409e-a3d8-c1935e032374", "value": "3072:iVG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:PERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339441, "uuid": "1d699958-ca06-435b-a15a-f1b9fe68a45b", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339441, "uuid": "bd0b63d3-404b-4c05-b486-db2403fd37ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339441, "uuid": "87adc096-f12f-45a8-89ec-483b1890950f", "value": "7626ff05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02337735-ae8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320621, "uuid": "583ff68f-6f72-483a-b160-08eed4cd7ff1", "comment": "Malware payload (Dridex)", "value": "6f869adb3716f2821a96690b3f9eae85", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320621, "uuid": "b0fe34e7-8a08-4a8b-b661-f6f0bcaef074", "comment": "Malware payload (Dridex)", "value": "6354dbc47302104f46b8262e80cc5708938671f1c2f17cc876ade5c3db9dd91c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320621, "uuid": "fd32ff11-5819-4820-96ac-6e9509b8d558", "comment": "Malware payload (Dridex)", "value": "fea2a6516d243d6524b9bf1a2a63fd025296696f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320621, "uuid": "db300979-d5f3-4d31-810d-cc681b83da08", "comment": "Malware payload (Dridex)", "value": "4ba77128d278645c6eeeb185ce2dc47e8ea18e4315c875b6fad55e13dea624e199bf5f20883f0b807527d0576405117d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320621, "uuid": "9f77f35e-6d8e-47bb-9fb2-0096192ec37e", "value": "2FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320621, "uuid": "c4091923-15d5-4001-8d7c-576ddef3b288", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320621, "uuid": "a6e87e0c-7362-4f43-975b-4e3fef696a1a", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320621, "uuid": "6b344686-e040-4e9b-b8c2-76947ed78668", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320621, "uuid": "4a0d16fa-c140-4fdc-9fbf-2aec757a3456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320621, "uuid": "3bb00f1a-9b4c-4149-a41c-cb39e01a5da2", "value": "6f869adb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cb0e76-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338852, "uuid": "b1b33b1b-f37c-426f-afe6-d1e833e77ae0", "comment": "Malware payload", "value": "ac43ed6d01a14b0d58da89cfbea2a34b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338852, "uuid": "797f23c6-c3b1-40b0-8f10-5bd7b2258afe", "comment": "Malware payload", "value": "635ade9afda0a185157cc20690c8189415c7355e90225269f27ba42ebc5cbe1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338852, "uuid": "5bb95143-34a4-4fdf-8228-89daa619beab", "comment": "Malware payload", "value": "e7a03dd7fef174c1c133aa57d8f830790f22b21b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338852, "uuid": "79ea3adb-9f2b-45cb-a442-536ed1c8ee7d", "comment": "Malware payload", "value": "4f85103679a469e9efae80555ade7f1521e0570c871583a0c784113cd5e3b155a99f456e727aa75e3ac12f9b2febb2de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338852, "uuid": "39144a09-f4fb-43f4-a3ab-62bc16a24634", "value": "05F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338852, "uuid": "dbf40ca5-cb5a-4f38-b14e-5b8fa7123263", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338852, "uuid": "8ab46412-4a62-4aa8-af72-4ead5d1ff7b1", "value": "3072:sB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:a4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338852, "uuid": "0fa0433d-af21-4105-a45c-9248fd3e10b7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338852, "uuid": "0fbd58fc-df99-4314-8342-d955989ba58b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338852, "uuid": "b9ab7050-7576-4adf-9eeb-880e874692d4", "value": "ac43ed6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f41d09-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338510, "uuid": "85e57977-b2ec-4062-be84-0896d7d17d58", "comment": "Malware payload", "value": "9c696cb9c1c105267728511ff6b56279", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338510, "uuid": "87ff4d5f-2069-4bea-b8cc-f13670c9b8b1", "comment": "Malware payload", "value": "63abc500d2a9f12692276d1cd2becc0ce16719ab69a69ea9827bd411f12b4291", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338510, "uuid": "6febf98a-f865-4abc-a078-02c86f9c3eab", "comment": "Malware payload", "value": "3e97c42c9a074393971f138eeda73c4d6848b3e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338510, "uuid": "3010cecc-6f5f-43a7-a80e-6401251486d1", "comment": "Malware payload", "value": "41bedc94a2c2f2b2562b3e2a0d5af31b649a91c03332c14569f7569ef5229c20a22fc7c4a4ae60a610a66c408f206e9c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338510, "uuid": "d68a92d0-f088-4ede-a229-6dc4fcd8c522", "value": "90C53397EC51473736AB0604254123D4B8632BFC994793C3BEE982B444CE916E9EDB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338510, "uuid": "bbe286c0-ef25-406b-b2ee-4e581e008218", "value": "49152:TuCcUdUCXw/0UAGKnVH3p/X7OQK2n1jUQ6jJNgBOmMeImC+nhmOVPGDSEgL:yCNUr/0UgJXCQK21jp+JNHvehNOOEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338510, "uuid": "e5780576-871c-40f7-8f3d-9fccbf716024", "value": 2529522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338510, "uuid": "0416512a-4e84-4894-9f9d-a095cdd191b4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338510, "uuid": "126fc224-ff5e-4641-9726-cf5deb620fdf", "value": "9c696cb9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca397e9-ae2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620279058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279058, "uuid": "cc92c10a-b127-472e-9903-84c53b63935b", "comment": "Malware payload (AgentTesla)", "value": "68c616d41b682e6858274540d81b2aac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279058, "uuid": "9e3e2a20-9cd9-4580-b671-d3553375cf20", "comment": "Malware payload (AgentTesla)", "value": "63b1cd3b4bd84bc36bd121bfd7640f5ed1c6eff5faa8bf797b349cfcd7fee23e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279058, "uuid": "94970e29-6036-4eaa-b351-2ddce1cfd119", "comment": "Malware payload (AgentTesla)", "value": "e5e5237e9dd6e30ff3711b600c63dc21f561033b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279058, "uuid": "aff32335-48fd-4edf-8578-edb9e58d8cac", "comment": "Malware payload (AgentTesla)", "value": "41e4d9a32c57e0c1ec4f67457fbd7de0e39570bbcbbe57137f956cd18250fbdb9c1e2dfe27150f6ae736580c9cbb1005", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279058, "uuid": "7ac9d175-b8f0-45ba-bf57-3d837fcaf80a", "value": "E1C4239D9707C8439A7CAE3454B61DC50C0863FE8150B4FE16BDA0CEB70D8EEA81D99E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279058, "uuid": "eb6f29cf-9295-4b6d-9ee5-fda1f6469dd1", "value": "12288:RFP3x4WWEXntIrz4N37JinKFQSA0fIq4BEq:RR3xrXtoOifZ0fIq+Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279058, "uuid": "cb90ec1f-db9f-4a66-9135-606a2ca086b3", "value": 549640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279058, "uuid": "05b05b02-a9d8-41be-86f2-12e4b8382448", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279058, "uuid": "93d7822b-e813-422e-832d-e934fc91d5c4", "value": "proforma invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30318823-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331436, "uuid": "e02829b3-7cb8-44e5-b640-626732a8b107", "comment": "Malware payload", "value": "13bd1321f4065bfd1df12a3a63d5a432", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331436, "uuid": "7c0b4a7e-41fd-4957-a998-34137af2fc35", "comment": "Malware payload", "value": "63b61ef670ed34262d7fcf8e4cb57b18669072f6892fc4e5561a704aa1dc9d8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331436, "uuid": "76806fe1-69a5-4f10-a2fc-58d8f9180b5e", "comment": "Malware payload", "value": "8581b072879471fc83891af1f70652e3ce83c225", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331436, "uuid": "62d5acde-a2c7-4efa-a45e-5f8e884040ba", "comment": "Malware payload", "value": "4210b7f565181f549390c67d0ecdea6a234aac79d6bfdba71c7e786c46c262534661fd4846d9e408cff2e983092c76aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331436, "uuid": "dd2acfe8-e99f-4479-bfd8-7d717a69ca0e", "value": "56F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331436, "uuid": "1fb6d5f6-b1ce-42b1-92d1-41026d5fef98", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331436, "uuid": "f87253ba-fdb3-49a3-adb1-807738e032c5", "value": "3072:1bG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:sERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331436, "uuid": "4551d8c4-c672-441b-a56d-cd99ee3bc798", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331436, "uuid": "c7062408-24d7-427b-8afd-478cb608f822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331436, "uuid": "00934495-9ea8-4fb8-b42c-f3be18a97d5d", "value": "13bd1321_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd71cd3-ae6d-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620306947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306947, "uuid": "aca4ec2b-b5a2-45e7-bb9d-122e3faf37e2", "comment": "Malware payload (njrat)", "value": "b67e8b1b74e705a0cb254caa8687c93e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306947, "uuid": "c6856c20-3218-4fd0-b648-0cc3ac902617", "comment": "Malware payload (njrat)", "value": "63c2ab0ece24b47cdcfe2128789214f87451a3d82d641a418b32afebaaf07b51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306947, "uuid": "c33228e8-d029-41b0-9bff-c4bfc6a0797e", "comment": "Malware payload (njrat)", "value": "59038745c1029d12e629ff8e0ccd7c1ad1476efc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306947, "uuid": "c509e8a0-d556-4d74-ba9b-7c56cda6d683", "comment": "Malware payload (njrat)", "value": "7eee34d5c87a577868ba11a7ec161a8fee68e776ee68fe6fd1456fd05721f69e5f7c4c8630c612059564f554033e7ca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306947, "uuid": "e5b0224c-4509-4922-804f-3040767b2325", "value": "AE34C0077A5B4B11E518F2B0A2DF207153E26BDB2B7387852F08726DAAD33979E1074D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306947, "uuid": "06224393-972d-44f7-b0c2-836fe08cca6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306947, "uuid": "fc7a1c07-1d10-4aae-ada5-25d321bd4d0a", "value": "6144:jbPFWg797V7CvkziWkXAIBtEUetFTZdXTZdHXTZdXTZxrUVc9CRuUMfM447:jsY9h7ukziWy9EUKFTZdXTZdHXTZdXTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306947, "uuid": "bf5684aa-83c0-4cae-8605-c284a886e7c9", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306947, "uuid": "f6bc9f0c-eeed-4978-9f0a-96dbfd5675c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306947, "uuid": "7daea06f-4a1f-465a-aa06-77bf13421256", "value": "63C2AB0ECE24B47CDCFE2128789214F87451A3D82D641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e6af28-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285534, "uuid": "38b32caf-93a2-4e77-87c1-dfbd15336117", "comment": "Malware payload (AgentTesla)", "value": "daaa8878d09b85b1c12b37da7eb3f075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285534, "uuid": "e27eaf2e-fa97-4a00-884e-2ff5b46733fd", "comment": "Malware payload (AgentTesla)", "value": "63e6607730c26cc1b181a5a7779c8488977f23c88020dcd305af2cf9eb6498fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285534, "uuid": "8ddb2b31-a981-457a-a45d-a7c848cd2abd", "comment": "Malware payload (AgentTesla)", "value": "5f95303e48b6f56edb31c2de5a98ba82e9c91cc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285534, "uuid": "c30ea75c-dc5f-48d0-9699-7670ccd94503", "comment": "Malware payload (AgentTesla)", "value": "496c02ee75c421abb6c7fef8d9173a5ab993d69c34b59e3c72d53832f87266b6a0a4cd7d9739b4f0516abe4a8dc1f904", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285534, "uuid": "cd06ca34-40ce-4b77-9964-42a5611c24b4", "value": "F2554B91A154C8A5E87B07B1AC2BD53011E37E4DD5B4C10C69E9BE5B3BB3382609FE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285534, "uuid": "cf99348c-8960-4006-be7b-6060ea42025a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285534, "uuid": "63653352-b3a2-4117-8aa1-86302eaaf8f5", "value": "12288:+tzIMDvDLhYYw5UknosArccE5RQrd/fVPudGi5ZLcGM:+IZO3bPudGi5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285534, "uuid": "b033bc3c-c4e9-405b-a9a2-40ffe487ff5b", "value": 1375232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285534, "uuid": "a5b16930-034a-469f-b4e0-6a3ecc578232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285534, "uuid": "78a5e568-5865-4a88-a221-cf4cfa0a584c", "value": "KUTIPAN REVISI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2334056-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291711, "uuid": "2657c488-cea9-4760-a4d9-f79869897c23", "comment": "Malware payload (Dridex)", "value": "f578b9e7a884a7412c08eee9639c9ef8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291711, "uuid": "483222dc-e9c7-4380-905a-4c4523f07425", "comment": "Malware payload (Dridex)", "value": "640abbd5c1b88cda2e44e559f74a559d33d073582468a85ffa5f3c4524530043", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291711, "uuid": "d732ce39-ac93-45ee-931c-695601ddfdf3", "comment": "Malware payload (Dridex)", "value": "eea1f6ef0b8cffd325409bbea53318072e6382c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291711, "uuid": "f222f3d2-254c-4247-885f-ca13d5b09bb4", "comment": "Malware payload (Dridex)", "value": "1b5fc70e48e60e6907927cf536be6bc8146809ff8f77fb5bcd109873dff6a9052f0018f2b8ddec9397030ddebe80dc4f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291711, "uuid": "74dff9b5-73bd-410f-808d-4e411e486edd", "value": "15F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291711, "uuid": "bf2d4b2f-aee4-457e-b7cb-3f5e956a5138", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291711, "uuid": "b798d4d5-edde-4654-a52e-cd7f51b05784", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291711, "uuid": "e3e3b1a8-d569-45c8-9f52-9e1deebde0f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291711, "uuid": "9707751b-601b-42df-bbc9-6f926796f711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291711, "uuid": "98ea92a3-8377-48f5-aac8-62192ec640fe", "value": "f578b9e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d9645c-ae27-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620276946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276946, "uuid": "a8bbae72-9178-4741-9a36-38861d4aab42", "comment": "Malware payload (AsyncRAT)", "value": "b7293e08d74bd46679ba9d8676c905ad", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276946, "uuid": "7b8030bc-5870-4c00-9318-5cec6f9e7326", "comment": "Malware payload (AsyncRAT)", "value": "643bb75abd587887ae08a595d8c194324896a35e67e7e1f9d0cbca072d80a35f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276946, "uuid": "a26ce2ec-72d3-4951-9b37-d0d2003b2c83", "comment": "Malware payload (AsyncRAT)", "value": "b64e7adaa11fa0d7ef383812978ffb0346d4ccf9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276946, "uuid": "8655cc06-99cc-4af5-8423-608f3160b53d", "comment": "Malware payload (AsyncRAT)", "value": "a1794e597b90b1e71aadd167e6f7d90e763e474ff7a3676788653bd2cec1a92a598514c4de925dce6eeac111e710ea34", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276946, "uuid": "3331437c-8dad-420b-b10a-685c8e1d64de", "value": "0A05F6EC751075EEC617CC22DBCE1C15E6202176972B9607932303BD9A0EE5BAF385DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276946, "uuid": "985e759b-6723-4daf-90bc-51e5d2b4dd2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276946, "uuid": "de50ef89-7b0d-4dfa-a986-6b1abf20051c", "value": "12288:WROttA8HoLLoS60/K7yh0d1te/Hr6lGqso9i8J7s9wQtVnPN+wYQwQsRuxhThAvG:ZbHoLA3sPr6kqB9im7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620276946, "uuid": "bf77364f-8ec0-4b90-8cac-4ce346463073", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620276946, "uuid": "a64c915f-bbf3-49b8-ae7b-07e5f0714183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276946, "uuid": "d1aa0e83-e8c0-4bab-873b-92f46b6bc3d3", "value": "purchase order 0234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2da42d-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285389, "uuid": "fdcaf774-8f83-4988-abcc-bad5b950c9bd", "comment": "Malware payload (AgentTesla)", "value": "ecfc6c65c53f78fa82faff8981295499", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285389, "uuid": "5b181c98-31c1-4f6b-8237-fae3f3d969e0", "comment": "Malware payload (AgentTesla)", "value": "645937f8235884d105c16d523a5431c4f60dcb5e6f0f55c4b688b7b4de6b1edd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285389, "uuid": "8f9d42fd-f936-47d9-9c2f-873ba9b4c9ac", "comment": "Malware payload (AgentTesla)", "value": "29186e01a704dc2cf1a2c013c5291e0edb6eac63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285389, "uuid": "3ed04507-470f-42b5-b2f8-70b1a49e4035", "comment": "Malware payload (AgentTesla)", "value": "d75fa2824927cbdf748edfb546cf2460b2237ee77aad33ad517d81bbdcda241f5aea955bfee1872aac607c846568ca7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285389, "uuid": "23988966-280f-4dd4-9efe-08155c5c7750", "value": "9C359D2222989924E17B63708062C13947F67E02E776D75DAEE87CDB3F336C19A57213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285389, "uuid": "e3e95e42-919e-45dc-a591-d2c1b03f1151", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285389, "uuid": "c744186f-5ef0-4d02-b4d7-3f6b27a725df", "value": "12288:F6bWwrnBUnomC6SOLI2n58xF3JdnAWppd2Ozi7bxa/WkSM:F6bvEC6FfW7dn+xa/Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285389, "uuid": "f892ccc3-bc9a-4aec-a723-09244e1ca86f", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285389, "uuid": "c7b112de-1c1e-44d4-a466-f8cf9ab0722c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285389, "uuid": "6b8a0579-945b-43ec-a4c7-b581954a4d2f", "value": "Order PO-NO065979_Quote pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac65052d-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262925, "uuid": "174d333b-94c0-4fb6-be5e-145ab22ae7dc", "comment": "Malware payload (Dridex)", "value": "8549a9b2b4518cd57840f0fbb166d34d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262925, "uuid": "a7053a1f-4104-4068-88f4-10d92a7da07e", "comment": "Malware payload (Dridex)", "value": "646fc92b0a6c84b26083146b5f6b3fb2cf060daaa7d6a2851f7c67e9c6451a58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262925, "uuid": "888cca0a-2357-462b-b738-e7ccd03a56fb", "comment": "Malware payload (Dridex)", "value": "d5d2cbf9dcd75f88cbdccbb462cecf9098da2fb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262925, "uuid": "d524ed7f-b7f4-4881-ba52-45aca8bf575f", "comment": "Malware payload (Dridex)", "value": "7d235fa884334e7f436768ced952cb190dcad12c89a7b2cdb1fd5639cc5d6332013fa54e336b4a618e9f71757f814604", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262925, "uuid": "81738bd8-e692-455f-9bea-0622a8a7b6c2", "value": "D0F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262925, "uuid": "6732e30e-a677-428d-b114-7916026d3457", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262925, "uuid": "42ede88e-5221-4c61-815c-a1c5dcfc3091", "value": "3072:3B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:64KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262925, "uuid": "28ad4095-11a7-4b55-8a0f-dba9ef5d1e20", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262925, "uuid": "f8248925-de9b-4f2d-8dee-5e1abb1ab8dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262925, "uuid": "d7950c28-88da-405c-854a-11a117760569", "value": "8549a9b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dc12ac-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339183, "uuid": "97dcba36-ac3c-4d6c-adf0-56142881142d", "comment": "Malware payload", "value": "d13de03f9d7ae69135e493b55dcfe59b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339183, "uuid": "e0db9411-2c01-4ca9-93c5-25322067aac1", "comment": "Malware payload", "value": "6471c0354c18e18c268add72a72235f0ec4c6f52f980d80a395881ba38c4d141", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339183, "uuid": "f7bad234-c03f-4eea-90a9-301e891ed416", "comment": "Malware payload", "value": "04117bb2da0097406466c79734981698ef665553", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339183, "uuid": "9a659177-ee53-48f5-a663-69f04c8819c2", "comment": "Malware payload", "value": "3a025bcf13d7631da707403ac7ebeae91dcdc88e1656023bd7ca357bf2de46c940c4fd049a0d57678271af1c37cb9600", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339183, "uuid": "759b5681-3f17-4755-9b14-3954c1720fb3", "value": "61F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339183, "uuid": "c73132dd-9992-41f8-a32c-78db05081eb6", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339183, "uuid": "dc9599f6-4585-42f6-ac5b-61b3f55c3ba5", "value": "3072:5kG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:BERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339183, "uuid": "8c810c2f-6ec5-418f-8a80-f278dec29918", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339183, "uuid": "6ef838b3-0bac-4d9d-8e96-bc3241f026af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339183, "uuid": "70271482-afc9-47ff-96a6-954b6a1f2d25", "value": "d13de03f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caec6901-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284451, "uuid": "0b6e3640-7d47-4f62-aadc-a6fdd7360ed8", "comment": "Malware payload (Dridex)", "value": "5706bd3ca686631accfc01977a69a513", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284451, "uuid": "6d324e63-df95-4daa-8d61-49f05b4484ab", "comment": "Malware payload (Dridex)", "value": "649050990bc5ec9bbc7cd566f7c3f9dcde11ea1b40c379287f7e5b3e84fe5445", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284451, "uuid": "7fb85aee-47e7-4564-af6e-d3385a70c3e2", "comment": "Malware payload (Dridex)", "value": "ac830569a3b1292d47af4384d4bd56004a2596d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284451, "uuid": "f1020c5b-a905-4678-b67f-88be9678972d", "comment": "Malware payload (Dridex)", "value": "ac0c7f2cc0cc8c70f7468f4d1d20e125abbce21ec3775517e2a7b28a0a5598d9291c65bfcfc74ff55fb0a11d8f50bb60", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284451, "uuid": "7ddb1162-0774-4bc3-b300-896e63e4607c", "value": "25F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284451, "uuid": "29f4b324-5dcd-427c-bdd6-6d818e36a23d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284451, "uuid": "30b8fd0a-4ff6-4d53-ae27-b9039855896a", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284451, "uuid": "9ee53738-a488-4eaa-bcdc-11192b0cbda4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284451, "uuid": "213c70b9-9ffa-46bd-9462-5c71341f3d07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284451, "uuid": "fc8172ac-2458-44de-a372-5cf845a77755", "value": "5706bd3c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3c8848-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331375, "uuid": "fcdf4ae2-9960-4d56-95d9-1e477a99a966", "comment": "Malware payload", "value": "f6fb72ee531c7ffcafa497aae2996012", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331375, "uuid": "a2e976ce-4151-49e5-9662-fdd693699175", "comment": "Malware payload", "value": "64ad0d516bf60c7a184065a37579bcf7cb4a74c7849e69d555c85b8d46fcfa36", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331375, "uuid": "2516673f-42f7-45bf-94a0-5d6c7b2f468a", "comment": "Malware payload", "value": "8d4c9ad261309a836a96acc141884bc326ed8c5f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331375, "uuid": "ceae0baf-d8db-4bdf-9e6b-6869498a1d1e", "comment": "Malware payload", "value": "96fe0e70c5c4efefc2f9dbc079e3c8fb3906d466065ae8ec4c86a70f56aedaa47b4566b1e1b54926ef3074bd096a5303", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331375, "uuid": "a5fc34d3-be59-4042-842b-61a7e36b260c", "value": "EEF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331375, "uuid": "9b33109c-838b-4082-a5f1-902d0c247aef", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331375, "uuid": "e33a3c1c-606d-4ee1-8e64-8a963cb0f9b4", "value": "3072:PbG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:CERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331375, "uuid": "904ee6c4-3650-4348-9206-fb5959b44b75", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331375, "uuid": "986044ac-643b-4c9f-8dbc-705de1fa9af9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331375, "uuid": "cb25562b-6b0b-4464-8edb-75803d864a89", "value": "f6fb72ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4586f7dd-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313433, "uuid": "1b327abc-6873-4abf-8a7f-9056fc14bdb7", "comment": "Malware payload (Dridex)", "value": "0dc5e26b34b3ce3a94d276707bb6868d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313433, "uuid": "d00685e2-e6b5-44a4-b52b-2a5d63c0edb3", "comment": "Malware payload (Dridex)", "value": "650af2ded93326ddf37529a4053b128567cbbfefc19f78bc7d369ee8dc8d31b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313433, "uuid": "1a5c9cdb-61fb-40a3-a7af-09e7658c91e8", "comment": "Malware payload (Dridex)", "value": "a44b7c2d840aca0967cb4bc9e2b351469f8d0bb0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313433, "uuid": "3af77b1f-352f-4977-b61c-e300c84ddd1d", "comment": "Malware payload (Dridex)", "value": "12babf97a27ab603a17de9d5c753e3d68544e9cb602cf70c4d6f4741ae05451710ea845ca533233fae0e01af73c1babe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313433, "uuid": "b92b716c-6f03-4fdb-a291-f6288cfdad2d", "value": "80F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313433, "uuid": "05521e67-cd4c-4eba-acdc-406f8ed0b67c", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313433, "uuid": "3d662e33-78e6-4b6c-9915-c1e28af6bb1e", "value": "3072:SWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:S42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313433, "uuid": "3f5e6a00-a523-4f46-845c-2a5dbcb21937", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313433, "uuid": "c52e33e3-dc1c-4d79-a6b0-d9a674e786c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313433, "uuid": "22567e94-fcd4-46ad-9264-605d8d02c1d9", "value": "0dc5e26b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5e78e8-ae22-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620274843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620274843, "uuid": "51881005-7415-482a-85c2-7d830267de86", "comment": "Malware payload (Loki)", "value": "618a3903f6ae4795491b9087782a5cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620274843, "uuid": "9fcc592a-8323-45bf-8cc2-4cee2df574bb", "comment": "Malware payload (Loki)", "value": "6522bd3205d4f2eb0e2ed19912a478379d47f5c47dbbcd351d6de4f8b7b5c778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620274843, "uuid": "7ddd198f-8d9a-471c-a1d1-d0338be06eff", "comment": "Malware payload (Loki)", "value": "e44e69b570ac83abb0ca67231f25ab862acb3aca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620274843, "uuid": "8901201a-587f-47ad-98c5-453c2514dda2", "comment": "Malware payload (Loki)", "value": "250065af1290ac962e6f20425a83b797d5de6333db66c3d23844c7e73b3daaaf19ad05f592be53926efcef0cf5d105ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620274843, "uuid": "960157bb-aec4-413b-9123-8162dfbbe2ff", "value": "D9059D0067E85FD7C6CF47BAE199261193F5D006A69BFB8B6948EEF53C9339089011E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620274843, "uuid": "b159b8c1-efb0-4f51-aec0-161d9e4fcc69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620274843, "uuid": "2d52c3db-48ce-4d9d-a749-0a2aff73d42f", "value": "12288:e1fxhwL8mLAHefRIZtbVqrTwqEZI2wx2oJ6tJsPfP67e45:aZyJAH/ZtxqEZdwx2oCCfy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620274843, "uuid": "c7a958e8-982a-480e-a71d-abc3dec66d2a", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620274843, "uuid": "57f44a31-367a-4696-89cb-49cc96cc9c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620274843, "uuid": "b7888ec1-e8bb-4d71-a38e-1260462c27d9", "value": "MV JUDY V-2107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88be0a21-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280904, "uuid": "e926a472-c36b-41a5-ba0a-a8921a885e9a", "comment": "Malware payload (Dridex)", "value": "ec412c9de85afb1b4631ca2519592546", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280904, "uuid": "4215795a-3922-4652-b9ab-165a942ab971", "comment": "Malware payload (Dridex)", "value": "654d68b78fb74bba672091af20b37d45174e8f69bf5da54c7328ae99f0c5c271", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280904, "uuid": "67a4b853-42c9-48cb-b314-40964c73191c", "comment": "Malware payload (Dridex)", "value": "853bad90c9f796c8b22fac0edaaff64bb4426d6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280904, "uuid": "0d05d4eb-3edd-406a-bd02-3a71efd5ed4b", "comment": "Malware payload (Dridex)", "value": "cf56a4e4d7ebfe1112f0e9f8c3254cf9a83eda3d9695f7d64b26c150ff2c6d7e325a665b4dfc427dd9b858732de6571b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280904, "uuid": "0ed091ee-d5db-4a3d-9ef6-76946bc1dfd2", "value": "2BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280904, "uuid": "650f7f3e-bad8-4f1f-a0a8-a3acb3ad5ded", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280904, "uuid": "fc1441de-a66c-4036-8b92-5170c287504e", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280904, "uuid": "e5029db0-7c90-414d-952e-de9dd72d7be5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280904, "uuid": "e3498280-132d-4e88-a8a2-50f4d7cb9cd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280904, "uuid": "6db93f40-1c39-4573-9b36-c1880acc8e44", "value": "ec412c9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d74632-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338580, "uuid": "4526e691-8a41-48bb-ba70-89e2fa00af07", "comment": "Malware payload", "value": "77e1d9aeaab9c3c5166bbf3727a6e4d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338580, "uuid": "eb68ecfc-86b1-4783-bec9-d67a96232237", "comment": "Malware payload", "value": "6616bbf624c843530e50c6e4e69d4b7c6f2d6025ed1b845833158136159961e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338580, "uuid": "523e74e4-1753-4689-aafb-8bdcb883892b", "comment": "Malware payload", "value": "4ee069a8273eaf4b6d4f2ad0b47323b50a01e0f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338580, "uuid": "6b8d1d10-58d2-4eed-a3e9-e2c341523700", "comment": "Malware payload", "value": "96fd62f78b82000158571a86323ceefc55710c26180599fc20518d24a3dc9f5e8138ca917a38dbe3439f0ae25d9a2b8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338580, "uuid": "cd8e4d71-1c2e-42b9-bf71-ce0f60f29496", "value": "B0F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338580, "uuid": "20f603e9-1afc-45aa-8acc-4c70655dba26", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338580, "uuid": "375d03cb-a2b6-4bcf-92a2-12c989eed085", "value": "3072:3kG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:7ERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338580, "uuid": "d2ded29c-741b-4163-a43c-ed6df8f6289f", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338580, "uuid": "701a09dc-6036-4d9b-b254-3b68fee448ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338580, "uuid": "7a127a58-9998-4457-9683-f25943e35506", "value": "77e1d9ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b2d9b5-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298934, "uuid": "ef4d5815-3f9a-4de3-92d4-21c8dca267cd", "comment": "Malware payload (Dridex)", "value": "5428c6444f348233145cf86ab233f47b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298934, "uuid": "f34d52c5-cf63-436c-b3b9-7d1c860658db", "comment": "Malware payload (Dridex)", "value": "66627a35584dbe8f9a1451d0124a3169fce8e8d5a9558c38f6fc2d90802faf81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298934, "uuid": "05392127-6f49-4636-a1ee-d17d16a4fffc", "comment": "Malware payload (Dridex)", "value": "787b57c22cb8f74b0632875bf46dbc9a024ad372", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298934, "uuid": "f94eaa7f-cba0-4de9-957b-ab07ae8f04d7", "comment": "Malware payload (Dridex)", "value": "9620a9a5ebe597f3c1f04ce0a788ed1510764c39e4976bec6bb99458b314f49038fdea1ac50b8b0238732f7ac0e00e1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298934, "uuid": "fb5750bf-3c32-4e78-83cd-8945d18ca0a0", "value": "72F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298934, "uuid": "adc54b66-ef11-4a6f-a417-0d78320608c2", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298934, "uuid": "9eaadfdc-ec63-401c-8e06-f93ca7d589f5", "value": "3072:JWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:J42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298934, "uuid": "285471d8-6f7a-482d-9869-d73544e660ca", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298934, "uuid": "bab74e4e-e7ce-4f03-87e8-80789c490994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298934, "uuid": "0bf57c7c-2f23-4702-827d-245635322ea4", "value": "5428c644_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374e71e1-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620259292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259292, "uuid": "73b9fe28-5185-4258-9a21-cdece2acbd86", "comment": "Malware payload (IcedID)", "value": "4663d5c264c2a2ab8711e10cdeb9c138", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259292, "uuid": "bc280f00-eca5-4af9-a834-1329cf96dca0", "comment": "Malware payload (IcedID)", "value": "666a39015d53540460f6f3b5347d22457dfefd8ace09048503e7c20bb4ecd2f4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259292, "uuid": "2912be96-7df4-4893-a768-a887750a3866", "comment": "Malware payload (IcedID)", "value": "1e08012e2fb7a5f9237c9f21ae19b9b5a0cd979d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259292, "uuid": "8880fea7-4da0-4b3f-92ea-1ecd3deaa52f", "comment": "Malware payload (IcedID)", "value": "95a1c2111f82db19b1c0bb70ed10c28170d0a2060cdddb8373f40aa3e88a90c343963a45cc5ecc373e2e4c30c243dfad", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259292, "uuid": "3a330868-a1a4-4447-b9ab-c8874094591e", "value": "9F3441A689A8E0BDF50628B2643CD745C950EEC05E53DCD6B5F384229FA39F617123CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259292, "uuid": "e8dbb4fd-2a8a-4b18-ab0b-9dc5389ae074", "value": "e0533e6b0ac9b87b7ad9ea052e7fa74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259292, "uuid": "14536f43-8d72-410a-bc5b-ff741ee62248", "value": "6144:LbG2zudGcUvOSYQqtlyh6aN6RJ7MQH6+kbgUG0DrUOs2d:LRzuMcUvOSYQqtlyh6aN6RJ7MQH6+DUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259292, "uuid": "48fc4754-5747-4e83-88b9-2899fd7c5cae", "value": 232024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259292, "uuid": "0d3311cb-2975-4c6e-8314-9995eb2a4de8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259292, "uuid": "ca61cb57-a502-423c-ad75-a7d6235e4ca9", "value": "4663d5c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef789c3c-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331327, "uuid": "9df069a5-bc0e-42fd-bb2f-67c2f1e675c0", "comment": "Malware payload (Dridex)", "value": "358a05080cdac2173bf8086464c1ee71", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331327, "uuid": "6f86acac-38cd-4b48-b6ba-e8c0824836db", "comment": "Malware payload (Dridex)", "value": "6697cdaaf97453331a183bf722b832480a34a3533f34a7d40ea233841b943fa5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331327, "uuid": "7914339f-c077-47b0-bed6-f9e143e752af", "comment": "Malware payload (Dridex)", "value": "69b187db589ba586db8fa75acf429f7c5e27d42c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331327, "uuid": "a2dedfba-0bc7-4868-b2cc-9670f7f6b649", "comment": "Malware payload (Dridex)", "value": "f180796807dddbc106da7972db0c64c6ec8a192f35e7dbf73be718c16e55b33a864d25f08b3347cc3524df527de3d51d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331327, "uuid": "cc25abdf-6c5a-4f25-8148-6afd642e43a1", "value": "17F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331327, "uuid": "939ecaf5-0c76-432c-9d9b-0e46e69dfd52", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331327, "uuid": "716a378d-22af-4db1-b8db-34167becf765", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331327, "uuid": "51d11fed-bab6-4055-bef7-185c8d113d39", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331327, "uuid": "62aaff50-7efc-49b8-a5c0-dc9aed31a842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331327, "uuid": "7b3a39d9-2eeb-4bd7-92e3-7974f27c17c6", "value": "358a0508_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77c267a-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620281009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281009, "uuid": "72d1d592-72a3-407c-bec9-3431ba61c0ba", "comment": "Malware payload (Dridex)", "value": "b0fe06677d15eb2c78f84897fac5906f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281009, "uuid": "577ef630-5a51-4be7-8f6e-dd9e8ec88fbb", "comment": "Malware payload (Dridex)", "value": "66c5f4d7aa050c8c1dae735215bd3d17d5b3a345c194ec7dccbe306ac327ea08", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281009, "uuid": "e1e2d74f-5a01-45b8-80fe-71587fe86929", "comment": "Malware payload (Dridex)", "value": "a97289c3ac4e83992195b7f3a353d683828632a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281009, "uuid": "40306f3b-17d8-40e4-873f-221fac731dc5", "comment": "Malware payload (Dridex)", "value": "c7727aaa9a2e067f95f34dd80da75463caa7e78ed06d4a76b3fa4496e21f00ca8e84763dad8dd7f853257d43bbb1471a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281009, "uuid": "87459658-6076-412f-87b0-62f7878f1ce8", "value": "DBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281009, "uuid": "150f6d52-2cc0-44f7-bf73-bf64e1cef31a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281009, "uuid": "ce3e2957-91b5-4e2b-b5e9-e04251af1904", "value": "3072:+lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:+lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281009, "uuid": "0791a636-1d93-46a5-86b5-1e833fbd2daa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281009, "uuid": "fdd4c484-03e3-462a-b6fe-c55e6a067699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281009, "uuid": "c154f5ec-9a51-4a9b-9215-1b1daa0f805f", "value": "b0fe0667_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6b3681-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620266144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266144, "uuid": "54622814-5c9a-46cc-a85a-1500a0071661", "comment": "Malware payload (RemcosRAT)", "value": "8e3a6cfb86a8c0696133c3526fe9f04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266144, "uuid": "a33218b3-eed6-4254-bea3-94017dccb75c", "comment": "Malware payload (RemcosRAT)", "value": "673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266144, "uuid": "6789ae73-b1f7-4298-a036-cf5ba7ee39c2", "comment": "Malware payload (RemcosRAT)", "value": "0f35083e3cbffe8eabd59f84c5a0e58c3a284c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266144, "uuid": "613aab59-a370-4517-8ceb-913dd0bdad08", "comment": "Malware payload (RemcosRAT)", "value": "87965e0f29451586db4c5497b05a1f49d124d37a48deef1c5b991edafbf1550ed15ac843e6594de7184d2108e21612fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266144, "uuid": "781f9f85-673a-488b-a41c-51e6d5094b98", "value": "30F50A3A21E8359AB3073ADB0B7878C60F9BFBE88530215D7142B34AC365B1A4DF5765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266144, "uuid": "9ab17e04-f85c-4494-b7a9-4114f5919dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266144, "uuid": "e6c676b3-f787-4aaf-9005-e8cfe0de31ae", "value": "3072:57qHa9B30ZTfkTTSK69IXUIFtLLk4+6UUdZ:57qH0i7yTh69tSdp5dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266144, "uuid": "80438887-c386-433a-95d8-f1df9fbe57f4", "value": 3409408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266144, "uuid": "d240740f-92e4-4cf7-925a-b092ae11f0d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266144, "uuid": "2804130b-e84f-43e5-b4db-688b40cba4cc", "value": "Factura Serfinanza051053709735077235764653194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9295ec25-ae16-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620269753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620269753, "uuid": "26278d41-aaac-4ea5-9203-580bb7d3391a", "comment": "Malware payload (NanoCore)", "value": "66f6d2913075cc29ab618c66dac4680c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620269753, "uuid": "fd2f88e0-1069-4ed8-861b-46a92a45eddb", "comment": "Malware payload (NanoCore)", "value": "673ab9bf8f0fb63b8907fed608935b01739fd0f2a5cf8fdb4bf90b0ecbc24631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620269753, "uuid": "68c27b70-c9ad-440a-aaca-f02efaa714ea", "comment": "Malware payload (NanoCore)", "value": "3d4aa2218226b7d31e53925b3630b52db90ccfe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620269753, "uuid": "e5283e2a-27cb-4cda-acbd-8fb45a397363", "comment": "Malware payload (NanoCore)", "value": "572541db4e642158b58709bfe5a3fde3d54c1e1ee280cdb7012348509ee76b5931b457e34cd5c2e256588c4f372660a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620269753, "uuid": "e9d4c7dd-40b7-4a6c-bfbc-a154e386a0cb", "value": "48D4F185A836C671DD2DECB1E72A64F60B213DBEC78449FBB058FE2D3672011805B697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620269753, "uuid": "e6fc1800-6603-4ced-b60e-c1227677b882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620269753, "uuid": "59e10bb3-3bb3-48aa-865d-fccf41dc3601", "value": "12288:0wDGmWAJfCBSMHN8Ugv9Ly7v5ItPM9rjesisKPw2VXtu:00Gm9fCYchgv9u5M+jesiseLXtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620269753, "uuid": "c6cc56c8-5806-4854-9cc5-8f11aec46b7c", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620269753, "uuid": "738ecb1f-da8b-4ebf-9d7d-2f4acded145a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620269753, "uuid": "bd2f2362-74cc-47f2-b6e7-dc56f3bbe1e9", "value": "66F6D2913075CC29AB618C66DAC4680C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26080e7b-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277302, "uuid": "2dc824c6-d6dc-4fe7-bafb-dabd4f46868c", "comment": "Malware payload (Dridex)", "value": "e3f3250735c73a7a3ea4161c385035ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277302, "uuid": "fc8e62a1-17eb-46af-a31e-5cbf69dd65b3", "comment": "Malware payload (Dridex)", "value": "67564ad3dc9c722adb648435eed3414b26657678162a4c376115714197d8bf0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277302, "uuid": "b6265651-a57a-41a7-bd37-382d1972288a", "comment": "Malware payload (Dridex)", "value": "2b815ae8a02009544c48380cb67a0c70ea794e16", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277302, "uuid": "0f9e9324-2965-490c-a7f6-bf04482eeeb3", "comment": "Malware payload (Dridex)", "value": "b45418d3eb31d0595319b606a46436a6c0647bbd9727a8ce17604493c3f9ab9e3aa0a15a595b2ff3dd1cbc1126fa0a9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277302, "uuid": "1139ace8-47bf-4354-840b-6351cbeb4d49", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277302, "uuid": "d96e9851-7f28-4669-8ecc-0e017728eea0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277302, "uuid": "5770f88a-ecfa-406e-bab3-bbb5900e347f", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277302, "uuid": "50ab569a-7b0c-4719-836d-97cf150a127b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277302, "uuid": "c20b800b-2ddd-4882-8e49-354961b66b4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277302, "uuid": "69e52817-d786-4d99-a3e7-b439024e0bd7", "value": "e3f32507_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cea7039-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620313391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313391, "uuid": "e8b983ba-08b8-4b78-9345-93b49bd97ae2", "comment": "Malware payload (TrickBot)", "value": "ca01a71ccc8a2fa1d0f5573fb61ea336", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313391, "uuid": "201fe730-c201-4d1e-a210-868dca254146", "comment": "Malware payload (TrickBot)", "value": "678de819abf5f00b28eaaa8239169a08a75050a4df26fe3ce5b262d6c7b6cb24", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313391, "uuid": "46abcb9a-b66c-453b-915e-8126a6767500", "comment": "Malware payload (TrickBot)", "value": "9a39b6a0e942b3d7efda50285ce754f3ca86f3fd", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313391, "uuid": "feb61541-1ecf-479d-954c-b19436e480cb", "comment": "Malware payload (TrickBot)", "value": "087cc8d9423f85e857a89de3cdd60ca917d1b06e660a95c51fc42672beb118452baa1d746d2cee9efad0267792927474", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313391, "uuid": "6bf8f420-6f10-474f-93b7-79e765c6694f", "value": "FC94E11139E1C475E5AF113D09369B3A1BB7FC22CFB1D6CB67809E4D9C329819D2A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313391, "uuid": "d0005212-a9e1-432c-aa01-015a961b1b9c", "value": "88cc056314d3e98bc2df177b4a530af1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313391, "uuid": "526db46d-cf8c-4002-bcb9-0011f62dbecb", "value": "6144:khrKSoVwO2YQ8D4HHUSrSfB2EEWnFez575akXEU4FS1PudwlnXk:4noVwtYQ8zRfZl6574k09Vd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313391, "uuid": "6de1cfb3-5603-44b6-8c6c-305b77d34dc8", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313391, "uuid": "d1462b5a-b431-41f2-9814-5f0c7b99c4af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313391, "uuid": "97e09f40-f825-440b-81e6-f4d8d783abe8", "value": "ca01a71c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfb3591-ae3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620286120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286120, "uuid": "bd15f3f1-9de8-4437-a123-5d314571937d", "comment": "Malware payload (NanoCore)", "value": "0cd8b198bb4b8648a226491100eb2395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286120, "uuid": "24ab0803-9324-435a-b31a-494a14703c2c", "comment": "Malware payload (NanoCore)", "value": "67947dd13a089589ad2e0df76fe6e7d4b2c7a2ce5b74d1608d1298250540d997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286120, "uuid": "6d58239d-10fb-486b-b409-8a58db1b725c", "comment": "Malware payload (NanoCore)", "value": "d7207cba2e9ce7723b46c523f640b536603b5cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286120, "uuid": "3e74ebaf-f6cb-4054-8809-9936e300870c", "comment": "Malware payload (NanoCore)", "value": "f678a0a0e94279b2e3f7a4916209c62367c0b11603242dbc0471fefca1a58a450ec6a6ade65666f6b6f672ed021607cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286120, "uuid": "8bd30486-8d48-47bf-9a5d-0db4c0a36880", "value": "A385FF3010DE20A1336C77427EF230D8ADAB7B57E57AF18F2709A02B9EA85459C78775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286120, "uuid": "76406dfe-0377-41a6-85eb-e1e101682731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286120, "uuid": "dcaec069-d2b6-4c7c-84ba-72b11090dea5", "value": "3072:UH8OiJXxI4Uv9qtHZje21BDR63h3daj6LRyKJ/zc/17tJSHg8BCctfmu5dIzce2M:UH8OAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286120, "uuid": "6825188a-9982-4fab-a04f-69140748199e", "value": 1786880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286120, "uuid": "59446ca7-e136-4fde-b2df-c7416b2706e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286120, "uuid": "3313a8cb-6bc2-409a-8268-7d3b380be006", "value": "0cd8b198bb4b8648a226491100eb2395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e35897-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266504, "uuid": "ac03903b-6b51-485b-a057-f1e17b33ba48", "comment": "Malware payload (Dridex)", "value": "0220a2ed472f5e4fb34e63e5f2063979", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266504, "uuid": "ef448cb7-fb52-4d0f-9a64-1e211e25eeb1", "comment": "Malware payload (Dridex)", "value": "68035fbf5fb43e72b610cfa14f5f329fe09baa75aa2ec5cc2989d8a83e60f2f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266504, "uuid": "28bffead-409c-4881-8482-0c2467f9a027", "comment": "Malware payload (Dridex)", "value": "b8b94ce6f5b8c332a0f7b8b8101a6f6780cbf2e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266504, "uuid": "448e53f0-be49-47ca-9078-58e61c6944ff", "comment": "Malware payload (Dridex)", "value": "5b9f59c6287bbe5e69c8139a008dd2f1231d96da4996e36832239deec07191ae7e3b236454aeeb3fa702891d3c2a10d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266504, "uuid": "753bdff2-2ed4-4db0-bb73-745e4dc52b74", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266504, "uuid": "2e0de3ea-39e5-474a-af08-94d30b555239", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266504, "uuid": "b8cdbc88-34dc-40b0-820d-0d174fa1e28e", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266504, "uuid": "861b04c8-5994-41de-a34b-ebea5654cdc7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266504, "uuid": "3f431d3a-a2e3-4d3d-b5a5-c253944ba044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266504, "uuid": "9bf2f0fa-8c31-4025-9096-2f150c7f79a8", "value": "0220a2ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223b273d-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324111, "uuid": "100999f7-6ce7-45a3-aa6e-8458205d9f5a", "comment": "Malware payload (Dridex)", "value": "9c42cd1cfba1c8b02a8dcc329f065530", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324111, "uuid": "f441a040-ea9a-4de1-9a86-70ff6cc47a89", "comment": "Malware payload (Dridex)", "value": "6828e8b5d313ef79f2cddfeeaa5be8b82f7ce92d960ccad8310e53d5f2bbf774", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324111, "uuid": "ae624da9-33d0-4d24-9397-835fe9debf99", "comment": "Malware payload (Dridex)", "value": "326ab2934425e07c0f5d5da20a5e7e863d4e29c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324111, "uuid": "a7b83b57-0a6d-4da7-8be1-5232d51d410c", "comment": "Malware payload (Dridex)", "value": "2f027a0e6b1f16069656df2cb1e0d78ae4b31a4c068cecc423e37fc31501d72d416f8e9c0c173afc75b3dcf59027355b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324111, "uuid": "3a5277cf-bb94-4c0e-9d4c-9a8cb1ee771e", "value": "31F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324111, "uuid": "ff7f6d2f-5ccd-46e0-ae50-22355f1b51ff", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324111, "uuid": "7d6f4a9f-16a5-43bc-bee9-9c8ed2c9131a", "value": "3072:niFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:8eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324111, "uuid": "f67ff74e-252f-4c90-b942-99f1474d449c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324111, "uuid": "11f9495b-d8ba-4349-9c1d-820dd4d21686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324111, "uuid": "932ffd6d-4f2f-41d8-b433-7ac5e17f6a09", "value": "9c42cd1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4371f8d6-ae2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620279069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279069, "uuid": "e380b728-8302-449b-8c06-f437ddfd9748", "comment": "Malware payload (AgentTesla)", "value": "5c1dfc41184e7e0c8beeb63cf8eb5684", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279069, "uuid": "ce508fdc-fbba-44bf-973c-9e94ca193343", "comment": "Malware payload (AgentTesla)", "value": "682ce3faec5aee3ab19316ed585ae60d088cc69bb0dbfe4c089c6d1cade26de8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279069, "uuid": "5b29f418-8f71-469e-a671-e1a4feb5e606", "comment": "Malware payload (AgentTesla)", "value": "20c56ded4ff57c8a655f44e770e168ca617c37f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279069, "uuid": "734b4b04-2321-4cb5-a364-17ee0a7c2da0", "comment": "Malware payload (AgentTesla)", "value": "8d914b5950317789aa5b1db46a0e37c24f477574470bc8c03d47cb67e873db76dfcf992898a07a0600f95780342d18da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279069, "uuid": "7ea968cd-cdcf-4bf9-beda-137d55d96358", "value": "5D35AD2212989A24E17B63748466C13947F67E12E272C71D7EE97CDB3B336C0DA5B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279069, "uuid": "e15ade20-7359-4049-970f-df1d71b95ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279069, "uuid": "2a0806f8-b1e9-498b-8f2d-b87f4a210c78", "value": "12288:qeV0LxWPnvnoNZBJV7Iv5G/nfdBbtSwZU00EW+oaMLdvcH4KEA6uOr5/M:qeVf2Z/pIRE1jnZUmErKTWr5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279069, "uuid": "69dc5a1e-5335-4359-a3ba-2d87fee43a66", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279069, "uuid": "ee1469c0-e3f3-4205-bafb-3c1fcfbe224c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279069, "uuid": "9fcdcc26-56ab-4654-a609-a1c00138c5fc", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1d9b86-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620327726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327726, "uuid": "5db36eda-f3fc-4fb3-a042-248bc0e9c967", "comment": "Malware payload", "value": "2df7f9ea4d6719d9f94fd5a99f39751f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327726, "uuid": "ce93d55e-54cf-4525-a942-4c8fd3cef5fd", "comment": "Malware payload", "value": "68550b09bbe1ab14ae740259d351d9cc93b3b0fca283b1aa73e13f60e232bd61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327726, "uuid": "bdf2d30d-962a-4b83-9731-b71f083ae170", "comment": "Malware payload", "value": "2dc709239bc86a0a9c385de8336810fefea7b45f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327726, "uuid": "23b401e0-6fbe-43bb-98d9-d314c9604a14", "comment": "Malware payload", "value": "72aec7a1f3e408285ba9249df6534251165ed3a209c09627fa5b4af5990fbb790a09cb1b8306aef86597c39f6de0c9b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327726, "uuid": "865b2a3a-084c-4790-b8c3-cee89b381a1a", "value": "DDF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327726, "uuid": "3afd9f6d-c5e2-4115-8b19-72b8ee324b6c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327726, "uuid": "5596cdf6-ab1f-4117-93b3-9f338584319a", "value": "3072:2IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327726, "uuid": "f8f7a85b-6073-48fc-b306-3aae3684e820", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327726, "uuid": "b10d9c13-c02e-424a-99a2-49870042e21e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327726, "uuid": "2a266da5-a9d6-4329-81ae-7b6567151e8b", "value": "2df7f9ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df6b330-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342142, "uuid": "d03590f2-8577-447e-9ddd-d8429497c039", "comment": "Malware payload", "value": "1af78e2a8d774d5a6ef7ced1f14e4f16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342142, "uuid": "c7b2821e-18d1-4f71-9c94-67c275bdbaa9", "comment": "Malware payload", "value": "686922edfa0e8e097214dfca2d559374bc1bb229adc5cb3f51e8eda5fc3c8f23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342142, "uuid": "809b88b3-f5db-42a2-b2e6-a3b91372d544", "comment": "Malware payload", "value": "b0b8a97480b8f7e10dd036c4abf415440adad394", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342142, "uuid": "ad585c01-8792-44e7-9d4a-55f6511b3b2b", "comment": "Malware payload", "value": "94f7d3584d57d51225c6dd96782f08c5dbe9e9bdf04f921e4fe7ef48c53c513b0432375269ce1142ee5aa2fcea92b663", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342142, "uuid": "36e365ff-fcfe-48c6-83f2-82fe1c91bb26", "value": "81F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342142, "uuid": "96fc3b02-ba4f-49ab-b0cc-3060bcc47208", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342142, "uuid": "1bf79f9c-4eb5-485e-a262-1b9f074cebfb", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342142, "uuid": "40ee209f-a2de-415a-bbdb-7f5ddedbef97", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342142, "uuid": "a9138dde-91f9-4b6e-8ed5-3d5bc6468d92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342142, "uuid": "5d551645-72f4-4366-8e18-ea205e71b974", "value": "1af78e2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc5de2f-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339429, "uuid": "a2bd6119-f748-4efe-93ac-e543fd457528", "comment": "Malware payload", "value": "807f096ac43724157808ee088de54a65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339429, "uuid": "43cae8e2-185c-4128-8191-b2969291b9cd", "comment": "Malware payload", "value": "68863bffccd7e8712f326157c12434ad2331e905ddfa2d7e1df1a5d08aa661fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339429, "uuid": "5bdb2a14-a79e-425d-9eac-363956ce5fa9", "comment": "Malware payload", "value": "33b96319d6978b89ec1c1c73049b69f6a714f35f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339429, "uuid": "ab6f32e8-9787-420a-ad3e-34e227e52451", "comment": "Malware payload", "value": "c63358a233de49712d4b6b1b633aa2fc09b963a3ff5f4cf9fa2bc5c040ea2eaa4f95330ed341402692da139b1d73b098", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339429, "uuid": "3f5870a7-47c1-48cb-a896-d4eb848c1467", "value": "61F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339429, "uuid": "0cf6b946-5680-4e9a-82a1-d74803756431", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339429, "uuid": "b8952de8-4c76-47c6-94cb-222c390a2b6a", "value": "3072:XNG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idJd:8ERMVPG6+Y63HoG1QawL40Prx6KLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339429, "uuid": "98814782-8c1e-48e6-8a90-d6a42730e077", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339429, "uuid": "4e53df31-590b-49d7-abdf-f8d9ba70fe2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339429, "uuid": "d55c6c65-4058-4cc3-b3cd-6f95aa8cfa38", "value": "807f096a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5686a2d8-ae53-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620295852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295852, "uuid": "27de6ff0-695c-445e-9da2-8f81a16c63c9", "comment": "Malware payload (AgentTesla)", "value": "c0a11a28f11401dedc4eea4313936d6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295852, "uuid": "61e9a7f3-8cb5-40b5-ae62-59d7c741d608", "comment": "Malware payload (AgentTesla)", "value": "6895528d9820bcdc5893be0d836d7414a24e17633eae3c298bce0b74f94e8a1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295852, "uuid": "8d81eb91-c108-4238-b502-11f3be5bfc87", "comment": "Malware payload (AgentTesla)", "value": "1b797f1bbd62aa44f7e08ca75325266be513baff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295852, "uuid": "885b178b-4d18-495e-b164-7e32a657a468", "comment": "Malware payload (AgentTesla)", "value": "10a6d86f715221179089a89339689ca23d9cca0a206515322c105e42eeacc432395ab62a44a5648f801da619ba99f09f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295852, "uuid": "4458ffe0-b1e8-49b5-b092-c38de97670c5", "value": "3B359C2212989924E17B23748462C13947F67E06E276C71DBAE47CEB7F336C1D66B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295852, "uuid": "348a2597-dc2a-4ed2-998f-4c0b2fea9814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295852, "uuid": "3e3df4d8-522e-47dd-be2a-3c0c0929c763", "value": "12288:zjPZxRSno1MKipgx5Vzv1IbvVAQ7tDfnB4V+fNbZxuqRG6SfC:zdxVvx5jIp55nOV+VdxU6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295852, "uuid": "42d850cd-6f09-4a66-8d85-813d8a7e66e0", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295852, "uuid": "33dca7bf-63f3-474c-8af7-cdb3f7f67a2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295852, "uuid": "32d9be48-d002-4963-a946-50f24f160904", "value": "Invoice Packing List CORP Invoice R-CONM012 2021-04-26 - large shipment tools (1)2021.04.26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf52b9c5-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273694, "uuid": "0963b8f5-2114-4310-8c11-cd9cfad11f09", "comment": "Malware payload (Dridex)", "value": "4bd35ae9fde6a149b60930655e44d9c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273694, "uuid": "4a84e313-b31e-4e5d-848a-2565b77f7db6", "comment": "Malware payload (Dridex)", "value": "68c3cc906fdb20eb873acf9b80c186b45314722365f1288948b69d2007229868", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273694, "uuid": "96dce898-eb4f-4af9-ab9e-621af3678d43", "comment": "Malware payload (Dridex)", "value": "f3b4f695fb91b2b206b62f9ba5f08368fc79b51a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273694, "uuid": "33fa8ff3-62b7-4a29-b902-4609d13dcc2a", "comment": "Malware payload (Dridex)", "value": "f5371d41467d71dc93e9d586d0e91c9beb2493dbe779b1a4051c6d6829b3434876389cd3abc9f56cd00a119ab375b308", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273694, "uuid": "6944997d-9db3-472a-bb5a-c1d59110c7c6", "value": "3CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273694, "uuid": "0d735e4e-f650-4d86-a587-afc44d4f16db", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273694, "uuid": "df8929f1-4aed-4130-8343-f0e00077f1d3", "value": "3072:GA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:G3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273694, "uuid": "1926dccb-aab1-434e-956b-e045cd30bc32", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273694, "uuid": "a3a0ac4e-ee9b-4015-a538-34d4a7c3f950", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273694, "uuid": "eecf5d0a-0897-4e7e-b547-23c62d44673a", "value": "4bd35ae9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38165a02-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339180, "uuid": "d7968c8d-ca9b-4077-b6bd-6fdb5287c308", "comment": "Malware payload", "value": "ee80af22cd6ad9da66aedf9c87266e8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339180, "uuid": "c5b8dcca-c937-4e1d-8707-dce584259e23", "comment": "Malware payload", "value": "69ae63c8c8245117e0615de7170dcab3e01c2e6a184e62ee4ca5085f6284542f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339180, "uuid": "b8f225a5-c05c-4f12-be5f-1b2dd830bd9d", "comment": "Malware payload", "value": "9281264b1ca6f8f7c3cbf0b62ec58bc0bebb9430", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339180, "uuid": "2f949431-a50e-4885-a6e4-2d0adcefeb33", "comment": "Malware payload", "value": "6a1bea2cb80d7c8dbf81230ebfde8f7ce1e517d39a08a2cd6837f6342045e333eaf4d9647c3eaa4f62b6ed6b62bf3d70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339180, "uuid": "0afd2e72-2df5-4d73-9df1-1725cde5cff3", "value": "21F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339180, "uuid": "b07a2fa5-1615-4bf4-bbf3-094b52170a10", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339180, "uuid": "15a5aeec-8953-4351-8166-087dd1521cf7", "value": "3072:n3G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idKz:OERMVPG6+Y63HoG1QawL40Prx6K0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339180, "uuid": "942e2dd6-8e58-4d47-bd45-91d7ab82adbf", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339180, "uuid": "876122ec-2ebc-4b12-b8cd-79a4cf3496e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339180, "uuid": "e858f5fe-e9e8-4ca4-96fa-52fe1090cf25", "value": "ee80af22_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70003b5-ae65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620303798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303798, "uuid": "689f4568-45c3-484c-a9c0-d504aa7996e6", "comment": "Malware payload", "value": "bd5e0d325783b0526ae79b58fe08ee77", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303798, "uuid": "8295031c-15c4-4a14-bd08-0bade20681de", "comment": "Malware payload", "value": "69ba01eb1fe057757516dbc89211b3990fefe9b894f0594af2ccebe500442202", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303798, "uuid": "360314c6-a5e7-48f4-aa72-17fc599fc05c", "comment": "Malware payload", "value": "c066447df75901430365317b71d21369edf340f6", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303798, "uuid": "67b37d56-9e1c-4044-8822-25db14a43e6e", "comment": "Malware payload", "value": "badadbeb2ce73641df985423dd776ec9213ba50a6af462e1ce95ad9aef620faca351a2fb16cea8293819907380b69e42", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303798, "uuid": "86be5b63-d991-4bb1-8511-1d4c01fab508", "value": "2B226C3DC601EC26D212C4BED03849B5F71A6162E093F4295566F2DF47E27934A8E4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303798, "uuid": "96bbe956-82b7-4dfc-80df-ea958c611ebf", "value": "192:ScIMmtPil9G/bixd5OgpCBAfXViw7swwd3t1:SPXJixd5OBBoVinZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620303798, "uuid": "a739ec2c-5ce0-4227-9a64-e32b7d1458e2", "value": 10323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620303798, "uuid": "5a405923-311c-4030-8be0-aa5faf72817c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303798, "uuid": "7665447c-6d3d-468d-bfe4-87ed8e4aa373", "value": "Revised_PO_758869.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60a5e3f-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273705, "uuid": "91ba4339-3545-447f-b27e-a25fdf356e21", "comment": "Malware payload (Dridex)", "value": "01c75f6867e5b8d7d039de7a8fc899f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273705, "uuid": "81251571-ecf6-4962-b9dc-00646a804cb3", "comment": "Malware payload (Dridex)", "value": "6a312f266c54f69a48addfccc91252d528c3a92ce26d77b4a938178f4a4612a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273705, "uuid": "678e69b2-bbbe-46db-9ba6-a335527b4f02", "comment": "Malware payload (Dridex)", "value": "1ec005322de681811e22350054b5e022f5ba59dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273705, "uuid": "c69dc3a4-f2f7-4835-9430-f7f98caacfb0", "comment": "Malware payload (Dridex)", "value": "25605d61793695e1425ecbb1ce5f1de36d1ea564dfb803aeb8f45f0a7a62d36aa27b7e874febebdd986c29b8d3181289", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273705, "uuid": "036352fc-9474-4540-b1cd-b2c48e376124", "value": "06F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273705, "uuid": "911fbecd-2f0f-47b0-afdc-0ac1117ef18a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273705, "uuid": "1588a91a-68a0-40d9-b661-49650ad03f90", "value": "3072:aB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:D4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273705, "uuid": "7f13fcb8-e66f-4684-9320-436f6cccfdb0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273705, "uuid": "0dac5f88-9e80-496e-97b5-9ec9db028b51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273705, "uuid": "845ef45b-3799-493f-858e-74436d20a0a1", "value": "01c75f68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd519fbe-ae6c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620306869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306869, "uuid": "8d7a4ca0-f662-4478-b471-fea3a217040b", "comment": "Malware payload (Quakbot)", "value": "5f3235c2e9f620fb7685359585ad4333", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306869, "uuid": "68a741da-f0f5-4a8e-88a3-85c1f2de5e88", "comment": "Malware payload (Quakbot)", "value": "6a35fc7e42b5c40dcbfe494dc0ac2b8cc94c3c88be69f7a636b97ef189e1a97e", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306869, "uuid": "f4b9f2ac-a940-4a63-a0cd-262b593e4efb", "comment": "Malware payload (Quakbot)", "value": "7c8edb262f6f8477e34321587ef5f44072d32b72", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306869, "uuid": "edde7b6e-acb0-446f-af02-07b5d4769a6c", "comment": "Malware payload (Quakbot)", "value": "27cf9ab8aab2d5a4b1c722b6e32065ca4bf6b2fb999f09f2098018a31d98f63eef725553feed64e5be2d2e63381ace3a", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306869, "uuid": "fffde42e-73df-487f-b27b-0fd41f0d1d35", "value": "BDB39C0BCC094AD7D12E93FD6D074DF96E0E5718D8D62FEF44221F8A3A651631E4B0AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306869, "uuid": "bfc9a8f1-2105-4ad8-827a-0cf19e85bc1e", "value": "3072:+YQvKINbjvw548LMb/oqKO8NnS8+60KcP:+CAbT648LM7D98Np+ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306869, "uuid": "03313408-4f88-429a-be37-c223203d1768", "value": 113013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306869, "uuid": "5b657113-c3f3-40f4-8560-fd5f2848dd01", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306869, "uuid": "c338d5cd-b15c-4cb7-a1a6-1590610a92c0", "value": "Complaint-675341227-05062021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0b391c-ae2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278708, "uuid": "aafd2480-02c7-4a51-b560-847386580361", "comment": "Malware payload (AgentTesla)", "value": "7d6ed6d47bed663742e5f5cd0056d772", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278708, "uuid": "dc34dc1d-ae22-4451-93eb-4adfc480de6b", "comment": "Malware payload (AgentTesla)", "value": "6a7431dc5fc9dcda63fb158e9d072030c0407461281f49d5ff9d836bec071b25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278708, "uuid": "4633798c-654a-4ab8-8e4e-3ac380964bc9", "comment": "Malware payload (AgentTesla)", "value": "ab0f64b527f6724e14ff1298eb02aac04af25c6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278708, "uuid": "b88603bb-0342-4711-ae78-e9c19b6779d0", "comment": "Malware payload (AgentTesla)", "value": "819df567748cb0a0ad7a0c7138c51da4dffd46c2d2d94f2009ed73c4174c7831fa868d2037b14e71aca02e05ca4acc93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278708, "uuid": "d58949c6-a710-479d-8e68-8cc46294923d", "value": "9FF46BAC75146AF1D35B5E23A3CF0C0643651274A93BE90A8F6013FA1A57F173E39D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278708, "uuid": "4b70d166-b063-4ed3-b08c-8cef71a3ff88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278708, "uuid": "02122101-2dc7-41ed-812d-9c655e920529", "value": "12288:lFooLLoS60/K7yh0dp/dmmGm0Z6maNHLdxippp68uH1T:lFooLAdH461LDWp68+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278708, "uuid": "6b9b2676-de25-43fa-a90f-c9c014f46f99", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278708, "uuid": "5457a1ba-10b4-400b-a159-c1f2bbe81d85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278708, "uuid": "0d6c2ff0-e4d1-40bb-863b-89ee20f938b2", "value": "MV GENCO RESOLUTE VOY 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b699c75-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339266, "uuid": "af9494db-f0b5-45ce-94a0-1a5b7ebfe62a", "comment": "Malware payload", "value": "d79e5c9c6d0e8b21cc5ebc9fcf39ceee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339266, "uuid": "9105260d-f1fa-4b93-b98e-b41be8b93035", "comment": "Malware payload", "value": "6a90a492a467963e99b48a055d41f0a69f9f67f234d81f523a8a96007648bb24", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339266, "uuid": "4ccd3bf1-742a-4e7a-8e60-8f382fa2ede2", "comment": "Malware payload", "value": "4d894e8cb6731a6546d4000993a9818853399e7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339266, "uuid": "083998e7-4212-4fe9-a45f-b3a8962ea8d1", "comment": "Malware payload", "value": "992b6cb64062eca5ccfc54c9355a20afde72001751af927ca765df21e3844eede633d3bb7cef4b762814b68ea75cbea9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339266, "uuid": "c3e6d595-5b2b-41cc-ba04-836398e37c95", "value": "3DF3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339266, "uuid": "ccb101a8-0521-4a05-8523-378a20a019f4", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339266, "uuid": "78a0ec7c-0223-43ab-b447-21b14c4f952a", "value": "3072:NVG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:CERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339266, "uuid": "0fa80060-8aef-452d-88a1-6cc858d22ebc", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339266, "uuid": "907839dd-58d2-4066-92f3-2bc9de9a04b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339266, "uuid": "74b6be37-01e9-4796-845b-ce55b592ce38", "value": "d79e5c9c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fdf8c2-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339275, "uuid": "49abdec1-6aec-414a-8146-c32248e4009e", "comment": "Malware payload", "value": "b75fd36e6ef0604ed688bea63da30c05", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339275, "uuid": "fc0c6467-277a-4de4-b2b7-8a4930d80b1c", "comment": "Malware payload", "value": "6a920364ba3aa06207147d127f00dd490466b30f39872d7bbf0f257356f2ecd3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339275, "uuid": "63254f8b-e72c-4926-beb6-46904e7ce2a7", "comment": "Malware payload", "value": "6b729b5ec275874d162b83827e6d0a937dd1af7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339275, "uuid": "cd3ac27f-5868-4151-b584-c728ab180937", "comment": "Malware payload", "value": "57a7ba450f6a24c0e389f2d746ea67b950113752160fa79eaefca490d9357156be38f4ffabc5c1d27f85d703756f4a0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339275, "uuid": "e006957c-4273-4b6f-851e-d9b3ef339002", "value": "91F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339275, "uuid": "8efb7551-f333-43c6-a725-aea22292d4ba", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339275, "uuid": "1be476ee-fa0b-44ed-9568-4b836ae50255", "value": "3072:NNG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idJd:SERMVPG6+Y63HoG1QawL40Prx6KLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339275, "uuid": "6e87f3aa-710c-4b5d-b87d-8ee7643f946a", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339275, "uuid": "091cfa26-2270-461c-a4b3-9b99778183a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339275, "uuid": "640148eb-52a4-4bb7-94cb-b6bf47d79398", "value": "b75fd36e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27a2fe9-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620339385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339385, "uuid": "2f2ebb70-da41-47bc-96b1-731a1cf7dbd2", "comment": "Malware payload (Dridex)", "value": "2db59d13af93e5f0bba91cbc9aa8e021", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339385, "uuid": "25d31af2-cbea-4447-86e4-5b78733d2265", "comment": "Malware payload (Dridex)", "value": "6ab510506d893743e421320f42e0f30b32ba7d21fff2ef0802d1e31fb3a13de0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339385, "uuid": "aba022fe-6eb8-48a7-843c-31a0d1a50089", "comment": "Malware payload (Dridex)", "value": "eb812f59d8c4668ea595646fd19032e1ad848fbf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339385, "uuid": "6a0555ac-e458-49f5-85e6-5b3b103adfe6", "comment": "Malware payload (Dridex)", "value": "dffa0789729523cd02b8ed705ac2cea44ef5c90bfdea3d4cbf5e8875b5465458f7ce40419457ee6599e5033a8a0e201f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339385, "uuid": "8f42aa02-75e9-4e7e-8a46-3503d3b56310", "value": "73F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339385, "uuid": "2408d597-b5a9-4d91-bfba-1e7fc76570a4", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339385, "uuid": "f9511c24-404e-4edc-b371-963e5308614f", "value": "3072:mOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:2ERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339385, "uuid": "f084cff1-b047-4d72-a9ba-896e6a06f306", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339385, "uuid": "1e3a9e89-8412-46e5-92a3-f7c71f012f0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339385, "uuid": "a2721ef0-be0a-4878-a050-90fb6d530ca6", "value": "2db59d13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac535a45-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291701, "uuid": "8af92e1f-29de-4bc7-8607-d1fd9233451f", "comment": "Malware payload (Dridex)", "value": "e24a2e435d9ae3abba2c06fd5bbb4db2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291701, "uuid": "4848fcbc-a0da-4f63-bd9c-f24f4208dfe6", "comment": "Malware payload (Dridex)", "value": "6ad2fed5af43749a36c4ec0112ae796f7c73482dd2999d6d651b13cc1913fb12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291701, "uuid": "d147e78d-a9fd-42e6-8f79-c78597d27c46", "comment": "Malware payload (Dridex)", "value": "6ded13582ac65656c0976b2491153bf6767367e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291701, "uuid": "02a45910-3050-477c-a760-2b7c1c664d19", "comment": "Malware payload (Dridex)", "value": "9a939b30f3eaa2a96ddcdae40a717e1890ed73cbcf4c4a069de63bebff01549f30b54617531d076d9069907ddd3760d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291701, "uuid": "55c19467-83c4-43dc-89e4-cb7b459b41d6", "value": "37F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291701, "uuid": "86d47208-bf88-4c05-a71a-e971fd3ed1b7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291701, "uuid": "18f0f8e8-ed89-429c-a77d-6f5a3f894f82", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291701, "uuid": "bbf9d783-c556-4160-a258-3ee1c14cadb7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291701, "uuid": "7e7e94af-83aa-4abf-81dc-49d8bc99749d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291701, "uuid": "ed38850b-5123-44a2-a3fc-ce3f4c208b49", "value": "e24a2e43_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6c921c-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266520, "uuid": "279d5ac8-9a30-4cdb-a3fa-43520a4df486", "comment": "Malware payload (Dridex)", "value": "bf423a9ecb9bd0cc85a8d7be64eff00f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266520, "uuid": "47d188c7-63a1-41db-95b6-51bd9e7d9ade", "comment": "Malware payload (Dridex)", "value": "6b050690ffb47fb76209d4991ad2495c21bde65905b608103b3b00ccc8cdfd10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266520, "uuid": "7abbb699-88b5-4dce-9ad8-3d64d9c105ad", "comment": "Malware payload (Dridex)", "value": "66a46858f32db1bcdd9950fda974cd25127897ea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266520, "uuid": "3e97ea53-dde5-401a-98b3-ec4e8eae942a", "comment": "Malware payload (Dridex)", "value": "a54e1c4f51d1c764c6b51b32ad4a1f1c38a74c99a41c5f33e66251ba840865ee62f0997274a6dea4695151c57664a307", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266520, "uuid": "09ad87ea-08e7-446d-aeb5-295cbdb4a750", "value": "EFF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266520, "uuid": "5ad4e28e-eea2-488a-8e63-eb27df2e1d4c", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266520, "uuid": "f50d74f6-6754-4393-89f2-b87c7762e112", "value": "3072:DB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:G4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266520, "uuid": "b84ba3bf-e0f0-406a-9998-f52132733411", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266520, "uuid": "60b644b1-d091-4220-9239-59a64fa61a48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266520, "uuid": "dd871aaf-2f76-4c08-896e-e955780f3c7d", "value": "bf423a9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71490613-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270127, "uuid": "c736b9f3-3b55-4f54-8107-608c32016b57", "comment": "Malware payload (Dridex)", "value": "4b6dd47fa7ab190dce78e8441d691f8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270127, "uuid": "4300862e-9e76-4ff8-8c1f-ff42e0733c8a", "comment": "Malware payload (Dridex)", "value": "6b2af3663955931f8d532e111fe48d5d60a19d9c9487aad0bc521aae76811624", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270127, "uuid": "308f4b4f-247a-493f-b622-2bdd53dbab1f", "comment": "Malware payload (Dridex)", "value": "a7cc4f8759775737ddfa55ded6916c49f86abd7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270127, "uuid": "acea2e66-bc1a-42f9-8b0f-9dc055ae5bc4", "comment": "Malware payload (Dridex)", "value": "a9836e3cb2cdcf9692053bcd9738dc5a6776c1ea3e2951d4cf299f10c0d7151f2b374c2995519f3932b8f4e50b0ab614", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270127, "uuid": "69ede1aa-f7c0-4b54-a025-b51ec8c1063e", "value": "57F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270127, "uuid": "943937d0-3764-48aa-9295-246810ad68db", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270127, "uuid": "f175ca96-da7a-406c-99b7-8d2b47f994c7", "value": "3072:xIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270127, "uuid": "d5392b27-2d2e-48c9-9967-03a9c6512b38", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270127, "uuid": "f392bdc2-faa6-4130-be21-fe2eb4553e58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270127, "uuid": "7789f336-608a-47f7-aadb-970c24270e21", "value": "4b6dd47f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0c3848-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (BuerLoader)", "timestamp": 1620310147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310147, "uuid": "5d0a94eb-f999-4f1f-979a-2b865a2e1f61", "comment": "Malware payload (BuerLoader)", "value": "7908cc9996b7423c766157d8119df254", "object_relation": "md5", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310147, "uuid": "5272a8a2-a5fe-4127-a69d-3959f6dc9720", "comment": "Malware payload (BuerLoader)", "value": "6b665a866997d39ba17c6b687693c71b4d4a622d016ad7e0c37bc735524858be", "object_relation": "sha256", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310147, "uuid": "99cd1980-ae66-4d73-9630-170d124ac7c5", "comment": "Malware payload (BuerLoader)", "value": "7974b277a69b8c811734a6ad30f3ad1f523d3503", "object_relation": "sha1", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310147, "uuid": "d05b8310-034a-4dce-90b4-60297ea8eb34", "comment": "Malware payload (BuerLoader)", "value": "fed30f3811fceacfc496ae6956d5901606ce945cdf87c4daf8cb37848a89fcb8236dec46fa7c45d2af6392ff70688ac4", "object_relation": "sha3-384", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310147, "uuid": "fedbbb99-496e-40e3-832d-93f08bc1c102", "value": "B4E5AE323B91843AC2773571851EF3B9A2EEE9700E71438BA5945E3D2F345C2892D66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310147, "uuid": "5ede97d0-ed8e-4a10-b4bb-8c6cd4098fef", "value": "13e73e6f78baffcbdd5760fa3de75bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310147, "uuid": "ed96f51c-5c92-4a1d-91de-05046f751811", "value": "98304:Rlyd4AKZck65BJzLseFBCTdLgqzL88OgsYeMm2hAj093OfhHWlfBGwQjzvEWIc:aWC3M6gstMAYVYhHWlfBGw4JIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310147, "uuid": "84c8385a-a9db-4f6a-932a-22b2a5f407e0", "value": 3202232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310147, "uuid": "a6a1ea8e-2715-401f-af2e-2a27295c1bfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310147, "uuid": "41978e11-d861-4508-a08d-b758a13109ec", "value": "AnnualReport.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0f4008-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284483, "uuid": "e74c93dd-b7ac-4655-8fd3-fece1ed9e542", "comment": "Malware payload (Dridex)", "value": "1ba20c133c9d94bf527728c5b7c51ba7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284483, "uuid": "d60953f2-e717-4c53-834a-440edb80eeb8", "comment": "Malware payload (Dridex)", "value": "6bc634804bfaa5edbd222666f4ae7517414948258e3c63ad37728e0c65700844", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284483, "uuid": "ea4eccec-8da0-4617-981c-45169f858a7e", "comment": "Malware payload (Dridex)", "value": "b42bde550ecbbfe9e1eb4b80920d8adda86480fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284483, "uuid": "1213ede7-92e1-43b7-9c82-0d55a33f166e", "comment": "Malware payload (Dridex)", "value": "b5db173445930f7d5c900c12372dd7902781462143336ebef3ae2d2011360aaa126e6ea1db2c7b5e75d1a6213007ac66", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284483, "uuid": "5b6a79ce-e937-4401-ade2-5376fdd4dfb7", "value": "32F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284483, "uuid": "677574c9-c6ac-407b-9b3f-786a77836258", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284483, "uuid": "7ae1df7e-28f4-4a95-9f74-be9c237c49fa", "value": "3072:bB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284483, "uuid": "2b36fde4-8150-4f9e-95b6-e1a37427513a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284483, "uuid": "b65da627-b31f-48af-a1d9-11d559650351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284483, "uuid": "2ef5bfd3-1c18-47fc-9f05-b7f260c32c8b", "value": "1ba20c13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f011744-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259332, "uuid": "b9cca3cd-d127-4e52-86cb-0a4eca59df79", "comment": "Malware payload (Dridex)", "value": "7df47ffe708fa792d66447ef5f65d72d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259332, "uuid": "218b5622-5aee-4478-a36d-947c0b8f3a2e", "comment": "Malware payload (Dridex)", "value": "6bf5adb31a7d93a59217be555f32883076c7d119faafee5b1f68c75733838c34", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259332, "uuid": "9a52ad18-dfa7-4cdd-ad85-0fe3c76aef08", "comment": "Malware payload (Dridex)", "value": "843c63162acad330120c360eae635016f73bda14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259332, "uuid": "17d88c39-fc9b-456f-9db7-81d8df3e945f", "comment": "Malware payload (Dridex)", "value": "71d7243ef0e259e55682b3561fa6fd5f3c5adaa2d67d40a81062bce2a5a47eb2b3ea02433ad7a8387d57c55b557dcf73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259332, "uuid": "d8bdde19-aa18-4165-91cf-f299c31697c8", "value": "EEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259332, "uuid": "da46be18-b572-4d51-96a0-e92537a6740c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259332, "uuid": "847b5427-bd76-4a99-95dc-8b67add90d0a", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259332, "uuid": "8630b29d-7afa-4212-83b8-25f31e182186", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259332, "uuid": "1ac2fa4c-3cc4-4a99-a7c2-b98ebb4100ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259332, "uuid": "771dfcd3-cb6d-4fe4-9b93-7ee3bbaa9be7", "value": "7df47ffe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f756bd36-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620306429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306429, "uuid": "eb95b3db-7f33-4920-a42c-666fe54a6fd9", "comment": "Malware payload (Formbook)", "value": "1e1f169ac3fc87ad55252f38cad083bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306429, "uuid": "f3fe4553-6a83-448e-a522-dca780ffa14d", "comment": "Malware payload (Formbook)", "value": "6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306429, "uuid": "d7068b4e-4e7b-43c9-8266-c827eb82fee9", "comment": "Malware payload (Formbook)", "value": "ec778acec7bfe578f6d13556765e5ed5ba0a405b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306429, "uuid": "485aa63a-7a2b-41a3-aea0-fd1e6f453db1", "comment": "Malware payload (Formbook)", "value": "6e9686b3bc47ca85241573cc0392858953c15da3e78d969131c327a3dc0463fd358df87068b7ac7e92836059e20ee54b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306429, "uuid": "6a6db407-89ca-48c8-94b1-c997f311a7ca", "value": "D9158D61B2C24433D0AF5E74AC3BB7745C36FE821AE8104627F83D589F797613A3A586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306429, "uuid": "37b7b2ac-543b-427e-9156-6831ba769568", "value": "a4e462a199bd933bfcc2e6a6ed1e5792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306429, "uuid": "84a2edc6-ec71-4226-957b-44adc1aa3725", "value": "12288:B85p/Fufy1iu51lf2ChJrScwHWZe7EimMU8/r3V2JKOdKU/Oy/wUL:B8rdbV1J2qV4pEaLqKOdKUD/w2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306429, "uuid": "aed2febe-9331-4fb9-b67b-be4997e531bd", "value": 921232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306429, "uuid": "ca6f4665-4ed3-45e9-a7ba-c0d848a56ef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306429, "uuid": "a72c35c6-ffca-49d4-b386-21edd3b30d53", "value": "doc_391200004532000450.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1104b3-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339027, "uuid": "05207565-b839-4cb6-aa56-d3833c69875c", "comment": "Malware payload", "value": "7fe2dbc45e83bef86d1b1fbf90cef185", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339027, "uuid": "2f1febea-44ae-4cdf-ba3b-80961bf6abf5", "comment": "Malware payload", "value": "6cbe563868c4318fe19eeee8d32dd251d0cf0cfae1d6095727ff04bc8836b56c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339027, "uuid": "8783573d-05f8-4f6b-baee-287db28d76b5", "comment": "Malware payload", "value": "c1376a281d21d9d94d86115966f54f4711a5f5df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339027, "uuid": "cbb08d8f-d079-40a4-9522-7ff360b05a41", "comment": "Malware payload", "value": "068f1190893c221cd69d3fdde603d2de865e521c611ee5c7d8ca5539c332268ad9a36f1fd86ba17bffb579f16a32c716", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339027, "uuid": "a9ff189f-0c15-4f45-8319-b6491c9495c4", "value": "21F3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339027, "uuid": "e9d1a575-d475-4e2b-a4dd-9750b3afa07c", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339027, "uuid": "41a43892-9568-459a-b5ad-de9ad8d826b0", "value": "3072:wqVG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:wXERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339027, "uuid": "57ffa0fc-cb0b-4cf6-ab1e-492de5752788", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339027, "uuid": "7d0bf3af-dfca-400d-ae29-fd3b5d9de321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339027, "uuid": "49ea29a2-d530-48e0-a564-0cd4727ef9c4", "value": "7fe2dbc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b0b56e-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338719, "uuid": "39328c44-a5d3-4a95-8967-8cfa55b513b0", "comment": "Malware payload", "value": "dbc251446e1554d554e01926391f3608", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338719, "uuid": "47caeba0-1f51-4ac7-bd02-281712dc9767", "comment": "Malware payload", "value": "6d49779f7422ca03d4ee9ebb006b4a71febe4beca7cbb0fd113a8dfeb35b6cdc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338719, "uuid": "cff4ba03-fd72-4c8b-b7f2-45bf828ed26e", "comment": "Malware payload", "value": "f0ea770e294793ed1dbc0dd4060497fc038c38e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338719, "uuid": "dd29a7c3-2b81-4193-a1c8-6d418c7bde73", "comment": "Malware payload", "value": "676c8a25cf8a868df850d675fee988ea7e424ae2a334a88edfcf65e4ae341d0e79e5c905ec899fc120b4087b60ff5af8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338719, "uuid": "9f55b213-562c-4990-bb72-66327e6fcb77", "value": "57F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338719, "uuid": "a80ae2bf-0989-42f5-9b50-d9bce91adbfd", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338719, "uuid": "386378d9-f2be-4f4b-868c-956ad94a6fa9", "value": "3072:FOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:jERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338719, "uuid": "c9c73bee-7b8d-45ce-9f55-5e3b0cd7ff0b", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338719, "uuid": "4f23f575-874e-4d89-bade-790c7d3d76e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338719, "uuid": "6072049e-65bf-47fd-98c5-eeff7a65b76b", "value": "dbc25144_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8ab184-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620320588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320588, "uuid": "db1c347c-508d-4111-b85e-597f82b1da75", "comment": "Malware payload", "value": "71149a83552ddf00cff4fe25fe053ecd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320588, "uuid": "68d482f9-706b-4d71-99a6-86b871326e3a", "comment": "Malware payload", "value": "6dd1a417d2a52404ed7884a7e9081c8f35fec3187f3c9e4630803387e2aa5742", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320588, "uuid": "894add6a-5976-404a-99ca-6c8277742594", "comment": "Malware payload", "value": "4f7f5723ebce2148466280b36c9a3313251ffd99", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320588, "uuid": "d5fff3d8-29fa-4e0d-8114-1f08a111ca4d", "comment": "Malware payload", "value": "9e6d40dea3db1033228e11504e71d76013ba6558eb6587529d0eb70110819392c90bacd2a0fc04fb838fff36cf1669cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320588, "uuid": "5a832dee-faa4-433a-81ab-a612111f9ae1", "value": "0AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320588, "uuid": "13a98bd1-9466-49bb-a685-9a3336d2ed4a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320588, "uuid": "2ba0b5dc-7fe7-4d74-9265-a22db8d8d78d", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320588, "uuid": "8a45d94d-238d-4bfd-a7d9-df75df56e8a9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320588, "uuid": "5e093681-7e11-4b0a-8592-85b18ad286aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320588, "uuid": "054d97e3-918f-4ffd-9952-29d64a8cf101", "value": "71149a83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d692301e-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320548, "uuid": "84262edb-ceda-4442-b2ee-0ad467238a78", "comment": "Malware payload (Dridex)", "value": "c1a45a6953f28c89ae60ea317814fc76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320548, "uuid": "9c07feab-9d4a-4566-a521-45d87700baec", "comment": "Malware payload (Dridex)", "value": "6ddc2f83a60f6f32657f4823c990a729df18525334577b4171703571fa4eeeac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320548, "uuid": "c4a938a7-fef8-429d-91b2-950d0125f8a5", "comment": "Malware payload (Dridex)", "value": "cb15319c85fae743659a71a45b69a68bc7685887", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320548, "uuid": "cf846a59-8a57-4190-9abe-991974897534", "comment": "Malware payload (Dridex)", "value": "c2e4108880e7d714f50f8581efbfc49ad006ee0c878b63d66b085d0f64040db17b5ea9637b441a5a053ec945fb04498c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320548, "uuid": "28446291-a94e-4e46-96ed-92d987066f2c", "value": "2DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320548, "uuid": "38a132e7-7556-4431-b99e-d5817d1bd765", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320548, "uuid": "8569bf8e-a633-42e8-b2a4-823117e4d382", "value": "3072:uiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:leAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320548, "uuid": "64041f72-eab6-492e-8580-8246d3c31438", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320548, "uuid": "6791d863-4783-473f-832a-9bb82af9dece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320548, "uuid": "8b72c3bd-f277-4911-afc1-f66c75632272", "value": "c1a45a69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e64cb27-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338788, "uuid": "c6371e89-6a23-41c5-ab0f-357c9f7a9ede", "comment": "Malware payload", "value": "9f93375437d64d3d5f292729fdeda510", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338788, "uuid": "21ab53c0-26c6-4398-a582-1478d55a057d", "comment": "Malware payload", "value": "6deef3ee36d371f032c19c174de70bf09bc6bfb37582fcdecb81df02e65428f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338788, "uuid": "7848544b-57f5-40d5-a82a-117779396aa7", "comment": "Malware payload", "value": "0af691ea02c828493230e0d69ab11b85a080ce72", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338788, "uuid": "bb25741f-b075-4f5f-b394-b3395f2f92c6", "comment": "Malware payload", "value": "31f72d9e3f8722964f789612b09333e297264c8554e33be626e9b6082ece794f01786591bee834f265543a9ee198e556", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338788, "uuid": "061802b7-a4ca-4e11-9372-9b2931345710", "value": "F7F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338788, "uuid": "6862fc6d-5995-4c85-ab6c-db3385493a7a", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338788, "uuid": "1db97940-3397-417c-b55f-0a4c7b7055d4", "value": "3072:8kG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:KERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338788, "uuid": "9d52479b-1398-4a19-b4fb-dfd5690afb44", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338788, "uuid": "0a52ed58-81fd-4fa3-a9a2-1d349cb41020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338788, "uuid": "826e94b3-661f-4931-a870-be774622b050", "value": "9f933754_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd92284e-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284536, "uuid": "c0e1cce0-6859-490a-a50b-42d37ab6b32d", "comment": "Malware payload (Dridex)", "value": "ae8f18865a33696420fa93d2a07b1af3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284536, "uuid": "55fe5448-75ee-4ca2-ba10-2544f2cb1fcc", "comment": "Malware payload (Dridex)", "value": "6e00e92defebfd45121025dc18a6a3f34439e2151d80a801492e97be99e3e365", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284536, "uuid": "f54124da-61d3-4423-9fac-358897ec0e5a", "comment": "Malware payload (Dridex)", "value": "94f13f88687b90f7adba262fdba63cacccade6e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284536, "uuid": "20bf5045-6ffe-42e3-a1c7-c79e3813b75c", "comment": "Malware payload (Dridex)", "value": "71081b1e365cf6f8bb4181e20897f75775d5761801110b6b0ed40350854b598bee6fcece99a115b7c6c2ece49ac36f94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284536, "uuid": "ddfda61a-700e-4b26-a80f-128baf23c4c5", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284536, "uuid": "a20b1eeb-493b-41a0-8025-128e42912f4e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284536, "uuid": "f0769e2c-3339-4a4a-ac85-b5136bc5d182", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284536, "uuid": "4753fcbc-67df-44bd-a54d-1f9d5067bf4a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284536, "uuid": "88b40260-989e-4f8b-9977-12cb3e5b3163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284536, "uuid": "0bad7aa1-c749-4951-80e5-0332ace896ba", "value": "ae8f1886_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7db2b43-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320550, "uuid": "e8e64b82-c90c-415e-a603-300a1e52ee7a", "comment": "Malware payload (Dridex)", "value": "54ebff24b3934c3846160f1da9ae488d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320550, "uuid": "33061b26-3485-4053-bc1a-bac2fc259f90", "comment": "Malware payload (Dridex)", "value": "6e1dd76196b44848bf03d446e8817677d4071f187364a92fb7a9c1db50a17f2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320550, "uuid": "0ec5c2ea-fccb-4a75-94b4-0b600bbf44bd", "comment": "Malware payload (Dridex)", "value": "93be82f842674b8974885c63d28e72fb174280f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320550, "uuid": "e44ebb9f-5ee2-423f-afad-460bb17f3eae", "comment": "Malware payload (Dridex)", "value": "1d649e02e0f1ee9ae4187d3b8b4caf030adb92e17169978292ce42dc7b8e317b50ed0b5e5222ebae473761568397ea84", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320550, "uuid": "dde10ff1-75af-44cb-be31-1366be3f2819", "value": "1AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320550, "uuid": "19e68feb-1f02-4bc7-8eb5-cfe40036ab5b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320550, "uuid": "70302623-e085-4a54-b31d-74d45a4cba25", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320550, "uuid": "68bc90b7-e578-45b4-814e-37cd0bca92cc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320550, "uuid": "efccd1fc-66a6-4743-98e4-27b4204f4dc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320550, "uuid": "d5e2e63a-660e-4155-bb29-f82e74d46933", "value": "54ebff24_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8ab9bf-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620295248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295248, "uuid": "0d7683d2-cdf8-4348-b06f-0e81207f30c1", "comment": "Malware payload", "value": "d847885a66698c06ec10a38878c032e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295248, "uuid": "ea37b3ea-047a-44e2-aa19-7ef8ab27096c", "comment": "Malware payload", "value": "6e26f4e8c26699081f4bd2e4d29d39704bb5be3fb527044853e0506022ff2307", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295248, "uuid": "4e539890-e0ac-4d04-987c-8a593ddd2fcd", "comment": "Malware payload", "value": "9aff08ff4a02d14bc9c811e99952815f9edcd690", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295248, "uuid": "921dd630-2a4f-405d-bc27-05c019288436", "comment": "Malware payload", "value": "b95e2f02285082f7ceb2613dfa9ca455f10855c51828c00c97556b22f2ed2ec3a0305e6a5e6dba1c985f331baf73c853", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295248, "uuid": "b02dc084-8e1b-44dc-98c0-43de5ee21656", "value": "3A74236E4422E06C6C4EA703FE9170923DDA0DD2CDB5AF5E87CB3BF718594D6224A0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295248, "uuid": "a860f73a-4b8e-4614-a70b-3ed536b2619a", "value": "6144:Aj0SyDOgY0YDhbEJgWYY2Yif2dyF6ztE1GWxcPOXjTxm+JGe+rPEFCz90F:Aj9yDvcDG3YY2YO0yQRPWaPf+z+rsFCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295248, "uuid": "2acc5849-a80a-49b8-8bec-ccff5b8c3107", "value": 365025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295248, "uuid": "7a59fffe-f24a-4cd3-aa49-4aab733177ba", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295248, "uuid": "66de2506-56aa-4f5c-95bd-b4452599e7d3", "value": "d847885a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff168cf-ae11-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620267628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620267628, "uuid": "c74414d8-c73d-42a6-91d4-cb8522757616", "comment": "Malware payload (Stop)", "value": "e00d79d79815ef47cf0d5ec5f3e76656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620267628, "uuid": "5e9c5678-8073-43e6-89ee-30de7aa25aab", "comment": "Malware payload (Stop)", "value": "6e8dafc9ac2e48e6b42dd15ce4c49d0dc0a83e6ca93fafeec8b87244ec05dea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620267628, "uuid": "4f7db46d-727e-4ae8-9a96-badf62028697", "comment": "Malware payload (Stop)", "value": "79efabc933ddf9406da1a761d60bfe453a930a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620267628, "uuid": "320a2e5c-5b57-460b-bff9-40082b17c974", "comment": "Malware payload (Stop)", "value": "81b98ef7c351108f024c04e465ebe7e1bdef5d0471cd8bcb091b021b0e4104ba0d66c35be26316449f03f065b3d4869d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620267628, "uuid": "228a5072-3ddd-4862-87a2-cba678783881", "value": "4E051230E590D035DD0715728C95E2B14EAD78A61B224DBF6BDC39F6EF38691B62230E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620267628, "uuid": "b3420377-3657-4d09-b895-02323ec5a06f", "value": "f82467823ad136f325b286fba7047ffc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620267628, "uuid": "59e29c73-3287-42b5-9e7a-a39eddc40b7a", "value": "24576:P9wDujNFK8jC1BU2gUJxJiB+ZHc1HpMzyI:1LN52vJieHc1Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620267628, "uuid": "82e0ae5d-e129-49f5-9918-5a702229acc3", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620267628, "uuid": "a3ccf87d-32e3-45ae-93e5-faacc0fdfbd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620267628, "uuid": "ea9ac76f-4ef8-42b8-9440-bf3850132be0", "value": "e00d79d79815ef47cf0d5ec5f3e76656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c40cde-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266458, "uuid": "f1bde05f-1148-422b-8afa-44004a4b1cba", "comment": "Malware payload (Dridex)", "value": "3680fb13ff6b76bca40198b90b7c0caa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266458, "uuid": "7731a790-f523-40dc-8fd4-e2c86849bbcd", "comment": "Malware payload (Dridex)", "value": "6ec8bf763a644abd75a171976ad70107a9688a864bb5641cb712199f62d0be35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266458, "uuid": "acb5cf80-2752-41e5-aedf-59310022843f", "comment": "Malware payload (Dridex)", "value": "46a65d34e822a8948c765ba84e7b2299c4dfb710", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266458, "uuid": "23142ab1-17ef-486a-ad04-bb1f66910043", "comment": "Malware payload (Dridex)", "value": "63c304c32a666ac9fd3d67949ba39d8f71b0528d8a0b1cf23b7429cdeeca0d0b806e379ea4f140394e44d529be8de784", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266458, "uuid": "f6b52809-6037-42f1-9b5a-c2686ea12f9b", "value": "32F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266458, "uuid": "5d0eb624-16b9-4a1e-a374-de5460c9ff88", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266458, "uuid": "d80c0658-b9d3-4a64-83a7-0fc9cc2fa5fa", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266458, "uuid": "da72272c-3268-410d-83b4-86af0ea2d479", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266458, "uuid": "5234d4e4-6111-433d-a10c-c2b417bc2d22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266458, "uuid": "8134ce96-c655-42f2-8bf5-fad484e8c5be", "value": "3680fb13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bd9b8a-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309653, "uuid": "4acfdbeb-eae0-4468-9d32-37eecfa5553d", "comment": "Malware payload (Dridex)", "value": "1498dba52a372457b73c6e0e8421788b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309653, "uuid": "29e282c5-29bd-44f1-b144-ec332dcc2666", "comment": "Malware payload (Dridex)", "value": "6eccced1ef578cf52659342263edb391ce2a5c8a7cb6e2ad688c6de366b9b64a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309653, "uuid": "77478a9a-813d-45d0-afe5-e1b0adb47fd2", "comment": "Malware payload (Dridex)", "value": "c35ed016190530da60fcf5684b813f080bcfe181", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309653, "uuid": "3410f6b8-11c6-413a-94de-ce43dbc7cab8", "comment": "Malware payload (Dridex)", "value": "a42a6f68b0e3fbd739c0064a2a92a52970c5b127015642cb503087d18ba31bc54dee5ff546fcebe4e00c3ebee8521a83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309653, "uuid": "8c764815-91f2-4ace-ad9a-4c0ea588c4f8", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309653, "uuid": "2a5ded94-5802-47d3-b134-780dda86a92a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309653, "uuid": "f64c0961-5387-46b6-bbba-ba86d38b7dea", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309653, "uuid": "cac511c6-7752-43e9-baf9-ec53f198301f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309653, "uuid": "5ac9db0a-d555-4fa9-a45e-1809724f75a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309653, "uuid": "82ddedea-825e-4eee-8d14-52ae7e07757e", "value": "1498dba5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08d33b3-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273696, "uuid": "b2a2dc08-1891-4d4b-a237-1ff5290ce74b", "comment": "Malware payload (Dridex)", "value": "5134947dedc139bc05be61a264106cff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273696, "uuid": "4b9fc42f-1111-4559-aac9-8f477c5285ac", "comment": "Malware payload (Dridex)", "value": "6f0bc2f0fa888aa411afbdb66f91c20c26c2d3294a88bafe2415fbd1613edb67", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273696, "uuid": "09ec6a8e-958b-4b85-95bb-8bc05e659973", "comment": "Malware payload (Dridex)", "value": "f97a6ddd266c2807de1ae597ef65c54c9c606e4c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273696, "uuid": "3a15f745-ed37-4938-94e0-39ce5bae2186", "comment": "Malware payload (Dridex)", "value": "f09bab09904b8b1eb282b5f5ffc475994c3cdeea5b2210379183bd72b160340d8a928748671960d7ce9e28ddd5d06899", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273696, "uuid": "85f8a1ba-3dd1-4b8d-8d61-25a006482cf7", "value": "69F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273696, "uuid": "96b7f383-a6a0-4370-8d97-7c10a492be8e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273696, "uuid": "fc98fc54-fb9c-49ac-b9e4-3d96765531e2", "value": "3072:QB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273696, "uuid": "63739527-54c5-4b54-a715-cdd0e1232af1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273696, "uuid": "f79a8d6c-b10f-4689-8660-0bd405937daf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273696, "uuid": "c1a5436a-8331-43b6-9689-65bd48280315", "value": "5134947d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4ce761-ae69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620305312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620305312, "uuid": "e1f525da-0b20-4846-930e-24af7d10165b", "comment": "Malware payload", "value": "462ee630164b599b1c9449e33f06d2c5", "object_relation": "md5", "Tag": [ { "name": "Sein\u00e4joen Squash ja Bowling Oy", "colour": "#462F4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620305312, "uuid": "3f704f1c-e347-4c85-988c-c92ab70096c5", "comment": "Malware payload", "value": "6f522cc6adbe791575df40a518ba10c89cb54af0d849be0841b036b05d441fa9", "object_relation": "sha256", "Tag": [ { "name": "Sein\u00e4joen Squash ja Bowling Oy", "colour": "#462F4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620305312, "uuid": "ce6895e0-1d96-4fdf-a50c-5ea0821230c3", "comment": "Malware payload", "value": "4637841b862ff603583b794a5d5ac70000697bc6", "object_relation": "sha1", "Tag": [ { "name": "Sein\u00e4joen Squash ja Bowling Oy", "colour": "#462F4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620305312, "uuid": "eb12d76d-6ef5-459d-b1be-3d90c8388295", "comment": "Malware payload", "value": "3d6b12b0734b509dd64df6f2656cc8a29b20d26cb15b2b3b8cf4df5a92a321cbb785dcd0f74a8446ef36e97d5d984f86", "object_relation": "sha3-384", "Tag": [ { "name": "Sein\u00e4joen Squash ja Bowling Oy", "colour": "#462F4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620305312, "uuid": "928bbc9d-3fc2-4e30-b6bd-f14ac6932828", "value": "22956C117A93ECB6C1130F31B908F279B2FDE5740BBA41C75394BA1829355A2962CDEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620305312, "uuid": "fc27e4fd-964c-4a88-bf90-2cdb90b481f2", "value": "a990f14a3344125f094d62df73e0963a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620305312, "uuid": "33849d8c-b658-43a7-86b5-b798581829dc", "value": "49152:RYSyVYw+KDhmI8xo4KB8ZnaE3jYMX2Ysyehlkfu/4xAKtL:RYLVnHDhh8xo7BMnaEzTX/syehlkfu/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620305312, "uuid": "9d0a5059-2327-4e75-bcb8-4fe2b633aa86", "value": 2021312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620305312, "uuid": "37d43f4b-fa3b-4678-bc50-bc09a564c2ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620305312, "uuid": "23d58515-d8e7-4e65-947b-d3dc4294db47", "value": "6f522cc6adbe791575df40a518ba10c89cb54af0d849be0841b036b05d441fa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16943ebe-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285437, "uuid": "eb1881f6-d96a-49f2-9f13-0d6c5305bd7a", "comment": "Malware payload (AgentTesla)", "value": "eb60bc1bed2d582bb4e17323c988a416", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285437, "uuid": "1800acb8-0095-482a-999f-12d32c78b2c3", "comment": "Malware payload (AgentTesla)", "value": "6f90e14595a67191a4969df0b85a828346921d6d4656ea793770b47a54d5b790", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285437, "uuid": "9fe12e6b-4e85-4967-9e3e-022ed595571c", "comment": "Malware payload (AgentTesla)", "value": "3ea995f593f526ad8fd6c83a6ef1ac80680f71fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285437, "uuid": "bafcfcec-f3e1-4295-862e-3f208304ea4f", "comment": "Malware payload (AgentTesla)", "value": "f17a7d2d351c4d9ebde1056e8beaa7480a8dc5adb8b6133bb103fbdeedc8ecd07b78e1a07042164e28d6272db444c5fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285437, "uuid": "35a56ad8-3a65-477b-b8f7-f708c228c393", "value": "0935AC52A2589A20E97B63304432C53947B73D16E272D31DBEE97CEB3F736819627213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285437, "uuid": "d29b70bc-f8b4-4247-8bba-de28307dc85c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285437, "uuid": "b713a585-701a-4d41-a9ef-a8cdbff8089e", "value": "24576:ihukwpJs/mlQegQlInFRZXRtWFMGMWQ2:EKslHznFRntCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285437, "uuid": "4721859c-d94d-4d96-941d-7dcb5ba3812a", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285437, "uuid": "4d3bc1b3-b7d3-4f5c-8991-20905da45a1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285437, "uuid": "7105ba47-330f-4a01-9662-8611b0b7f865", "value": "PO# PO2104280031 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0d6f9d-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324127, "uuid": "3d797cd7-c205-40cf-8b4a-9c8946bce404", "comment": "Malware payload (Dridex)", "value": "af633ff695b2e328470a6f5f8689eda1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324127, "uuid": "b49db2d4-a5f5-446d-880b-19b5a93a8e2b", "comment": "Malware payload (Dridex)", "value": "6fae61bca04a2152c8496d25d6857a582fbe873dd6ac211e0441d0848a7e84b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324127, "uuid": "ef9d9072-b7b5-4ce9-9af3-a3e46a9af73f", "comment": "Malware payload (Dridex)", "value": "12ad38ff621231e05ae252280388f7f684d91db4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324127, "uuid": "2725fb3b-72d5-40b1-b6e6-e9da814db084", "comment": "Malware payload (Dridex)", "value": "7b9b8ffd093d76516ca22cea6e3b8961e41ef4fcd1911b1396082f735d363df43f7eebfed5469b72c1ea2dc7d62edb73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324127, "uuid": "4577fff8-55bf-4711-bc86-e550a28d781a", "value": "63F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324127, "uuid": "97238027-2db2-4ba9-9df7-dce4f640f3e2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324127, "uuid": "e7aa6421-3434-4d2c-b7d5-84d2e5df1eb9", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324127, "uuid": "c2702f01-ee77-4e75-b08f-ba7590c4d211", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324127, "uuid": "3513a440-321b-4595-864c-026d24415cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324127, "uuid": "f24e920a-0ed3-4b74-9833-5d5e4bf13731", "value": "af633ff6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad6fa27-ae93-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620323508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620323508, "uuid": "5cca4eaf-2430-4c41-914e-77f159567e65", "comment": "Malware payload (IcedID)", "value": "3431f436099a12a223f837c8b905c442", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620323508, "uuid": "10732b5b-4ad8-426d-9b01-6e9d6d79ed86", "comment": "Malware payload (IcedID)", "value": "6fb512a27348df40379fd4324f03e536c81ea6624e57adbd2d2125567bff4287", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620323508, "uuid": "e5e23706-0230-4f75-bf21-e57a4ed292f8", "comment": "Malware payload (IcedID)", "value": "4e9a15f49817da396030652a47381d766e306f62", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620323508, "uuid": "9808820b-4105-4b84-be8a-ecd5a23015c4", "comment": "Malware payload (IcedID)", "value": "1e13c44ad7a5c42911211b02714fb34db4b2eb46804663eb70c611c844c6613ae0177fe262e48908a45eb619b68868af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620323508, "uuid": "2bcc725a-6310-4e95-b456-6f85f5a67d47", "value": "85349226C9E8D17DF147A4B6743CDB88C554AE809E218DE7A6D6C812BF138B117227CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620323508, "uuid": "6951dc50-5439-4500-a535-52a574fe1681", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620323508, "uuid": "28cc7e0d-6c92-48f1-8705-a38f7661db24", "value": "3072:/Z+jEoUhhUuTjmhkJU8XV+eDOWedYlGRWMxAeiAbO+yH5wtrPPPPkeU/hLzQHaOO:HlmE9rfwZSueOIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620323508, "uuid": "4fbb30a8-1634-41a2-9c3f-779c1da6cdf9", "value": 244312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620323508, "uuid": "42a0dd6c-c2e4-41a7-a162-6f601b3dd7ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620323508, "uuid": "7c2aa780-797e-4d06-bacb-5a1f858a021c", "value": "6fb512a27348df40379fd4324f03e536c81ea6624e57a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2961dc7d-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620309520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309520, "uuid": "49b81405-fe4c-4eef-b0c1-4c439d408aaf", "comment": "Malware payload (Quakbot)", "value": "2b5ac4c00e20e875ad3574033367db23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309520, "uuid": "815b0f3f-5bfe-4987-ba8a-be165bb51e08", "comment": "Malware payload (Quakbot)", "value": "6fbcea3566bf29fc80e928a90356345460c85fc5f982ee684d4775c0120d59eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309520, "uuid": "1ebdb747-44e9-4202-9760-ed6dc1a75352", "comment": "Malware payload (Quakbot)", "value": "1165f4764c74f024285a44752faf54de0b6d8a63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309520, "uuid": "a796be1c-ba45-43b9-906e-0d1fb57f5f75", "comment": "Malware payload (Quakbot)", "value": "40511fb5aad7e166031e779da6560815ea3412f3497246f6a296575b8c4c3e407fcaafaef61ad25c076f3efeeeccf465", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309520, "uuid": "842db86f-f8e7-4630-a571-d930d059010f", "value": "0A05BF22F2A1CC37D27326789E4B52646D39BE50F93899862FD41E486F343D13B36297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309520, "uuid": "b569fb36-7919-43ee-b71b-489b9dd361db", "value": "f8b50da2e330b5dea32ae4760264b148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309520, "uuid": "acb442fb-59c4-433f-b096-27b3c9e3e164", "value": "12288:+LR2XCmohgp+8RhuxTyAK4X+PAj6iMRbM+bevd6CR/Vr8m+BzJoKbxeEJuBnitAZ:+FaCz8nAO42HzxdeEJuBPOu+99z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309520, "uuid": "a5318058-4c76-440f-a367-997f86c8aa70", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309520, "uuid": "36ccf467-b9d8-4a8a-aa31-cc0a7af1f067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309520, "uuid": "17532fbf-b4ae-46ee-8654-33875833c026", "value": "44313,6048108796.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc621c25-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291754, "uuid": "c58e9022-073e-4237-bbb6-7c05f0a744bd", "comment": "Malware payload (Dridex)", "value": "5069fd0e1d4dfdc1f41fb389adad639e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291754, "uuid": "0d9fcdc0-d402-4882-8ca1-491ec36a154b", "comment": "Malware payload (Dridex)", "value": "6fd37d10c04e846c6d16721e734cc8ad5a5929603d29b09e6e7551eb5ca56d89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291754, "uuid": "1d69137e-83ab-4747-a771-0fb8d2fcfdc9", "comment": "Malware payload (Dridex)", "value": "64986b1031d1d889a9b22c15464428a383635b06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291754, "uuid": "435c93bb-267e-4de9-b4fd-a2b193506c64", "comment": "Malware payload (Dridex)", "value": "a6aa87e2005e74c219dbcaa7fd3abeb57eb8e9b888e36f94413a115a982350a2250aab240ff531d9e9d9cf93cd37c194", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291754, "uuid": "902eee44-e2f9-421c-9fb7-b30ad4e04f5c", "value": "D6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291754, "uuid": "a6b7208e-4144-41f5-b7ee-5e2452872092", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291754, "uuid": "0464813f-5863-4a7e-8ffe-104265be5088", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291754, "uuid": "cdd54375-c5f1-451c-bf30-5ebfb11880a5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291754, "uuid": "c814f3e3-1366-4fd5-8f4e-bc3097c4149d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291754, "uuid": "4125a1d0-a445-4666-a0e6-7d5891482006", "value": "5069fd0e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc105ddb-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620281017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281017, "uuid": "290c9784-38cc-4c0d-b6bf-d2c40f021150", "comment": "Malware payload (Dridex)", "value": "6f5f13392c265b3ca96603ad02f72bcd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281017, "uuid": "d7f1581c-62a5-4a7a-b921-211326fb6be9", "comment": "Malware payload (Dridex)", "value": "70082904a75ab0e0918af19e098293b1a0109f9db89625fdfe03f4c68185fbde", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281017, "uuid": "64e02d1a-799a-4d30-b038-cd14c0b6b7f6", "comment": "Malware payload (Dridex)", "value": "33548f2d73fd9d95879656d68ccd46f355d57d5a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281017, "uuid": "fdd8b823-c69a-43f5-941f-109e05df8a70", "comment": "Malware payload (Dridex)", "value": "b4bd0d08ae4882de7c24a0d705453e7ab828b4fbb0df6b26fdf7d3a4e3bd19eaf3d607723ebfc94001f974e548456673", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281017, "uuid": "5c537817-8703-47e6-b436-f3d7edb2cf94", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281017, "uuid": "025b9f49-64f4-4732-a2dc-201f8d79f5d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281017, "uuid": "d8a73e16-456b-4261-98b1-d8f766faaa90", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281017, "uuid": "f71cf045-fb73-4091-92e6-84945333db87", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281017, "uuid": "ea38a557-3b93-4d6c-aa41-702aee20d2b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281017, "uuid": "a6f2ddad-cc30-4561-b080-912e1a3cae34", "value": "6f5f1339_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13c0f60-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309748, "uuid": "628ce139-19fa-4547-9cb6-16855af51526", "comment": "Malware payload (Dridex)", "value": "edfe02b64facd63320ed5fe62a974119", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309748, "uuid": "2a9dff03-ba8a-41ec-abe9-75c0d022c890", "comment": "Malware payload (Dridex)", "value": "7077ee22e37da1c5c4840582b72853b0e2500c5bafbcda76c4e1490fe6c9652d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309748, "uuid": "fddb7f80-4c99-44f5-bd83-b43aa1677176", "comment": "Malware payload (Dridex)", "value": "fb03d26ad17d288834458ad6faa41c07649d789d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309748, "uuid": "44303f30-2fd6-4b9e-a427-d774a45e989f", "comment": "Malware payload (Dridex)", "value": "2b9c6732b689e6dc5f2aa5433b5e87395d702458ea9cdb116f7630aa3768f69cdd0d418dbc9cc000f7124e8a7d19da82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309748, "uuid": "c80037db-0256-49cb-b2ca-5185df767bc7", "value": "65F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309748, "uuid": "5c93ee0c-746e-4ece-bc7d-4a53643beae3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309748, "uuid": "3931ab90-95cd-48cf-bf8a-cd5088976a52", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309748, "uuid": "8e6b7562-702c-4317-ac5f-729502026494", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309748, "uuid": "ffb62000-5bb3-43ed-bab1-5d7056c1ebac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309748, "uuid": "ad58ee4b-1e20-4081-a120-f53ad305bff4", "value": "edfe02b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088bfc44-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339100, "uuid": "4f241b7b-abee-4e51-86d4-a9223e4abc47", "comment": "Malware payload", "value": "c9227d8d7d4cea2f59994b9e1f4369da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339100, "uuid": "c8166fb6-cdc7-4c78-b1f1-abd91a1d83b6", "comment": "Malware payload", "value": "709ade125b7766c70097dbe538ed560d9c78fe088f71aec2b9446d97f0ae4f07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339100, "uuid": "9deb6e6b-9bf2-495f-9f91-bace69756a35", "comment": "Malware payload", "value": "11aae795c2f8f541eb4c2b5e87e3aa2f6ac2fee5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339100, "uuid": "da4b5d68-c78c-4172-aac9-4d1667892cc7", "comment": "Malware payload", "value": "e7499130921cd59645c319ab08a4b4bf028b7fe1b4dcd0358704db0925198017a825133e2f4376edca17e2dce845f930", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339100, "uuid": "0ced1df9-44a4-46bf-9043-e9b7254e4126", "value": "8BF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339100, "uuid": "27dbb026-4faa-449f-ae8b-bf7284b89fb0", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339100, "uuid": "738b1d7a-e706-4aae-9756-9a4f44955ed0", "value": "3072:qiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:SERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339100, "uuid": "53ecbf24-322e-4816-9285-f8ac0ce239d7", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339100, "uuid": "b82d84c7-b1c6-4eeb-bc25-d684261ae749", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339100, "uuid": "faa75b58-ae77-4ef9-b963-49df42ab17c9", "value": "c9227d8d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b5c7ae-aea2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Cybergate)", "timestamp": 1620329804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329804, "uuid": "fe3cc6f7-ce56-4b31-89d9-c88bc6eb51cc", "comment": "Malware payload (Cybergate)", "value": "23b164d8c48b45a03a7e80640e53a233", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329804, "uuid": "412c4807-bcf5-433c-a219-d44b5a55cd50", "comment": "Malware payload (Cybergate)", "value": "70a9324fd74829cb87228210962e4b68747f6203b4de74e061d67fc4b7f5da51", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329804, "uuid": "0bbb37b7-e299-4be0-8c1c-03fa5db49ea1", "comment": "Malware payload (Cybergate)", "value": "0a2e835662940927e63d510e955839e4ffdf0b69", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620329804, "uuid": "1b8c3956-c46f-4cc0-9044-a10fe56cb4e5", "comment": "Malware payload (Cybergate)", "value": "9ef2268c30ed259fd6e067024fedbacfed890632910df07b4cc83fb7f869f782ef32d2ee09186269c4a4d8c614ce0c52", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329804, "uuid": "5430275a-7a91-4c87-b205-01fc7d254326", "value": "AC6401AE3888E684C4523BF07A18D0F459693D816904A1257EB9FF9F7839093EC5727F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329804, "uuid": "3a58b5f4-d6e8-4040-8d23-8bd51462746a", "value": "cba5bd52b3e624400ffe41eb22644b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329804, "uuid": "beeed514-11f6-4ea3-8614-180cb26113ae", "value": "6144:Bk4qmbiOAi/ninkTXUUh1ri61WfcFk1Tq4NfzSa:W9eI2ikrBc/fPZzSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620329804, "uuid": "9cc18142-c22d-4566-b0df-1ec875677529", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620329804, "uuid": "f4425e22-48e8-49bb-8b75-d04d28383acc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620329804, "uuid": "7e1a1e59-a3e3-4e08-a5af-1a1b09c357d2", "value": "23B164D8C48B45A03A7E80640E53A233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130677a1-ae8e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620321079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321079, "uuid": "c3c74199-bfb8-4dcc-a3fd-b7b8b8933e1a", "comment": "Malware payload (IcedID)", "value": "11d245d1f309022f6f59da477858f404", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321079, "uuid": "1c7c78f9-738f-4173-959c-6a21d1dfb763", "comment": "Malware payload (IcedID)", "value": "70af1f4be8b7b4b4dbad4861dfa75b4b65c4697f1ab5a824d273a7f302518a01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321079, "uuid": "cd78a046-e16d-4752-8606-024dffb8c235", "comment": "Malware payload (IcedID)", "value": "2250ea4e6c6b483f2de744b733549c7da546ff27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321079, "uuid": "09591b3c-0fac-4068-87f8-0d323c270d2a", "comment": "Malware payload (IcedID)", "value": "a3cea341367c25f57f0749d15772611cdb92ba445ff5f81203244c5a723345b1c8311a8d439cc2c1e7073eab6fb58aea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321079, "uuid": "7d6eb00d-474c-4082-9d26-2134616035a1", "value": "28346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321079, "uuid": "42e3ce0d-ab90-4f6e-862a-f4c89a4bde5c", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321079, "uuid": "c0c801a8-fad0-47c7-8fb5-851991def2f2", "value": "6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888IP:dJJLaU1mUGduNzGSijExi3oomlnG9PSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620321079, "uuid": "aa6f2a3e-b4cb-407c-a70b-2bedc31f79b3", "value": 240216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620321079, "uuid": "14e961f2-55b8-45a1-b058-f7f85a8149b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321079, "uuid": "46e30031-1021-4005-8698-be60c0bd73bc", "value": "70af1f4be8b7b4b4dbad4861dfa75b4b65c4697f1ab5a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ed72de-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620327652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327652, "uuid": "b8bd86e1-4454-40e5-97f7-68bf74b19a51", "comment": "Malware payload", "value": "f2541b6c2ec828631c08bd2c3f926049", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327652, "uuid": "ed49f67b-c3ce-43d1-a729-755f8640b5a1", "comment": "Malware payload", "value": "70b81c9d61eaa7a58dbab782534d733e5411dbfb77a825b33faa9e4406582590", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327652, "uuid": "70a70f56-ef34-4fa6-b321-a64f3a58a769", "comment": "Malware payload", "value": "74fcec5818558944e32a4fe3bd3c126ff68ce1c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327652, "uuid": "5d03a3d0-0e6a-4d93-b958-66b500082bd2", "comment": "Malware payload", "value": "1278532fd621c14b43e5ab4d24f7ceeaf15110d5b34c7b5023b7ef95c74a6665fc2a825748a4b39a0a2e33cc10bab2a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327652, "uuid": "b18f3c79-a02b-4354-86c8-84bb52e440c5", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327652, "uuid": "66e88a2c-0f34-454c-b8cf-693de13779b7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327652, "uuid": "6e1f1cc0-eb60-48e6-b4a0-f9dce964baa5", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327652, "uuid": "68e26034-0f02-48bc-a262-90187b978625", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327652, "uuid": "b597f459-08a7-43db-8414-007b0e0d3308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327652, "uuid": "305671fc-0259-451e-b08f-2b85ce6bd6b3", "value": "f2541b6c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92062994-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327734, "uuid": "5093bc70-7ac5-4b30-a645-cc320480e705", "comment": "Malware payload (Dridex)", "value": "e77cb70851f365a8c3d4fc8a01df4c26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327734, "uuid": "6f3c97ff-cdec-45fe-b7bf-5ef2a6dabe49", "comment": "Malware payload (Dridex)", "value": "712884cde4fabc3ebe304ef70e092b55eb3aae2350aeee3a9463f9b3a69a7fee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327734, "uuid": "43019472-2a97-4506-98aa-2305338a772e", "comment": "Malware payload (Dridex)", "value": "7941bcb294603e879bee8fc1f6212dd4301313c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327734, "uuid": "8ca516b5-6cb0-49f1-b950-1c5d0f5022b6", "comment": "Malware payload (Dridex)", "value": "85388845953c9ac6bc8e50caa9420fd227bcbcbf7116d1849cd6d74d97772a9bd552ebaa67e44b9e609ef5b01f3d094d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327734, "uuid": "56bb9e88-ad3d-489c-8b5c-b5466b227394", "value": "AEF3C085DBABE87FC44A35399471DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327734, "uuid": "da2331b9-d622-44c4-991a-10bdde1b288c", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327734, "uuid": "e7573ba4-158f-4eeb-a40b-8ddb88d22852", "value": "3072:ge45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:F4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327734, "uuid": "2ff3e5c8-2f7e-496e-b860-53efdc889dbb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327734, "uuid": "14980209-cafe-4c66-9e48-9713a49a1e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327734, "uuid": "4989c6ea-b4fe-49fa-87f3-81a33f6cfe08", "value": "e77cb708_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb357bf8-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331347, "uuid": "6e6cdca6-26f4-4993-8413-336090dc29c6", "comment": "Malware payload (Dridex)", "value": "effa839d598b460ee8e7290e88d0f1f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331347, "uuid": "9703b5e2-4c1d-4b87-b6bf-33f35c33f0ce", "comment": "Malware payload (Dridex)", "value": "71701c2155608390713e320cb2a58957438c3a346a7342cf984b4733ec1d029d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331347, "uuid": "71f6ae38-1cc9-4fee-b380-424fb828977a", "comment": "Malware payload (Dridex)", "value": "ef41549b07f0888897a8325d7106f7631168f2b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331347, "uuid": "fac9926a-fd15-4dbf-ba5b-bb2f723c1845", "comment": "Malware payload (Dridex)", "value": "47ae168cc46454ab6f40d65cbed6d5d52bf96435f4795831079cd8476e3df17cde1f5fe5adbbd47d10b07d8be0e601c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331347, "uuid": "1649a8f1-add9-4bc0-b08b-70428c5f6d05", "value": "C4F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331347, "uuid": "a8e5b3bb-d2f6-4864-904c-1439e8814fda", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331347, "uuid": "f27abccd-a97f-43de-9b7e-1da983ff574f", "value": "3072:ObG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:VERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331347, "uuid": "5a1c27bd-4646-4a23-8f1c-47c3c2fb8ddc", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331347, "uuid": "b41b540a-afe9-4bf8-bae3-b9416c1acf85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331347, "uuid": "e8c302c3-bc08-4a56-a143-1352d241da77", "value": "effa839d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0098a64a-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285400, "uuid": "3907d20b-a151-40e5-b1fb-528ed89960fe", "comment": "Malware payload (AgentTesla)", "value": "c3a5ba43f3c6b80f4ba41af853ba1eea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285400, "uuid": "62465dbf-0984-457e-8908-183c8d31f6bd", "comment": "Malware payload (AgentTesla)", "value": "718f9065e9aff74288e63d800e903057b889d54913c8ce27fc7859cf2643018b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285400, "uuid": "6cf7fc95-1c99-4602-8e02-978e01fd5b5b", "comment": "Malware payload (AgentTesla)", "value": "29f3dd0b5dce262ab7cdf318df7523e508963541", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285400, "uuid": "4442056f-8290-4f9f-b9ce-627dbb1c74af", "comment": "Malware payload (AgentTesla)", "value": "ef031255fcd9000414b1719c98bb4b1f2f4a53903c0f7a4643472851324b6586af9f97fd2e77ee93aaa971ab95092749", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285400, "uuid": "e1a3a516-3df8-482b-8d92-68db4ee8674f", "value": "89159C04B7A45BE7C2CE43B9E19D271153F1D416B29EBB8B6948FAF93C9339189001E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285400, "uuid": "f5fc7548-7ad2-4eaf-aa37-a65ed6de4a26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285400, "uuid": "f2e1aaca-6f0c-494c-87e7-40a91827853e", "value": "12288:hL1fxhwL8mLAHefRIZtbVqrTwqEZbndWMWH+pLTfyXACaMuYvKZ:LZyJAH/ZtxqEZbIMO+NDQvs3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285400, "uuid": "fbbe67f0-0f77-4f47-ad65-4e71f011bd63", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285400, "uuid": "a87224d9-af54-49cc-96ae-172324cc46ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285400, "uuid": "8d094c8e-ee8e-4712-bbb9-6f75dccf7a5c", "value": "Current SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7144ada6-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338846, "uuid": "31cd8fff-d48a-4692-9fb6-dcd5da8fe1a7", "comment": "Malware payload", "value": "aa89e9e26734591cd7195443d8871023", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338846, "uuid": "4bb2b8c5-0ec3-4369-adf2-77f5f822a5df", "comment": "Malware payload", "value": "71d6a13624fdb09a6f01163ce8cb1b987ef5711764db969ed228bb2e6a59fd7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338846, "uuid": "220ef332-30d7-449e-830e-d8371a7b8387", "comment": "Malware payload", "value": "4526d38c7a4fefc4113575e5b8941458eae33ec4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338846, "uuid": "f5db49e0-1f70-4acc-9d66-74a17bf637ac", "comment": "Malware payload", "value": "f3b60124f449e3b1ea4cc84cde6b711fd37441b0f911a23f2a9cd2b051b9913fdc8d1447eb1c8e44222b155d2e84e59b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338846, "uuid": "a224790a-e7cd-43df-80e6-b91c98b16eb6", "value": "87F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338846, "uuid": "c6068df5-e687-489e-ab64-c47d0abe282b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338846, "uuid": "c2455397-6874-4510-a0cd-1a519d8b34db", "value": "3072:9C45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:c4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338846, "uuid": "4b66dea0-4b20-484c-8be7-d76ddeb7b5c4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338846, "uuid": "8685e401-5779-447e-8945-8b71aeae140f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338846, "uuid": "d62dbdc1-5bd0-45dd-80ac-eb0360fc7702", "value": "aa89e9e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd629b2c-ae89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620319271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319271, "uuid": "ecc2eae4-51d2-4ec6-ae3d-22f1cae112fb", "comment": "Malware payload (Quakbot)", "value": "f5e796292b2cd1008a449a1608c87e5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319271, "uuid": "88f213b3-84ee-4184-80e5-8a718e85faa3", "comment": "Malware payload (Quakbot)", "value": "71fd7986dd41906e1e868f60a1b89d9d591ea261c45a65848d94b07a0378e31b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319271, "uuid": "24bc5de0-4e9d-49f7-9a6e-7f242e6a9db9", "comment": "Malware payload (Quakbot)", "value": "a1ff7b01bbff503a0087c502c1a353956b808a38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319271, "uuid": "0b619aac-3dbf-4d84-8a7e-694c0bcae43d", "comment": "Malware payload (Quakbot)", "value": "f8828bf440de55e9b5267d940904b1f24d8e33ab34f0e2f8b6d4c927fd144467d403dff8e94d888f78d1f3331cef2528", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319271, "uuid": "3f4548ae-059c-4301-a467-ced08038f670", "value": "8405BF22F2A1CC37D27326789E4B52646D39BE50F93899862FD41E486F343D13B36297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319271, "uuid": "537073e2-318b-4374-9f96-6b67bdefbc76", "value": "f8b50da2e330b5dea32ae4760264b148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319271, "uuid": "c19fdd4a-3527-4351-a33d-26eb0df6dd31", "value": "12288:+LR2XCmohgp+8RhuxTyAK4X+PAj6iMRbM+bevd6CR/Vr8m+BzcoKCxeEJuBnitAZ:+FaCz8nAO42HzoseEJuBPOu+99z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620319271, "uuid": "0137a4fe-3af8-4f61-af3c-65ddd0ccb8fa", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620319271, "uuid": "843846dc-d723-4c46-aa9a-a8deb8af634c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319271, "uuid": "91269838-18c6-48ae-a62e-5f34e8cec3c4", "value": "443136048108796.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7aa6a6-aeb0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1620336078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336078, "uuid": "e3f9f785-3e72-4542-9fdf-37ece632d390", "comment": "Malware payload (Vjw0rm)", "value": "d720234b5136a9aab99e6bb59b6f45c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336078, "uuid": "ce579f85-428d-4a3a-9111-d0b83431f3c3", "comment": "Malware payload (Vjw0rm)", "value": "7209b5eaae21d79e72ea7fad3fdf9430e4f6fa4c4011c29fdedb71035f35e0b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336078, "uuid": "ffef6a73-673e-4034-acb3-ce0fa183a437", "comment": "Malware payload (Vjw0rm)", "value": "9833e954338d45830ab5603486319f4a46ceca01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336078, "uuid": "2f4f6004-ccae-48be-b9b7-d58fe29d98bc", "comment": "Malware payload (Vjw0rm)", "value": "47286ba075879670aaca540cf788b0b900b3124bef23b7b8c58cf49fef22e4fcab62882a47fd3938f67e48c321f2f497", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336078, "uuid": "ebf371de-a31c-4ae1-883a-23492f4bdf4d", "value": "C2C59D50BE945AF9EF8D1D0ED06EAB1DC7F042172D22706BFA516F02B9DB146810B26F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336078, "uuid": "d23c640c-e29d-40e6-98e5-2b4ca125b0d9", "value": "24576:zr02WmJhZcEv7QJuqbpYCg27z5lugqgFsNADLM6UW8hMz9LeAGZDPApZlfLeU3DI:t0fsBmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620336078, "uuid": "76fd4617-b727-40e9-8d19-e86eb9d13f93", "value": 2562938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620336078, "uuid": "65cec3f4-8f4d-4601-bfcb-a262653f900b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336078, "uuid": "528b8b2f-5dc6-40d1-9670-86c05a66676b", "value": "NOTIFICACION DE TRANSFERENCIA VIRTUAL EXITOSA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34c415e-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338957, "uuid": "b2405767-1864-4d28-a3d1-a6679c25a0c4", "comment": "Malware payload", "value": "70093f4475099a76003ea06d8bf2795b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338957, "uuid": "76492925-204f-4a49-8ea9-6df75f563f07", "comment": "Malware payload", "value": "720e924198b0922df8719aa6fc57df52cf94c3eaca1ddacfe16613d54fc422a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338957, "uuid": "efb53fa1-cbb8-4320-be5a-c90cb13c3142", "comment": "Malware payload", "value": "fbe9348c931d9338de462efa54d9a1595af08f04", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338957, "uuid": "9f99225f-60b0-44ab-bfbb-17577157849b", "comment": "Malware payload", "value": "b13601ec3ff88071e3d00b1c639dbaa8dea0424322a0f5cfabcacfcf982f30780959ee2b2681724ce34cf9615bd9d9a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338957, "uuid": "17e06f5b-b941-4ae4-9b18-44c6f5936e65", "value": "D9F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338957, "uuid": "9439de96-3245-4a8d-965f-050c6601aae8", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338957, "uuid": "ee4b70f5-422f-4541-83de-262ba785ba96", "value": "3072:iLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:pERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338957, "uuid": "ac7a8d79-d906-4426-af09-6b42a486a2b3", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338957, "uuid": "697871d2-2457-474b-99fb-73452377ec68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338957, "uuid": "32d69729-a845-4ee5-9c0d-8f8036a18026", "value": "70093f44_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd1821a-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273691, "uuid": "06488b3c-cde7-49a4-9d66-ba64c4bfc498", "comment": "Malware payload (Dridex)", "value": "a62db86f983305ece9a6561d977d379d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273691, "uuid": "f72a9908-3f02-478b-8dee-75e495dc38dd", "comment": "Malware payload (Dridex)", "value": "7295894360297783292475e065e2c53783cae11c6ce899fc588e4d5261434f37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273691, "uuid": "d7b13700-8dc1-420a-92e3-0ef3827bff6b", "comment": "Malware payload (Dridex)", "value": "ea84b707dee79d3a81339f34d7dfbad0e1d1e4f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273691, "uuid": "abf312bf-ca69-442f-8253-cfac712b3b9d", "comment": "Malware payload (Dridex)", "value": "9c04d711a6de0ae31416253db274fc22a8915e660a879ea4a464185e35bd5e274efcb819a796e51771167970a2e7afd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273691, "uuid": "08b4b3c4-3cc9-429b-8620-7c5bd8dfb4b1", "value": "74F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273691, "uuid": "1ae13c32-9d9d-468f-bfda-672cfcf6df9c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273691, "uuid": "7e76a09c-9af5-4ad5-ad9a-bc140f70f010", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273691, "uuid": "05c211c9-3335-40e4-ab9d-97d36f735c8e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273691, "uuid": "81497467-3567-4f77-930b-8a03d25d47a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273691, "uuid": "ddb348af-9b8b-469e-ae8b-118dc69a0640", "value": "a62db86f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c204d0-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338632, "uuid": "639b63ff-4b3b-41f3-98de-99a214edfc86", "comment": "Malware payload", "value": "2e66f755333dfd416af828dfd5a5ad1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338632, "uuid": "82b0c22b-e542-417c-bc95-ce779c2608e1", "comment": "Malware payload", "value": "72a2560806cdc4305a66dcf68b9f29c75823da323636f7c7aa25af00fcd2715c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338632, "uuid": "9732b3fb-5d4d-4a1d-b142-cf62688a6a7f", "comment": "Malware payload", "value": "f4b6c9df8e3eac433ff1c6bb2d1137d5d374f667", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338632, "uuid": "07d0f3f8-4e18-414b-92e2-017244ecc0f6", "comment": "Malware payload", "value": "f8bab178be6f35522156ea8538479816f31fb2d22a94b6a541fc86a575921413600ecf74f190dda9125fcebee448df49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338632, "uuid": "0213e271-2179-4bb1-9baa-15664d40ff7c", "value": "9BF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338632, "uuid": "8eb80b65-73b6-4df7-acac-714027865966", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338632, "uuid": "0cfb65fe-3fd7-4445-908c-9ab987150cd2", "value": "3072:EB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:C4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338632, "uuid": "a0a48cdf-d1c7-4c45-9e41-a35b0c5982c1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338632, "uuid": "fd3791ae-9048-47a2-a0d3-849fbbc1689b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338632, "uuid": "44839b3d-1d5b-4025-936d-295726ad6d3c", "value": "2e66f755_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8038bb4-ae6c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620306833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306833, "uuid": "2f0f2b1a-4aaa-4cfb-968f-73708aaf7390", "comment": "Malware payload (Quakbot)", "value": "8da59aa27c406a936fbfbb812e6b3793", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306833, "uuid": "72141525-d77a-48ee-ae13-0f667487508e", "comment": "Malware payload (Quakbot)", "value": "72b9fdb8c11e45519c84f79f3de1cb6ebb04cd91ce43be8dcc754d9b487fcc24", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306833, "uuid": "43b4998a-bc75-4a24-a252-7ef3ad34f6f0", "comment": "Malware payload (Quakbot)", "value": "1cdffa464ffd1756a5af38f9c74d65591f0a377d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306833, "uuid": "ee08954e-84db-480f-8682-033cba98973e", "comment": "Malware payload (Quakbot)", "value": "6e899c0519f3397596f6138f4d1144265bacf3459d88fca47379821bac14854b34dd297afc882469a726d0628c7f1e13", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306833, "uuid": "6115cf0c-ee5d-48ea-9cc2-9f332231d91d", "value": "83B39C0BCC094AD7D12E93FD6D074DF96E0E5718D8D62FEF44221F8A3A651631E4B0AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306833, "uuid": "e28be210-44a2-4862-b98b-6cb9ea99fa3f", "value": "3072:2YQvKINbjvw548LMb/oqKO8NnS8+60KcP:2CAbT648LM7D98Np+ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306833, "uuid": "fa9b2b46-8dc7-4c14-a02f-1e6bb062fe84", "value": 113013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306833, "uuid": "0ea03b21-f338-4afd-8868-677f0b306e9f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306833, "uuid": "0e10d29e-676c-40a1-aea6-6d1874c77469", "value": "Complaint-1927346599-05062021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5564c8d6-ae6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620307446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307446, "uuid": "14a2170e-4c00-4b8f-bcf9-28f0329bd7a9", "comment": "Malware payload (AgentTesla)", "value": "9fc19490812719e3728ee3e30c152091", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307446, "uuid": "b4d8d74b-4b8a-43b1-8a5a-a5201444d6d2", "comment": "Malware payload (AgentTesla)", "value": "731129e8500dac3f278502c6a59473d2b946c0c86892fd6af1ad697327e57bcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307446, "uuid": "d5778b22-e0ae-4f10-8635-3d65ed8ebc23", "comment": "Malware payload (AgentTesla)", "value": "b440125bb5fb783a36d7fc8a3cd4062565071c5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307446, "uuid": "e3e38081-3610-4aa6-81fb-a61b3ce24930", "comment": "Malware payload (AgentTesla)", "value": "db4f965db5ed4e06e622e1eb2da7d1a164257d1641f1fb332ea38b230f7bb7c44198b527a3e0f3077451124bae69c90a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307446, "uuid": "d9782695-8416-4342-9974-03ee07c2f98f", "value": "2D24BFB875047DD6296F176BDE96BCED13A52A639AC798CC5068BBC30673331EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307446, "uuid": "9ce5cf42-d2f5-47d9-80ce-774609937835", "value": "6144:yxt5NNXkv5ZYCn8VrlQp+LY0gq5ETxvNs:itrFkv5e07S/gmeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620307446, "uuid": "f0a65024-383a-4e1e-864a-200fd389d97f", "value": 215198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620307446, "uuid": "0d4414f9-7209-4e9d-8363-acb8642017b6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307446, "uuid": "e4de660d-a32b-4d36-aa95-c8a91e76e749", "value": "LM Approved Invoices 06052021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6191307b-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339249, "uuid": "21289007-5b3e-48aa-8f60-5240835749e1", "comment": "Malware payload", "value": "5d88b4f7b2b361c4e3ef61df0512b5f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339249, "uuid": "e7648ba5-9576-4d07-8ed1-9d73c823323d", "comment": "Malware payload", "value": "731463c38e55003395fc7935b168db45bbdf4619a8d722ae2026c62252c84e77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339249, "uuid": "7f47d85c-3b5a-41fb-88b3-1273652b5647", "comment": "Malware payload", "value": "81d43410d520e535f8033c95de42f33fc1ac3f16", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339249, "uuid": "afeb3c4e-c017-47af-8aaf-2091ea1dac6b", "comment": "Malware payload", "value": "c7d93a4f9b79ee238f5a629919c5d4f5c7897b19aea25f6667134f54b25e098b9624cc06fa44273134b6e3b367abdc4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339249, "uuid": "e37d36c8-e550-4074-9028-38788266b636", "value": "E2F3C004D167E6D6C51A583222EA3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339249, "uuid": "494e1cfa-d6b1-4fd9-85db-e50b2752b1bb", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339249, "uuid": "81ac0cc8-c8d3-4f71-84d9-b12a1732fab7", "value": "3072:4mG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idn8:gERMVPG6+Y63HoG1QawL40Prx6KZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339249, "uuid": "2ae5a786-50b7-45a1-bd6e-ff62b3dd4315", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339249, "uuid": "163375ac-f887-46bb-8e2d-ea7fa5dfd188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339249, "uuid": "08b6437e-1481-491d-a23f-b29fd7e4ca5b", "value": "5d88b4f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8041b0-ae3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620286708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286708, "uuid": "ce65dee7-f2bd-4b77-addf-1863ce024d57", "comment": "Malware payload (Formbook)", "value": "868eeb1f2e06cada989d1c096fdf6ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286708, "uuid": "ab5db994-e7dc-4d9d-aa3c-8b138ebf1d0c", "comment": "Malware payload (Formbook)", "value": "739ca6c19dc99355e9dc717d4bd48a693103ab7b3f18c1ece86960f816b84d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286708, "uuid": "9fdcb1e7-584c-46a2-97c9-c1e3587bf581", "comment": "Malware payload (Formbook)", "value": "1ff6f9a088aae5eb94c74aa0f80eeafc3dc578f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286708, "uuid": "ab322dfa-80be-4573-89c6-5514d82f43cd", "comment": "Malware payload (Formbook)", "value": "6ce5efcbeb837dd86b6502ade9a180b548c7a669e9c44ed90e977bcd07f965591e911e5bf424b6c42776b087bf7855f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286708, "uuid": "81a586fc-4897-42f6-b1f9-f7fe1bad9f99", "value": "14A48BBBA34AC8D1EEA615B8911F4DA726117F5F68C573D1ADEDB13BCB31134A4E0880", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286708, "uuid": "d0660ee0-88b5-4226-a70a-8b0a501f8226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286708, "uuid": "2752c2d8-3a75-4f65-8e38-540304c5b2ee", "value": "6144:NrYSCdLVn/HfoXvXAa5EQJJf0QAP/O4RAAx3cKNiZgur4c40k4g7lzOUOWHK0Unn:SvV/wfwkDU+5AVmDr4A628K1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286708, "uuid": "33c57f66-d504-4708-b23d-525c099bb41d", "value": 479051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286708, "uuid": "cce102a8-8a7e-4291-86d4-0e8a73e08ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286708, "uuid": "e4ca22ac-5a39-4dc9-86a4-9340e0b175c6", "value": "868eeb1f2e06cada989d1c096fdf6ada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa31c2c-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338916, "uuid": "e36c4258-bbc2-493a-8436-ac8a6c16a3ae", "comment": "Malware payload", "value": "f3759f5ccf8c53c354c95b25015577e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338916, "uuid": "71e1b8bd-2017-427c-bda4-63f8eaa60506", "comment": "Malware payload", "value": "73f02df4e6dee32a74541841dae8dfe0a17e68cdceee420a48bfb84cf140bb67", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338916, "uuid": "16f095e2-f982-4458-9cfa-a55195540506", "comment": "Malware payload", "value": "38b1255e161a30c743d8d3850b79eb2a000b2863", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338916, "uuid": "ba742ac1-27ca-4380-a2ee-5fc10be0debb", "comment": "Malware payload", "value": "ecd0066f1988761c679fc771663caa253283c103462761da1ae93d0d671ccfdd06bd1a61ff136889f6a164eecbd192f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338916, "uuid": "2fd26038-8287-4234-a474-653947440b76", "value": "DDF3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338916, "uuid": "601b9e23-f1c4-4c77-b083-926c3f0ff408", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338916, "uuid": "7df538f3-ea79-4ef7-bc64-ff1e14c843fa", "value": "3072:QLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:LERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338916, "uuid": "c8b9511f-458f-4041-9165-c06fb099daf1", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338916, "uuid": "0dfa6d5a-342a-49ac-a8d2-d42c3a2220b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338916, "uuid": "edb5a55a-8ea7-41a2-beea-a53ba0840beb", "value": "f3759f5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a40cf3c-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313467, "uuid": "f3ca5b35-f17e-4c11-b2db-d4e1bbd8a1ec", "comment": "Malware payload (Dridex)", "value": "b0941055f56e40de3261c47ad64cedc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313467, "uuid": "283a11f9-87ea-4370-98c6-f767542de596", "comment": "Malware payload (Dridex)", "value": "742c0207c580a60ab6e820d2d884e468b10c7514098d124f8ad84ef0e04d3ea5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313467, "uuid": "aafd4f15-a184-4c8e-9525-fc55d19a5165", "comment": "Malware payload (Dridex)", "value": "29753213e905f7fc09aa797d198ac75bf7d44059", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313467, "uuid": "b3569e90-ce4e-45cb-8bc1-b8a23fa439cd", "comment": "Malware payload (Dridex)", "value": "5aabab15725007fb46ac852cc85e6cfe2d5b78c984b8a69eea63af3073bcd6c75ea9d9b118f95c373212d578f7524cd0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313467, "uuid": "4af347df-7270-4cbe-823a-4452a106c03c", "value": "EAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313467, "uuid": "f9e6d42c-8ece-46b1-b1c6-d9ccbe41509e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313467, "uuid": "14c71bfc-8532-4089-aa97-888664c077b4", "value": "3072:Qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313467, "uuid": "142f48a0-a454-4c1b-a915-74190e90d69e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313467, "uuid": "476c98d3-2624-47ec-a7e0-11ae2dbe8bbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313467, "uuid": "2d9e874e-49bd-4cad-a428-06a219cf5ee9", "value": "b0941055_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8122a6f8-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309667, "uuid": "c680e0f8-7add-4817-857d-0c69dc831c7d", "comment": "Malware payload (Dridex)", "value": "c2d79dd40b94dbbb86d3938d1d345207", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309667, "uuid": "054a11da-f108-4bf4-a240-7798ddedf311", "comment": "Malware payload (Dridex)", "value": "74633449e78cdd0e4665a24e936334e6599f40571d339f21ffeb2c8f856b7f89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309667, "uuid": "45829b2d-a6fe-496c-bbdd-ee732b6c23ea", "comment": "Malware payload (Dridex)", "value": "c813b5924bebcc826db7e4659fe083dcb36cbc06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309667, "uuid": "d18303f8-eefc-4808-a460-eaac7653f14f", "comment": "Malware payload (Dridex)", "value": "3c0d0009fbe114ceda6cccf1ef21ed27ad2d8e2ae1861c1a7c5f481328f7e344ee445c46fdf856e70919662acbe5a01e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309667, "uuid": "171e2bc3-5232-4cbd-a063-d6feba8a9996", "value": "25F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309667, "uuid": "68c2e578-bcf0-4a14-8a6d-afb7baf451d3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309667, "uuid": "8a30d4ca-364c-4a06-8dc2-7f3fa7ccbdd7", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309667, "uuid": "9a5110a3-2385-4d33-adcd-67d1ea569e34", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309667, "uuid": "0ae23e51-1cf1-4d2e-9c42-edf00c580a8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309667, "uuid": "02640bf3-b825-4efe-ac3e-cf5ae349a48e", "value": "c2d79dd4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d46bf9-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324097, "uuid": "00d398d6-5c1b-4ef7-86f4-f531b29e03c8", "comment": "Malware payload (Dridex)", "value": "c580bdd0702db676e8d8f795e02d4b26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324097, "uuid": "2887ff2d-884a-4df4-879e-a2d401846d30", "comment": "Malware payload (Dridex)", "value": "74f067bd762c825587219467e45a9c259fddef8fd40ccddc6d2914b97ccdd2a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324097, "uuid": "79b7e488-6503-4c52-b0b6-da2b442a8ff4", "comment": "Malware payload (Dridex)", "value": "b269e35b9086baacbfe2406ae2cb8d686b7b1370", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324097, "uuid": "5d100af5-26b3-4b19-af39-a765660e8eb0", "comment": "Malware payload (Dridex)", "value": "4e6aa27b3a84426f084aaff9b3398d71478a1eeb2cd44788d9fa251e588e07a7d2fed7b66b715c2163b54ac56bf49a38", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324097, "uuid": "0b5acf96-8f5f-4ab3-9749-e8d5a2306a52", "value": "92F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324097, "uuid": "f1992056-32a6-462c-a485-e32f49668ff8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324097, "uuid": "0f313868-fc77-403b-8af0-aedd8056756f", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324097, "uuid": "9c579526-ba91-4d51-bbab-398877067927", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324097, "uuid": "84f66df2-87aa-4cdd-81cb-b05b5fc05b8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324097, "uuid": "189bf7e6-1357-49b7-8899-053afb058e18", "value": "c580bdd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b325428b-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262936, "uuid": "b12af5df-0472-4493-adcc-a4480bb25501", "comment": "Malware payload (Dridex)", "value": "77cd366d47927ea39bf0c9c2e02fb960", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262936, "uuid": "f02477dd-17ca-4f6d-8269-2eee5b6cdd9a", "comment": "Malware payload (Dridex)", "value": "75669be43800920555368aef0d6b76b713588727da367dd343081400c2e219c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262936, "uuid": "1e4c91c3-51d3-48fe-978b-5a53e0c14de0", "comment": "Malware payload (Dridex)", "value": "7c120428a328961f3501a6978b639812127b5fcb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262936, "uuid": "bfad2788-dcb9-4c55-895d-814e70e33010", "comment": "Malware payload (Dridex)", "value": "a244e0f896c28ff0735c6260848e4f3eb7b4daa9ef220d4b1f3f3f79f9ccce8f884bf84aaa8fa52ece84cc82403043b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262936, "uuid": "9103e51c-5095-4286-84b8-374d04d8740c", "value": "8DF3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262936, "uuid": "37a6ee97-e8df-4da7-9f36-572e9b6dc2d3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262936, "uuid": "a6098fc1-696a-489b-8a03-a15606f17453", "value": "3072:bB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262936, "uuid": "bbeeb0ce-b588-480e-95e8-79ed81962c93", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262936, "uuid": "284bda0a-49e8-4c8c-a4a3-f9a7511f5703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262936, "uuid": "f5ee2d9e-57a9-4c98-a025-4ec577148b89", "value": "77cd366d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31083d82-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285051, "uuid": "bd7f0e6e-5b36-40dc-b472-af2aeab4a006", "comment": "Malware payload (AgentTesla)", "value": "e1c2ff2218624200595a27daae55c601", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285051, "uuid": "38e10569-761b-4e3b-be95-916431b071c5", "comment": "Malware payload (AgentTesla)", "value": "756ab3c5bffff0818a4c93ccc7354abf63836b91faa2590f1c1b83284ef41de4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285051, "uuid": "e6784780-45ff-4892-bfc5-b0ac9160b551", "comment": "Malware payload (AgentTesla)", "value": "0b76ea77165cca562edce8e86fdaacdd2d83f5df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285051, "uuid": "3b9c04a4-ab37-4eaa-9b68-8cbea9de2f27", "comment": "Malware payload (AgentTesla)", "value": "8719890424de158679ea61002563d547f06d1e4ced7815ede48774f682b89e9ad3eb3ea307edb3bd43838cefc6d5521d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285051, "uuid": "5cd7ce69-87c6-4566-9d89-c73cd37ca2a0", "value": "31B573A57AF8C92995BFBEE241747D47C9BEFBBA9131B6EC60844D5CC6000A35C81393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285051, "uuid": "a2f37e0f-20b6-4d1c-ac34-f4b658c5091a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285051, "uuid": "ae2a2a10-07fd-4a64-bcdb-f74c4b9cc1df", "value": "6144:m/Kiwl+hJsdrlSOC89jsqab7hPNjGNMm3+s3/RnGuaNsZU/5+CLHCwL5YHAL2L9J:m/Kiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285051, "uuid": "4e102d7d-4b93-4c2b-85c1-a826a07bb735", "value": 2418688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285051, "uuid": "eb0afc2a-0863-420a-ac1f-c3e32f3c0269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285051, "uuid": "22fee4b2-d760-45ac-b757-5a71f0e65167", "value": "Enquiry Items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3486723b-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620324141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324141, "uuid": "7f33fb08-51e1-4e1a-93b0-5dae0dc62a5b", "comment": "Malware payload", "value": "27b43ad5c64090359036905f97cc92d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324141, "uuid": "54c9fff8-0e1e-47c4-b82f-54471f172f78", "comment": "Malware payload", "value": "75a16b78cb92ec81dc6d055f0d58814e8a9a5ae9a987a8a3d0e4e7d549046281", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324141, "uuid": "89cdcadc-8ffb-4d39-838b-7dd84d1cda0a", "comment": "Malware payload", "value": "97ee3bc7677d8600d1b151cd64eec32c72961145", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324141, "uuid": "cb5b3321-b956-4e86-a4c8-545492e2cb9b", "comment": "Malware payload", "value": "8a3ea51822d9169c7bd9e7695b9da66f59d99c65d43977404e0bc3e73f57d8068c7788052f27def3f2a4c610d3161946", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324141, "uuid": "4af95210-179b-45af-9264-53591b493db0", "value": "7EF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324141, "uuid": "165f26d8-bc13-41d6-8053-945172aebcab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324141, "uuid": "b5d92539-fc66-49d5-8c2d-008d823b4cdf", "value": "3072:yIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324141, "uuid": "345f2fd4-515f-4b72-ab43-5912fb2c7989", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324141, "uuid": "8e070980-5f59-41bb-90f5-5e3e67715a5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324141, "uuid": "1053d7f9-f7f5-462f-b74a-a1f79eddcb94", "value": "27b43ad5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bec466d-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327697, "uuid": "d9b359b4-af14-4190-948d-347cc316bdf0", "comment": "Malware payload (Dridex)", "value": "f1cf6f9b528eeea02079010ccbc9bddd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327697, "uuid": "486ca4c0-0912-4e66-8076-93eeb996ba7f", "comment": "Malware payload (Dridex)", "value": "75e3b224683539c8ce75654302064e19313c918d61444a5e4109da7c17d536f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327697, "uuid": "c62d823c-0fcb-4236-8164-dbc089f02dac", "comment": "Malware payload (Dridex)", "value": "100ceaab7fc9b5d21e0b59a0d28d3dfe24fa63ea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327697, "uuid": "5e9211f6-2364-497f-aba3-cf955207fafb", "comment": "Malware payload (Dridex)", "value": "f1d219320cf812ee773269a2beb559ad2935dfeb205dd54bba6260318e47f3888d0f0efd9bea4532db64aa23a2ab6b04", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327697, "uuid": "3426566b-da9b-4575-b623-8c92af6eac12", "value": "26F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327697, "uuid": "36647cc8-0b85-4620-b046-ae8eb7a34ab6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327697, "uuid": "8dbac062-cb53-4acf-92f5-cf92d8b36e99", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327697, "uuid": "0f1f8b4c-2064-4b6e-a5eb-bef900d55566", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327697, "uuid": "c5adf5ca-c68a-4489-9a0b-452ec39e52e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327697, "uuid": "d0d6de03-d8c1-4000-9eb1-14131314df48", "value": "f1cf6f9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e258713-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288107, "uuid": "1c9ae02a-71a3-45b7-9a1a-28c2a6063737", "comment": "Malware payload (Dridex)", "value": "7c213d49cd9fab4a4e10e4f4459d4c1e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288107, "uuid": "038e216a-c57e-4066-a670-dbd3ee87c026", "comment": "Malware payload (Dridex)", "value": "763f0ef48d2902eda8fc52efe7303498283b011e7b5a52b5f660b5f7d27a1b7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288107, "uuid": "c61a44c3-e7d8-40fa-bfd2-223c3dfc4175", "comment": "Malware payload (Dridex)", "value": "6e63b729510aa1bfb4672a2a3911011f64f61e1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288107, "uuid": "f666323a-1736-486b-9c4d-19766c7f92a1", "comment": "Malware payload (Dridex)", "value": "ec7d4001b9058120b0e4af62bec69d3eec47f64d9f741733feaaf45c79feb18f8aaf310116696bd53c4a9d073887beff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288107, "uuid": "bbd5e45b-a2ca-49eb-96b9-d1e4795fcac6", "value": "8DF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288107, "uuid": "7c7ea3e0-bdac-4a39-becf-ee875c3132c6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288107, "uuid": "cf74d8b8-4c9a-4708-abf4-42c683804b6c", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288107, "uuid": "57d5a1b5-ffa1-4320-b76e-c0d0e42babf6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288107, "uuid": "18e887c3-572f-4301-94c4-50b950b2d2ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288107, "uuid": "a0350957-4290-4f02-b735-7aed4268b1cd", "value": "7c213d49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ae5449-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306192, "uuid": "3eb9e1d4-c6c5-4315-b1d2-47af8fcf27bf", "comment": "Malware payload (Dridex)", "value": "9d3f893a349d1fb583f9b24000661085", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306192, "uuid": "a1b00abd-89ee-4bbb-8f18-4ff122fc8f79", "comment": "Malware payload (Dridex)", "value": "7648fe474ff956b33d7e5b46f755569a14ba645db601f8718d5769f3e0de5e27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306192, "uuid": "fcc6c3e3-f523-4c9e-9702-e21eb4ab00d5", "comment": "Malware payload (Dridex)", "value": "1510787851ef5d7c7dabfa53659f96600b30c1ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306192, "uuid": "f0022001-b646-4505-9cd2-0eec5bc01406", "comment": "Malware payload (Dridex)", "value": "dab32d6007057e682909978f915a7c3433779dd72d9d42f86bc45f106bf9a944c26d563ad14d4ed4b39f8ebc4869905e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306192, "uuid": "28564572-68db-4790-ac2e-02c23fb264c6", "value": "99F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306192, "uuid": "a0a1d8c1-fba9-477a-b51a-838574011a54", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306192, "uuid": "2919e50f-3058-4984-ab33-a6fd9b94b7f2", "value": "3072:XIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Yc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306192, "uuid": "ffb0e30a-fd71-4dc5-86bf-a5304faebf34", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306192, "uuid": "a7f54609-44d0-470d-99a7-b0ca80c1c1c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306192, "uuid": "cf6cb779-795f-4a0b-8ace-a91fdca1fcae", "value": "9d3f893a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea0d249-ae23-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620275169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275169, "uuid": "50c97ac6-4ba8-481a-9544-3e4212fa648e", "comment": "Malware payload (AsyncRAT)", "value": "8386ad530818e9eb7d3f382539903273", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275169, "uuid": "bb5f2930-3526-43c7-92f3-6e21a9ef153f", "comment": "Malware payload (AsyncRAT)", "value": "767111470dee2831acd1ca1cbfd8e4acb400a71a12422a27922ddf300315f5c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275169, "uuid": "252acbf4-968d-4d32-a2bc-8c2a7627e2ee", "comment": "Malware payload (AsyncRAT)", "value": "5713f51096c411288c065155cbd9b4f197fe7908", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620275169, "uuid": "d3c34bb5-8c38-4e0d-8085-6790d1d6d48f", "comment": "Malware payload (AsyncRAT)", "value": "fb4bb5a693f0b4cafda9b607aa58a82db0a9ec4fa523e514737abf49c1c2518c76d24dd4b679763201c9285b42128c7a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275169, "uuid": "9f7dd785-3d40-4a2f-b86a-ca4504f2d7f2", "value": "CC11FC0EAE49632DA71422041249704E4E4106CA42136A3EE09EB3B4628CECDFBCDFF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275169, "uuid": "290fd664-705c-44a1-8d08-610049f6e3b8", "value": "24:WnzaiyrOtYVJYHop3pxpjWJYHCpqpL3pLV:ia5r+WJYHop3pxpjWJYHCpqpTpLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620275169, "uuid": "10db511b-2d2b-48f4-9a2c-c645b475c295", "value": 976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620275169, "uuid": "ebccef35-52e1-453a-ab26-592857bd0c89", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620275169, "uuid": "0d23f19d-2722-4d90-b5b6-2a651dc156b1", "value": "NY54.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84358d36-ae32-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620281755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281755, "uuid": "55d6cb40-e6cc-4975-a259-c3beacfb7a5e", "comment": "Malware payload (OskiStealer)", "value": "43fb35807a4860d1942911b14637b222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281755, "uuid": "cd93d4b2-4439-459a-8daf-d9badc09bcef", "comment": "Malware payload (OskiStealer)", "value": "76a5f8550442958458b6bdb42625ceda1380548e9bcd8200e584f3c486de96ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281755, "uuid": "965063df-7c17-4af0-b042-eb6e95473589", "comment": "Malware payload (OskiStealer)", "value": "aa245d1997245202283006a6a6f3399f26cf98c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620281755, "uuid": "1ad81eff-9c8b-491e-b02c-4534ca01dfde", "comment": "Malware payload (OskiStealer)", "value": "d91ad2461ee708d40a903b16e98310edb6ac32c8bb01de9e75f548a77c4e010fe1032ce371d7b650ba2443314623f51b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281755, "uuid": "1c9515f1-bfd2-4fb1-a6e2-b63e5bee42af", "value": "0DF47D0017E85B97C2AE0379E198E23573F5DE05A29AAB8B690BF9F53F7339145009D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281755, "uuid": "84ffde99-af93-4635-aaa1-bb8ca3a21d06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281755, "uuid": "1510b685-f13b-4e2c-aa6a-0afde849bd5f", "value": "12288:Bog1fxhwL8mLAHefRIZtbVqrTwqEZzTVGeeeAItC66rCWmzG:+oZyJAH/ZtxqEZzTV+9I0/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620281755, "uuid": "88837ff7-0cba-4d4c-9d44-f34ecaace3e8", "value": 755512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620281755, "uuid": "27d978be-52b0-412a-b694-5b7b52b3d380", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620281755, "uuid": "0758e373-550a-432b-a8a5-02b954cf251c", "value": "PL025173069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd1fea2-ae8a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620319701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319701, "uuid": "2db1d028-e3f3-4f70-865f-c00d0f6b894d", "comment": "Malware payload (AgentTesla)", "value": "73a4794fe1615368f1de3c51a36989ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319701, "uuid": "e45bb1c5-d625-47be-9801-d3a76a3efd1f", "comment": "Malware payload (AgentTesla)", "value": "76ee7eacfb1b508c6e8e3174aaa29cf4fdc946fe76114fd6047cb695eecc764f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319701, "uuid": "84237200-aec8-4089-870b-d27fef7aa81a", "comment": "Malware payload (AgentTesla)", "value": "e66e403c98a479f79b1774b7e793dce2172bf7fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620319701, "uuid": "d650e66f-db83-4e3e-b173-9f35b44ad738", "comment": "Malware payload (AgentTesla)", "value": "79da9aadb4c6ab749ccb03c74d18de1ee8dae69bebb49b7abc31e08798cea5ae2e6888ad55db49ebe1f409a220cb781c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319701, "uuid": "db84e55d-90fc-4506-b2cb-49933c17e488", "value": "8BF4AD2422D85B0CE47E673559A0430807F1BC0BDA22D2CD7DE7B0DA1E7DBC69B25B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319701, "uuid": "3f373824-717a-4246-897e-de656dd01cea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319701, "uuid": "cb5834e7-feaa-49e1-b733-adc65b2ac119", "value": "12288:oTeKeWco0Lz03O9/9At+/3R+RZ9CNHAGKNeiPAHi4+H85cWrQfHl+9MkWZ:oTAg+p/3RwU2eKAH/559QfHOnWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620319701, "uuid": "b3aa0afc-b125-42d8-a0b5-0d82d089e13e", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620319701, "uuid": "2221ab14-6457-4f9c-a13e-abc0b49cb15f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620319701, "uuid": "7d016c64-012f-4cda-aec7-98472d9a66a1", "value": "73a4794fe1615368f1de3c51a36989ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64029ef9-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620310477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310477, "uuid": "42a0c6bd-5b0a-42a6-9229-1562d933bdc8", "comment": "Malware payload", "value": "a48dc2da2655fd049e37e36fcda28fba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310477, "uuid": "c6e36ee9-baa8-4fc2-9f3c-8b57cb05d623", "comment": "Malware payload", "value": "76f6c712403a2f6213390ab2a72a82c98c9c48e1b1bde182aa5932bd02a06d43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310477, "uuid": "597203bb-46f3-4c4f-95a1-c038a2cf9b8e", "comment": "Malware payload", "value": "96ce27ab5fec62c6ac3ed96dd1bdc2defad5499e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310477, "uuid": "e4eb2a3b-1f9e-455a-9d21-82ad5923163f", "comment": "Malware payload", "value": "d7290c4351520569f066eb63e8d44acc5008039f0c78ab295ce26b8488bcf024fb4ed88a22219e0cecdb27535a7c3676", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310477, "uuid": "f347b911-a1c6-48ed-8939-23661121ae0c", "value": "34247D21F2C24876D1631F38BC2BB26D5A36FF152D29654BA6F95D0C8E3E3C16C185E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310477, "uuid": "0b3ae72e-50c4-48e3-8865-5aaf7759b221", "value": "ff5a8f4780f2dc45750b55ab89f4b357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310477, "uuid": "f99b63c9-689d-4621-ba68-144d791fc353", "value": "6144:SJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9TlHN:JJpb7Y7vf5i5X9TFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310477, "uuid": "f30e8643-e78e-4aa7-b912-7c216f6d6b88", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310477, "uuid": "7a26f799-ec0e-49c0-a6b2-f67e2a9c77be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310477, "uuid": "2cae9677-d402-4623-a76c-59d854eaf310", "value": "scr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05792112-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285408, "uuid": "1997f725-1cf3-4ac9-95ce-1f64848f2df9", "comment": "Malware payload (AgentTesla)", "value": "fb24cd01933b68dacc9d83e637add74a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285408, "uuid": "adfb41e7-0b36-4f27-a262-0409ccaeb4fd", "comment": "Malware payload (AgentTesla)", "value": "7765bb133b4109809d17f61f297f79b941cb89fd19d83e5a8016de72303790fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285408, "uuid": "078889bf-53ac-4e2b-af6b-e895b1903d38", "comment": "Malware payload (AgentTesla)", "value": "ffa8910208eeab23d9fba4d3ecafe2c806d141e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285408, "uuid": "7b127118-09e2-410f-9f6b-2a8f13787725", "comment": "Malware payload (AgentTesla)", "value": "8fe58efc4086cb38d928937d299ac4091e08a6c89852d56aabd75961251a3ffe452304e6bde6dee26a0e5c79a2ceddfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285408, "uuid": "e683f983-4bb2-4842-991d-cd6a2fa8657a", "value": "B635AD2212989A24E13B23748562C13947F67E02E276D35DBDE87DDB3B33681DA67313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285408, "uuid": "bb70ec13-9101-490a-b14b-4ccfcaa2ae58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285408, "uuid": "a7739f0d-39bd-4f38-96c3-eda402fd9994", "value": "12288:RwLWn4noMjSUTyCbLYqB6H/aZm0GO6dY12/WLfjifBIM:Rz6tyCbLNMH/aZmHO6aA/WLGZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285408, "uuid": "ceb16ed0-0c4f-4149-90c9-b02c129a4b71", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285408, "uuid": "e16df334-d52c-4238-b11a-65b3e3fa1687", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285408, "uuid": "e14978b4-ec2a-4560-9460-d04d5dd9174c", "value": "0020210506-201927_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee989cb-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313368, "uuid": "795528be-5462-4004-8f9b-fa76d821531f", "comment": "Malware payload (Dridex)", "value": "0d4fbd70c3bcc0ba1553bb65de302c5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313368, "uuid": "ac01426c-2135-4e6a-a644-de9a30732b6f", "comment": "Malware payload (Dridex)", "value": "77f345f131cd5d9f83c5df9758cfda56b5d3ae9de543f2db4cc5e38312b16a84", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313368, "uuid": "13e6be36-682f-4a90-a8a5-0071f487736b", "comment": "Malware payload (Dridex)", "value": "897bfc555289fdef4ec90e9729d12679fd727de3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313368, "uuid": "198743c7-8edb-4271-a487-9340043ffc7b", "comment": "Malware payload (Dridex)", "value": "9adcf2e5ad77f1d828338f1525854e8b696ba2f0dc244b7e288734020918c8ef832b47a443b1fd1f32a04fddacdb1285", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313368, "uuid": "4afe09a1-7407-4475-aecc-753b68ab75e2", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313368, "uuid": "4eb78141-dcaa-4a82-b589-1752793ccec3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313368, "uuid": "8aa5c7c0-6d1f-4928-b7c1-482221c91b7f", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313368, "uuid": "26d11993-32eb-4ff6-8611-8a0754c7fda8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313368, "uuid": "237aa0f0-93c1-4d61-9eb3-b2bcce0959b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313368, "uuid": "cb458e65-d77f-4dc7-8824-2b223df716b0", "value": "0d4fbd70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80789765-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620310095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310095, "uuid": "0b104b65-92c3-4d73-95c1-9f2cff3fb7ff", "comment": "Malware payload", "value": "985f9c4d8bf231ca08046bcd44d558eb", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310095, "uuid": "c1b12fea-0d46-425a-b6b7-7054a1b6837e", "comment": "Malware payload", "value": "78322121578342e588375350f56edb5e0a6d4b889c6425814590afd1a967e650", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310095, "uuid": "2e1a3502-2443-4ec1-a65c-3a157258064b", "comment": "Malware payload", "value": "de5711528d94dab76186d9695ce19c3c6c26eec9", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310095, "uuid": "0b9c5bc5-42bd-4c3c-878d-c610dc527806", "comment": "Malware payload", "value": "d5a5ce497124858764ac64c10186e1879412173534c7b7e207746108bebb2632408ebd9cbed90352f98ddd4c5bd53dbb", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310095, "uuid": "133c7d47-ad65-424c-8d8e-16b00418a8bd", "value": "F0C36A73F1D18872D0790E7CDC5A92986A6FFE212D25165BB6E50E0DAD392C27C2C6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310095, "uuid": "910e048e-9137-4873-9c2d-5e49e351d804", "value": "a02ab1a937fc1433a9abad7bc2badee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310095, "uuid": "7c8a45fd-dbe1-4086-9067-da6be822e8b5", "value": "3072:WeZmogDk+xTMLObNlEB+VSdQgXHOPz2XrLekm9:WeZkgOThNlIWzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310095, "uuid": "665d164c-2ad3-4319-9acb-5798f07711d2", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310095, "uuid": "387475e8-92c5-4669-ada6-72d059fe7c26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310095, "uuid": "e95a7263-02bf-4ca6-95ce-44b44d4cf6e9", "value": "cred(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ab1e06-ae9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620327747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327747, "uuid": "06c4f9af-0ee0-4e41-a873-7d567811a931", "comment": "Malware payload (Dridex)", "value": "025c8e00e57f96d3ffeee9782e6ee434", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327747, "uuid": "150f633e-153f-4bd1-b35a-7f4847d413b4", "comment": "Malware payload (Dridex)", "value": "78722b6f85b4c65a950e66ebe7dbd64fa69cfc38fc847bcccb8bed07e907cfef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327747, "uuid": "511d12ca-2a33-4e1d-99b2-34bc78f1ce61", "comment": "Malware payload (Dridex)", "value": "1b28d730535dedcd89b0ceb45edd384c34607ba6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620327747, "uuid": "d622614d-196d-4f4c-b974-0777c979d030", "comment": "Malware payload (Dridex)", "value": "d0aeedf6fe563d43fb10cadd4208caef9c41d689937c2a898613a4dd1dc964979291f8a0e237f822ac4b55d605c583cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327747, "uuid": "394b2983-5a2a-49cf-aab0-15a897c8b553", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327747, "uuid": "86f939dd-2854-4e57-8f7b-3940c9ddfe68", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327747, "uuid": "17dcc64e-2fe8-4e37-b654-95a7c47fb862", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620327747, "uuid": "c525b0c7-4a92-4075-8581-200c7d57cdb5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620327747, "uuid": "018475bc-7b64-406d-a36f-45dadb7caf6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620327747, "uuid": "b985fb9f-0188-4c0c-b8b9-ecc8a5126e08", "value": "025c8e00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e180ded-ae53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620295838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295838, "uuid": "44854863-51b4-4bd2-bbe3-61ad62c30d37", "comment": "Malware payload", "value": "46ebab156e28ec6cd687a5a75738c0a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295838, "uuid": "03d0c15f-72cb-47fd-af2d-f37ea4eb7f10", "comment": "Malware payload", "value": "7878431fd8901387931ed2b1c52bc7def39885104e63fb5245494a91b60ebc47", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295838, "uuid": "60c31feb-630d-4813-accc-99f5a11f5585", "comment": "Malware payload", "value": "12e566c576f7392b456bbf2341677575386d8323", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295838, "uuid": "d7d56893-c894-4e52-81b8-d70e7ab605d0", "comment": "Malware payload", "value": "5fd460a6485ae2258e99697577841bf5f492d898e8089e7a4e84217f2efd114f1a711297aa1bfbc970576dbdaaca6dea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295838, "uuid": "8e9c3247-5ab6-4da3-8565-0a51efa76f4d", "value": "4603D07AD3016C39D1B6C8FCD52A16C86B6923C5CE80B97B769DB78FD18ED47072900A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295838, "uuid": "d3aa7690-79c1-4ad6-902f-55dbf06c34ce", "value": "768:wUJUOuZwAV4oYtOQh5LuOiz7+K4699s+aWsybcPCXjtqbQfOZdh3riw22z:Z0V4o97BF97anqcPItqFrIwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295838, "uuid": "4bde80e8-a9bb-400a-a229-07832d0dc685", "value": 39704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295838, "uuid": "2abd393c-08d6-4a91-958a-1202af5ead29", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295838, "uuid": "76260ad0-35d5-4021-bb2e-b6982074f41d", "value": "COMPENSATION FUND PAYMENT APPROVED NOTIFICATION 2020.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b7cfcf-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295319, "uuid": "b2856d24-3ada-4ce2-9f1b-a549768e0b07", "comment": "Malware payload (Dridex)", "value": "1ad967e532b9ea560b28d5b9906961cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295319, "uuid": "93092b30-53bc-493c-812e-a68dc5d1d5ba", "comment": "Malware payload (Dridex)", "value": "78a46c0d374f2a4ebef32b5638d5d4915a2606638a934964adc38a7c98f04f51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295319, "uuid": "c688dce6-1b93-4b42-a999-998df4395992", "comment": "Malware payload (Dridex)", "value": "5c6789fd9e8238d48018ab33a92fe4aa0efcb3b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295319, "uuid": "661d0b29-b92a-415a-9db5-fad6a1adf0c7", "comment": "Malware payload (Dridex)", "value": "f3b09a152284ea2c536b9cc38b1c957a5591a182db281dca3742fd9b6162124f38639b2a7394f3b10d1a432504f8d26a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295319, "uuid": "62986e2a-3490-438b-ada5-910af3f9a227", "value": "98F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295319, "uuid": "dd1d4617-15d8-4bec-934a-ae5f2b6401d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295319, "uuid": "9f1df5bd-2a9b-447b-8589-997d54c6a81b", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295319, "uuid": "1ff5f0de-4974-45d4-b162-cd826e32bf90", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295319, "uuid": "f5f8e0df-84d5-4e43-abeb-0b7c35cbbc56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295319, "uuid": "440901a9-f905-4c98-98c8-a455fc93c208", "value": "1ad967e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e7e126-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339097, "uuid": "6697a9c1-a23a-4d7b-ad25-2766e0f1f8ad", "comment": "Malware payload", "value": "8e2490a3a146cc4f2774a4e3c284a6bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339097, "uuid": "68413b5b-727d-4bc8-8782-29eec9414c9d", "comment": "Malware payload", "value": "7904dffc53b9d3f4b8aa047dcf196df17bac3acfcc570220209e03409f41cd66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339097, "uuid": "165938ca-9e4b-4ae5-b8c1-c0cc7a2def7b", "comment": "Malware payload", "value": "7506d6b8cc4dca2e0aa30cedbbcb2129cb1a722b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339097, "uuid": "1397bfa7-897f-48a0-99b9-e752785686ea", "comment": "Malware payload", "value": "749315d821c8e51d93980cc240988e3cfd4459e514aaf6ce40edd6242d3e3c3238e4d654cb7fc1e25440e48dafc3742c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339097, "uuid": "145d44a8-2fcd-421c-bb1d-e698179665ae", "value": "D7F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339097, "uuid": "05034f44-48dc-4624-b63e-5794a41f84dc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339097, "uuid": "21f30594-b2d4-40e9-a3f3-484611947e50", "value": "3072:QB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339097, "uuid": "7bd40b63-a67a-4cd1-9c99-60c8ba2884e9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339097, "uuid": "795ef4d9-fd24-4c06-aa22-c5114fb02796", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339097, "uuid": "149155fb-79d7-485e-971a-0e15564ae9d2", "value": "8e2490a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96309ce-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273657, "uuid": "1ca211e0-ec97-4c2e-9d99-31edb03bae53", "comment": "Malware payload (Dridex)", "value": "0f28d7e4431a428b80499fedfd569974", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273657, "uuid": "2558e089-690d-443d-b307-5d610410dd08", "comment": "Malware payload (Dridex)", "value": "795998b481e1984ac9baa0850423ed337c0dda2b235fa49ab228edada83ae692", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273657, "uuid": "2b6a88aa-6d22-4eae-9b1b-989d37adb751", "comment": "Malware payload (Dridex)", "value": "21a8436beb24eeb91289acc7e234eb1f6af19add", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273657, "uuid": "8a5c04dd-b38c-4005-88ec-15a7d52f75de", "comment": "Malware payload (Dridex)", "value": "5a53075aed00f167f1ecc122b0085b5340f98d9a70e814360df49404265692216e1a863a79f63eee493eb30e673cac55", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273657, "uuid": "590b3af6-a5ba-4877-a384-fca00b1f244e", "value": "BBF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273657, "uuid": "ea204604-d6c4-49e5-a408-99eab06b18d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273657, "uuid": "dd4e81ae-7223-4bca-944f-b9278a1f5dbc", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273657, "uuid": "cb363e00-df45-40f8-9284-71ba7b34309c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273657, "uuid": "7fd5eece-f943-4b8a-a828-2a272c9d0860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273657, "uuid": "ceb6a501-a81b-46bb-9801-ce2fcec0aa29", "value": "0f28d7e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa555e9-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270089, "uuid": "ca4c0ebf-4751-4987-9c99-f7a354cc6c76", "comment": "Malware payload (Dridex)", "value": "f9a673c39fa636e8ea66233600a694bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270089, "uuid": "67c0f80c-88b2-4671-b2c8-3a34908b8481", "comment": "Malware payload (Dridex)", "value": "796df4c914ff00c9e5af7d289ff7dbc0b26fc3ba130ecb43fc610f8a8deb0ac1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270089, "uuid": "ba4982ab-5f26-46d1-9719-7419fb37527b", "comment": "Malware payload (Dridex)", "value": "577aab24e0b8313d0d67a0b7799d65448fad8107", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270089, "uuid": "11f80acf-4f38-462f-bc70-d727d613b42e", "comment": "Malware payload (Dridex)", "value": "4bc56fac3a6e0881a33d77cb2cf11b117f9e2e7d5bfd9cb61dd75efacc17eec51c9a3d8b2f492ca809a2aee4c5ef674d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270089, "uuid": "cd80ab2c-b006-41ab-bd6a-05b71ad05e63", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270089, "uuid": "96b033d7-94e9-4f54-8450-de3ac9325ff0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270089, "uuid": "90fac2bc-fd85-4afc-9419-c38465aeea84", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270089, "uuid": "bb2788fc-f95d-437a-87a1-d0fd3522b462", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270089, "uuid": "971b7182-08b8-4504-aa2e-042b7c49a381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270089, "uuid": "68a20cf9-ee06-4f76-9721-4aaf3ce76edc", "value": "f9a673c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a39822b-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331399, "uuid": "05204094-d565-487e-bea5-304bed959888", "comment": "Malware payload", "value": "52daa28977e85c81c67178706bc1e3cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331399, "uuid": "9f8f2365-a0e0-431a-ac12-c2ba72af9b3c", "comment": "Malware payload", "value": "7a1bd12f76a23da9db190623451e7c2704e1a2f69a6792d9190ec28930246512", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331399, "uuid": "f02ae4ca-da18-4a55-a76b-2fbc738609fa", "comment": "Malware payload", "value": "757d0b157f70aeb8a9e2cb8c8a12eb14bc1388fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331399, "uuid": "5d7cdfba-18d1-4dc3-be06-108023dc57d7", "comment": "Malware payload", "value": "035cecca4044b946c62a9c98c3d2cc4dadf4be1a435461ce4535fcf5284b244f4a817c27fe264d354bfd3651334e75ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331399, "uuid": "ba6215c9-1729-455b-bcdf-a79e2a356694", "value": "1DF3C004D167E6D6C51A583222EA2B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331399, "uuid": "48aecb73-667a-4d5a-ace6-2b2206ec91ad", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331399, "uuid": "9fd17bf2-2218-458d-93d3-e278655f6b9b", "value": "3072:HgG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idxc:PERMVPG6+Y63HoG1QawL40Prx6Kzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331399, "uuid": "4266ad80-50fc-43d3-b90f-fae923a31761", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331399, "uuid": "fef358bd-c238-4976-bbb9-762fa4af4045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331399, "uuid": "620497e2-48d3-4992-b030-dd99627517d6", "value": "52daa289_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce93a50-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266522, "uuid": "792513c3-d82b-4963-bb20-daf9050a2c8f", "comment": "Malware payload (Dridex)", "value": "2ea15b2ab6b0afda5fa0f8c39d8cacb1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266522, "uuid": "6a5e8e38-eae5-45f0-9bd1-30949773cd7a", "comment": "Malware payload (Dridex)", "value": "7ac9a69d718415f3bb51aeed5e689c43ae4b31ae0c6872ffdce510edcc847afe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266522, "uuid": "46e65d0f-af7d-4498-978a-2ca388b7d16a", "comment": "Malware payload (Dridex)", "value": "c1f48b487e3ed4d5a8ae8fa6b5b1a577fd09b0e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266522, "uuid": "c8856a32-90df-4388-9c90-993954a6f76f", "comment": "Malware payload (Dridex)", "value": "60577c7f90613d10364af5490afc9f12e724b381b5895199b1ff121def50f7a4c42f037fdf3c919b08a9ddf6db95430f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266522, "uuid": "8bbc1d3b-10ef-4c50-aa71-2e6d6094f55f", "value": "45F3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266522, "uuid": "8c27feb9-424e-4697-b89c-68be0b737c28", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266522, "uuid": "7a386ac4-d271-46b3-aa2f-f805fce9c1d5", "value": "3072:tB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:g4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266522, "uuid": "acc42dbc-cbf3-4344-998e-360ffe9ae049", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266522, "uuid": "17018a52-54c1-47f8-8103-48f111f9e5e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266522, "uuid": "0c80e287-294b-4972-b81c-d8c8ffda0847", "value": "2ea15b2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f739d12-ae2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278606, "uuid": "200f0d36-cd30-4161-a83b-21392b594908", "comment": "Malware payload (AgentTesla)", "value": "3bc26dd6deca06aa4adc8dbbdeb72c0d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278606, "uuid": "e39fe7b5-4e51-4d07-a4fe-17bcdc52a7be", "comment": "Malware payload (AgentTesla)", "value": "7b0f701006e4f3c675b26b428898c2b56608bd3d6a1c0ad38f9c0708ad605f55", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278606, "uuid": "2a688405-da41-4cc0-90c8-62b455dd0714", "comment": "Malware payload (AgentTesla)", "value": "54f9f6fd2f68ffd2a5d29a867c9ac3f59d7e505c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278606, "uuid": "bd1bf9bc-dd9d-4fa7-a1ae-a7130eb21c24", "comment": "Malware payload (AgentTesla)", "value": "b1506d2dbaac952be4596dd04a956dde1d9e6e1a9d2fb383ed9960abdfbe836c833edb682bbec4b790ff77539c42b614", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278606, "uuid": "5f34d62c-ce0a-4350-89e8-cc21af022b27", "value": "0EE423F88AFB780806595B2DABDA7A960ABD0410FD43433E4525CE65FDF88815BF0B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278606, "uuid": "17cd59c1-2f17-4b4b-a1b6-efd67fc87839", "value": "12288:r3T7C4eFnsH7ibPjP+/dN3+oU7Ep3n+X+v7GuwFLwey4r/4IATcsXeXY7ubh:L/TeFnsebPLkuoUQ1nxw9wej/4IAQsXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278606, "uuid": "0bd49403-fc10-4c23-b434-2ef02c8d77c6", "value": 719094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278606, "uuid": "f7ba0815-3b4f-48ec-b107-3653757b1575", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278606, "uuid": "afe537c8-2314-4899-8bfa-2550bb967c99", "value": "NEW ORDER CTPO18542#.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afa67e7-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309710, "uuid": "c78d1311-cd59-4d96-9b06-ed5753c0d062", "comment": "Malware payload (Dridex)", "value": "e6edb950f64bedb78ebdeed9e75505c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309710, "uuid": "f21b5497-4c26-4e74-ab21-bffa2323e14e", "comment": "Malware payload (Dridex)", "value": "7b3169efb3e7e83e26bf11eb6e13d1c74b028d3eae8610ff4ec81101c778f4fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309710, "uuid": "18f7dbe9-28fb-4383-8a75-22543a0c18c9", "comment": "Malware payload (Dridex)", "value": "ce296455c5f5e30e9ff884e775582b27934baa4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309710, "uuid": "146da52a-910c-4935-8dff-24d106699ac2", "comment": "Malware payload (Dridex)", "value": "b91f094716570c66c050e5a65b1e2f375024d7415f3fc965f1acac754250f14f5ae7b30c9bc9631198bacf00c2152610", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309710, "uuid": "0b60acda-9096-4375-9642-ecadcf899c10", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309710, "uuid": "49bc4933-bbcb-4383-90ac-17b3e44c7093", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309710, "uuid": "649963bf-43d7-4915-ab06-5ed47fd6ab8a", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309710, "uuid": "e5e68835-b949-4c8b-a8e0-7f3cb9813906", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309710, "uuid": "9bd405fb-a3e5-4d94-8b0e-c52cef9c9556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309710, "uuid": "0ad97f34-0307-4e9e-b671-53b5ce8fa4e1", "value": "e6edb950_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7065c0-ae70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620308528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308528, "uuid": "bf66f292-9878-441e-98f3-d8836e5adc1a", "comment": "Malware payload (Quakbot)", "value": "e43036ff5733aebc5c2f46081c7f9006", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308528, "uuid": "827afaef-f333-44a1-8489-cce32f848222", "comment": "Malware payload (Quakbot)", "value": "7b4801469217b291d85882cf568da70ceb8aec9d82ba3879794fa4bcf99ef25f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308528, "uuid": "8993c7ad-a44c-40fa-bccf-e13a9862b35f", "comment": "Malware payload (Quakbot)", "value": "e30d56021f158178fbaf7c9d45aa658b924a67e5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308528, "uuid": "021cc2d6-f3b7-4f9b-89cd-23ed197a004f", "comment": "Malware payload (Quakbot)", "value": "cca0459b5d67595e4f35686246a98a44365673ba3da8d0c0e15f6a6f55992e6495c83b285b0a84d40fa084510ec27aa4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308528, "uuid": "144ff2cd-cc83-43a0-99bf-5ca30884e0bc", "value": "35B38C07CC098AC7C16D93FA6D075DF96E0E5719D8D62FEF40321F8A3A251631E4B1AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308528, "uuid": "d3f766d9-9e2b-432d-9f06-afe21ed89ebd", "value": "3072:WWQvKINbjvw548LMb/oqKO8NnS8+60KcY5CCFTjy:W8AbT648LM7D98Np+ET5rHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620308528, "uuid": "82de58eb-5e80-474b-9e82-b61e84b5325b", "value": 113004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620308528, "uuid": "76b0a832-ff6f-43a3-b264-1481a0f1490b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308528, "uuid": "19f71329-e02e-4f0a-94cf-8ddf05d26998", "value": "1613044558-05062021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34bf81f-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266479, "uuid": "f20d68f7-12b2-4b82-a72e-8a538dd38d9d", "comment": "Malware payload (Dridex)", "value": "776385f977758458e0ee86b7365de60c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266479, "uuid": "c1aac0b5-8022-4609-b86d-ebe2a778dab2", "comment": "Malware payload (Dridex)", "value": "7b4b24aced5a35a9c862af4e2a60559015179a1c4d42e485c2f6bb5ef47ca334", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266479, "uuid": "5b33f885-b4c3-4ef5-b221-dddbc6b10d0b", "comment": "Malware payload (Dridex)", "value": "b5b180383f595691372f136c4f80a56bca005119", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266479, "uuid": "467637f3-2f8c-4b73-81b8-cc5ab600e8a8", "comment": "Malware payload (Dridex)", "value": "13f54c0791ea285fd571a916b8656b7b342dc831c8bab745f533885e93129d98405fc57d419262192878edd313a64163", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266479, "uuid": "b29b139b-20f8-4c8d-b462-7dbaf3337af2", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266479, "uuid": "0a25c3fb-6120-47f7-bb64-f33302f4b276", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266479, "uuid": "46286838-b533-43fe-965e-0af262386db3", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266479, "uuid": "b61f109b-1690-452c-8520-662519e03ebf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266479, "uuid": "056fc996-98eb-4d23-a338-c5d1dd0ab8db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266479, "uuid": "f45edde7-edf6-466f-889b-a8d4b1441d4d", "value": "776385f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3362f614-ae71-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620308678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308678, "uuid": "75741bfb-274a-4381-8813-730dc4e7eaf8", "comment": "Malware payload (SnakeKeylogger)", "value": "83fb393deddb3d4322b0ba228fa0d509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308678, "uuid": "f84091e8-2aa0-4e84-9e14-d13f2e01c69a", "comment": "Malware payload (SnakeKeylogger)", "value": "7b4ed291baa7ebf39284edbb60ac5a718211f689a92711a92d60ceabaaacf623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308678, "uuid": "5e7feadb-dded-4605-ad3b-d37c8ddcf59e", "comment": "Malware payload (SnakeKeylogger)", "value": "03ad2fcf8490f64d4dfeaad4ff34474adfac1433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308678, "uuid": "87bcbb8f-db49-4b23-8ee4-c817e63082f8", "comment": "Malware payload (SnakeKeylogger)", "value": "fe233959e328b2cdf191154456827f7ee147366d4e6197db08122df171123e18b40e8649b0879c68d04eae740aa15a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308678, "uuid": "50b5405c-707b-4e02-9c96-d6c7431fcca2", "value": "8CF2E558BF998277DC6D4F7C21A202811737FAB668738A2F79AC1409DF532879D13760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308678, "uuid": "462edeb9-2379-4f71-97e6-e7192d71d5a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308678, "uuid": "29e61468-ede8-4d88-8c26-9fe9eab62659", "value": "192:hnFr3gj2zXzANIkYWy8sHw7P+zwTZOjA9wM:hnFS2zcNIksHW+zwTZOjA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620308678, "uuid": "fa418327-c8a6-4578-8aa4-e52483b3a856", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620308678, "uuid": "4f2a6d5a-98ce-4680-a378-f9d5921c72db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308678, "uuid": "c013f33c-8758-49ec-b4a8-549f8550e5b8", "value": "Notice of payment of 04.05.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b68f9a-ae13-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620268574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268574, "uuid": "8aad0c6e-4af7-4638-a909-03b265ba6c98", "comment": "Malware payload (njrat)", "value": "5930797cc5576206f47a9cffac67bdfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268574, "uuid": "4517a6ce-58cd-4f47-b509-0b8a893d467c", "comment": "Malware payload (njrat)", "value": "7bb029846f9d598d43a881eecadeeda0904b7eb4579d47546a88e58224c7656b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268574, "uuid": "27da62b3-f19a-44f9-809b-5ba484d814e5", "comment": "Malware payload (njrat)", "value": "3263329b2e25a4b5b6f9357c4924d0af0de7f7ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620268574, "uuid": "94dee1ec-dc5c-4b4d-89b8-39ff89ab1098", "comment": "Malware payload (njrat)", "value": "dcde3733a62fbc715da5d73fcff18eca77e049f191eda32566d61337a8c52d30e864c7a541b3f6edc4e906a05e0afe3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268574, "uuid": "8221c1e9-6297-452b-a5cb-d104dccb50d2", "value": "ABE10912CADDA633CEEE07729CB307402638D3814693CBAFA8C8558B5E1371617937B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268574, "uuid": "7a30f006-1c5a-49e4-bebd-5b0b5f5a5009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268574, "uuid": "e8a59cde-71ce-49b8-99c1-46bd18d98bda", "value": "96:ykEXyPHxhgWnh9luGd5wTjVqQXo8Z1radA6BzNt:ykPHrb5aVqQlZxLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620268574, "uuid": "e3b2e10b-1d2c-43c4-95a0-7701f52b53b5", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620268574, "uuid": "0e6c873b-8f19-49c6-ba9f-5ae8fe7bb9c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620268574, "uuid": "7b6aee88-5252-41ee-9191-d7dde761420f", "value": "5930797CC5576206F47A9CFFAC67BDFE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00df378-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339354, "uuid": "90aaad7f-9096-4ead-bdb7-02c590a860f9", "comment": "Malware payload", "value": "2cb7527a6ace0a9fdc0fbdd102a2fa15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339354, "uuid": "b0be0a4e-7a9a-4e83-a50f-e0964c19d6bc", "comment": "Malware payload", "value": "7be641052b2aae6d32b3882cca0526afea22e1e1edb1b623bd0d74f929ea05d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339354, "uuid": "8719c559-5545-462b-b3f2-caa89fd84bb9", "comment": "Malware payload", "value": "68e612d85f267ff5597b509aa921461a68168838", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339354, "uuid": "8159cc35-4aec-491e-a799-decc712870eb", "comment": "Malware payload", "value": "2973255933d2fa6eff0853a014725f6bb60e89a383e4d0e17bd58c8c8e9892d0833e1f9327a05726214c62968135f904", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339354, "uuid": "70d50112-dd2a-49ae-8d3f-6d24585a0b9f", "value": "87F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339354, "uuid": "a0fbdb89-b606-4906-ac10-c8d9aa7590f5", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339354, "uuid": "8e58f3c6-7358-49b6-b5d0-e6b94061d760", "value": "3072:+C45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:v4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339354, "uuid": "50e005f2-ec9b-4880-bdb7-552e3e1368f6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339354, "uuid": "86f3787a-6f50-473e-bcbb-0002861597cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339354, "uuid": "b1bb4027-7123-46d8-a19d-7727f21cca8a", "value": "2cb7527a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9530c5b-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338618, "uuid": "7e53d30c-210a-42f9-abdc-fa5981a89b9c", "comment": "Malware payload", "value": "9c1f1ee2cecec9b668616dc1d8b1f597", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338618, "uuid": "12c6a0e9-b497-4a9e-ab19-7374b5d8942a", "comment": "Malware payload", "value": "7c13738bac598b888063131045acaa3634c8299ebbf7d6a313692eedacb9b588", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338618, "uuid": "189c5b4c-1147-454a-a2fa-4cf9ab03af77", "comment": "Malware payload", "value": "1cae38dca814b3a7784ba733d3a9c8ff484eea1d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338618, "uuid": "b48f4ae9-6a44-4185-b565-1ae79ff1cc68", "comment": "Malware payload", "value": "76c1369532d13f1c044df846a7934b1f52a13ef4e27bcaeaec5e42c218b59cc4688831dd4cc36dad02fd7bf5b13e5c77", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338618, "uuid": "80b45245-5295-4609-9fc2-a8e1fd938095", "value": "B8F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338618, "uuid": "72cb78f8-6379-4bd8-b830-8fe385775f38", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338618, "uuid": "975864fa-d469-4ebe-a77e-474b5f7243bc", "value": "3072:KkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:0ERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338618, "uuid": "5a1680f4-fe08-41a7-8861-2325f0bb067d", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338618, "uuid": "99bbc3c2-8662-4b94-8009-09069c8dc7ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338618, "uuid": "18e739b8-36ba-497c-920e-07eceb0d9c8a", "value": "9c1f1ee2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd2c5ed-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320563, "uuid": "2198d1e8-e4b7-444b-a0e9-25f52a325ba8", "comment": "Malware payload (Dridex)", "value": "e0a99aa5ace52cc5888cac0c0a69d933", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320563, "uuid": "cf3d0377-e02c-4188-a6c1-537262e3c12d", "comment": "Malware payload (Dridex)", "value": "7c8dc46a60997718b05b67694f169aafcd7ea74e70319ba96a3c3b0fc6ff7ecd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320563, "uuid": "77b14fdb-f0f3-42f2-a1a1-965eb547ab2a", "comment": "Malware payload (Dridex)", "value": "41f0c4665be2e09c50df4e55585fcb9d5db40f62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320563, "uuid": "07852cf1-a00c-402f-b2a7-f276c3a9c131", "comment": "Malware payload (Dridex)", "value": "31f67d05b36bea4b6411ffd02f345798f29c42de53a4cb011fd95fbf5b53960d9c6c9beb57bb12ad13b49779e12aaa9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320563, "uuid": "5390f677-8c01-48c2-a77e-eef7f9d6fc29", "value": "B9F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320563, "uuid": "1e64fa3e-a608-4862-aec7-63dd7fc3e32a", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320563, "uuid": "9df28c9a-6864-4656-9ebb-6e8fcaf29839", "value": "3072:iWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:i42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320563, "uuid": "07d79ca4-84a9-4eb8-8d64-76eeed75497b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320563, "uuid": "90b7896c-d0e7-4832-8069-901264a987ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320563, "uuid": "0be55198-49b8-4ed3-855d-2f22a2a543f5", "value": "e0a99aa5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5a7a20-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339407, "uuid": "3970eda8-89ee-49b3-86c5-6657b1dfe6a5", "comment": "Malware payload", "value": "c7505fe5ca12a6c7981058a477e1849e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339407, "uuid": "ea854e6f-38fe-4b89-be08-88595b0d86fe", "comment": "Malware payload", "value": "7ca9d478198d94f396d287fe976af8ec4557edb90c36e5e536e4dea2bdc4b47a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339407, "uuid": "b42df283-660f-432c-85d4-0af2c910f1e3", "comment": "Malware payload", "value": "afdb458511a27c44f69148c9fa4cdc515f41ce31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339407, "uuid": "fb80683e-7c6d-4483-a848-3a74e78f0685", "comment": "Malware payload", "value": "0271c85c9fc75c5a47c77ed82946ce9dded815ab605a2f3862ffed19a3651e051abbfd6a32ba5641b1df35ed9a57b426", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339407, "uuid": "4ba463d2-a065-4c53-b0f9-4759217e1a1e", "value": "60F3E119C18FDD2CFE80E8768A9B7D1E361253C4DB15D989C0CAE93D12EB833BE49915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339407, "uuid": "a9e3252f-6a87-4960-ac3a-9bcb8141b02c", "value": "28be32cdaea89fe5b9aa51049f1ef9fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339407, "uuid": "8ea1fd2b-b2d7-40cd-a4dc-3224d4c308a4", "value": "3072:laZGUO4UhdV+ul929CahrwJsDGlLB36cJzNLOYk8ePaNjNV64apsZdJdfRY:yGzXV+ulmw6DGlx/zlOYUP+NV64X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339407, "uuid": "6b39cb20-4856-409e-a6cb-a3a9f929fba8", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339407, "uuid": "ba285780-c856-4fa9-9e3c-d4df92d9f0d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339407, "uuid": "ed87159d-2a29-48d0-bb05-b505a024abc7", "value": "c7505fe5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5041adf7-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316887, "uuid": "674155fb-9fe4-4109-beda-fd4ce4dd6f82", "comment": "Malware payload (Dridex)", "value": "84325f86217eff6b0aa50043b71380dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316887, "uuid": "12bc3cd6-5841-4a2c-8a61-21dd3cb9ecb3", "comment": "Malware payload (Dridex)", "value": "7cd640846d693cb7253f2d5199bf6b7bd236e2f38924b7c8046233b2860f7719", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316887, "uuid": "d934fd8c-82a8-4e05-86ec-1747c7781df0", "comment": "Malware payload (Dridex)", "value": "fb099ac8b9db7242e8dbf3dc3ad6ff895ccdd1bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316887, "uuid": "3355fed1-efe6-42d3-b036-196d5a2b4483", "comment": "Malware payload (Dridex)", "value": "81bc566fb4cc0e2c40da5168cc478838695e2e965f3d53dd849f8cb96806426c1549e22f4d9f33a058556602ca9ca88c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316887, "uuid": "211e2a74-56c5-4f24-a0e9-5dc41591489b", "value": "30F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316887, "uuid": "aa135142-7e0b-481f-a024-f4de238d44ca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316887, "uuid": "0b491e8d-b251-427c-bf40-6074b74a3030", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316887, "uuid": "c0ed9c14-4fd0-486d-a344-da8c9f3c712f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316887, "uuid": "b15fc4e6-155d-49f1-a985-257749b81fc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316887, "uuid": "1868310b-53da-4a5e-aff9-d0c3e9862487", "value": "84325f86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c006249-aeb2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620336770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336770, "uuid": "0caeb8b1-4559-4e07-9267-18536d2238b5", "comment": "Malware payload", "value": "75fd9a98ffabdc6cd2932e48affa2fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336770, "uuid": "e55834a0-6399-4185-83ec-846f9fa946ad", "comment": "Malware payload", "value": "7d449aa7f0c8097671688a2636f7b2d748f5ee3e4e63de3447d903fd371533f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336770, "uuid": "abcf377f-3dca-4ed5-9cc5-59229a268385", "comment": "Malware payload", "value": "73d99f7c741ef7648002534addd4948098d0a1db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336770, "uuid": "24bfe019-5f3a-454b-9218-d4ec870bec5a", "comment": "Malware payload", "value": "34eac463d99d6ca31d7e093fe0bc42fd5fef4f9e8a67f99910d54fe2a5b1288133b2337d9751790ec23e883e850a0f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336770, "uuid": "42433cb7-7092-449d-825b-617373aef76d", "value": "6DE4CE2D77C56E94C2080F32DA6380D487F0D12B6232FBEF69D869E59D02747875F86A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336770, "uuid": "62b6f747-1761-4c9d-ac56-9f910fcaa4f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336770, "uuid": "095ced94-3387-4c88-8fbf-e7924e61ff75", "value": "12288:BdfXT751sp1Yo86HiBADJuSxRvi1W8rLZ2F4yoYyAKippiWSNCJxo:B5c2VIiip1GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620336770, "uuid": "1b60b440-900c-41ac-948e-dad4bcf079b1", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620336770, "uuid": "b7ebbba5-fa5c-48e2-b91d-d8bdedcf3fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336770, "uuid": "d96a2b0e-1536-48b4-b92d-d58b34bb8e93", "value": "New Order Requirement 2204.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a5043d-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298907, "uuid": "5134479f-3cee-4b07-97bd-75838f88a406", "comment": "Malware payload (Dridex)", "value": "55e82de147aa58b4cc473daea3277457", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298907, "uuid": "ce82a6ad-38ec-4c69-ac7e-8480d6defc62", "comment": "Malware payload (Dridex)", "value": "7d457b60dea736afe0a0c71da4dfe2403ff2e4ef4eb174afdaa0a6448a9d2820", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298907, "uuid": "f4438343-30b4-4f72-8049-c9e4eb8258d5", "comment": "Malware payload (Dridex)", "value": "018c8ada1a4c7cd2ad13f30e7622934b494863fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298907, "uuid": "2e50fca6-31da-40e9-ab74-0ab6b1968f1a", "comment": "Malware payload (Dridex)", "value": "48edb9bfe5fbc0e6c79dd1f06e46fc93258de6dd014ae4b0066b7b12dd3fbba50dc1e244a8fe7ea20aa42ecd88c34495", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298907, "uuid": "00682967-d0d2-495c-b9d6-1d936abff343", "value": "06F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298907, "uuid": "b2d52ac7-5e09-4d32-a325-f3bbe1c30c93", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298907, "uuid": "f89a410e-65e3-48bf-8705-cb187c6db9ad", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298907, "uuid": "0f296ebc-1438-4a03-b174-3ee0a7d12ffe", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298907, "uuid": "e758794a-6961-4b64-bff5-ddc9bc88bc2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298907, "uuid": "62e529ff-5380-49e7-be95-a1fafa11a8d7", "value": "55e82de1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bdf4b3-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288088, "uuid": "8bea61aa-d87d-4c51-8237-b4f84e459a18", "comment": "Malware payload (Dridex)", "value": "b1380876e34cc9e2f9279c9d5cee4100", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288088, "uuid": "0f080280-0ceb-4f21-a7c0-a84b71e8af3e", "comment": "Malware payload (Dridex)", "value": "7df16414b9e316588b30c1d04fe0fed59bb98a0a03cd8aa2669636843b8dafe5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288088, "uuid": "e0a59657-fff6-435f-a71f-a5738a7e355a", "comment": "Malware payload (Dridex)", "value": "fcbe9e7bc3e54dba6f893d964e8fcbc6e1296f54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288088, "uuid": "ded6ac4e-eac3-4cb8-81af-f8646769dd26", "comment": "Malware payload (Dridex)", "value": "bfe684ae122e41befea10f5883d74dc5ea7403a582bb0614dd3070cd7ad3e466f9247a85648fa1cc12c619c62cbb540e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288088, "uuid": "20a74cad-1d1e-4e43-8612-dd07831166b6", "value": "93F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288088, "uuid": "a89a728c-0fca-40f6-a40c-69dc4422b62b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288088, "uuid": "2b34c338-c53a-4a73-97a8-dd794fb2bee2", "value": "3072:yIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288088, "uuid": "301f1a7c-2379-4d40-b74b-da2ea3c80109", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288088, "uuid": "5a58c265-4e90-487a-9acd-3f9f5a9dede3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288088, "uuid": "5c5b1554-e3a5-4388-b75d-a7763361fb53", "value": "b1380876_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ba5678-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620270159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270159, "uuid": "5db0f19b-7bc8-4f01-b296-8c6a055ea83f", "comment": "Malware payload (AgentTesla)", "value": "2a454833b69e4f9b9b2622051c15a195", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270159, "uuid": "00e9fa30-c3e5-4723-a453-3535952a6b55", "comment": "Malware payload (AgentTesla)", "value": "7e1dfb18bd9462700b13f9f564f339639ff4832908128440a4fadc35494777ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270159, "uuid": "0802824b-5939-47d0-b9c1-3dc19d10166a", "comment": "Malware payload (AgentTesla)", "value": "13fef9ae3a4895fb87e48a57cc8da4b3daf4a0fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270159, "uuid": "a3e2bb86-61f6-47c1-ace8-e95a2c251878", "comment": "Malware payload (AgentTesla)", "value": "d07e000f76134979113ee0f5a8460a4c103db07d401af8a7bd66a9ff5767818d66e8b8180cffd73b865eb4e61b30a788", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270159, "uuid": "172ba6bf-9b4d-44fc-aab4-37cb87091ef0", "value": "F704AEE9C9900CADFB9247768551F90D4FD5B68B4DA19203233C593C8AFB0DEB71B1A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270159, "uuid": "f28c8ca7-df16-486b-be43-d5c58e0a8847", "value": "3072:DC57Kh2i7Akd7dnyW0EslU7WaFUm2mgkT3s7Be+lpmZsA/CNIoxvxca8CpmmxchH:DCNs2i7Ak9pyNEqUKaFUm2mgkT3s7BeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270159, "uuid": "03c9a32f-8f0a-496d-a7a8-c8d70efa0e5d", "value": 186808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270159, "uuid": "2c9b805f-d284-4021-afce-8bd1e659955f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270159, "uuid": "94e04665-25ee-4c74-8919-494423e41a0a", "value": "2a454833_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578baa5a-ae60-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620301437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301437, "uuid": "20e4e020-659a-45ef-836f-363b94be2dde", "comment": "Malware payload (SnakeKeylogger)", "value": "2096676f088f7ac284a506d399c7e3a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301437, "uuid": "01b68912-6d39-4286-8ecd-71294c71025f", "comment": "Malware payload (SnakeKeylogger)", "value": "7e54751389a1e0b8cffe8186b51dc76f3050af919aa1bc0c0673276e48925878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301437, "uuid": "f21b8bf7-827a-40e0-a4ad-217b0c881846", "comment": "Malware payload (SnakeKeylogger)", "value": "90022dd081dab836018333ca052a92f9ad6eb7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301437, "uuid": "5ae46f6b-5380-4c71-897a-1913e82a4614", "comment": "Malware payload (SnakeKeylogger)", "value": "e6761e3c1cff51640e16999d0d4780ac64f8bbc31679502a69fe0127f9aa02f1b1b0355bb6f6b67109dc850a077710e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301437, "uuid": "1a4ef029-88a2-4f09-86ac-6d18d5f228af", "value": "18061C9C976C862DF0F78FB601C8874C4BD6EFD973321440AA59312366B72E593A9336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301437, "uuid": "0b27c17b-84d4-4265-94ee-87c21d8cb26b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301437, "uuid": "62f34e3e-09d2-44b2-82da-536575f8c8c4", "value": "12288:2DMy3OBie2k4W5fl7UF1zgvXTLP/5thc1pew+XYTjxehavbH3IGecWtC+31zVxQ/:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620301437, "uuid": "9027d668-1e92-43fe-bae8-0d50fccd2a3e", "value": 3736064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620301437, "uuid": "77e0e193-8de9-41fd-a861-05d258bc2ab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301437, "uuid": "e2d3b137-ff18-414a-9beb-0d18c9cc3a77", "value": "Order 122001-220 Guangzhou_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db46c0a2-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339454, "uuid": "1cb8f43c-d2f3-4753-82b6-9f32f103a9b5", "comment": "Malware payload", "value": "33cdcc7712992f15f35a9126a83ebc43", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339454, "uuid": "e1855d50-aa29-4193-ac86-75c9fd619cce", "comment": "Malware payload", "value": "7e8d8206e66749125ff3bbccd37c5f3b3694b64c35f2f57829b67a6e2c8cf1fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339454, "uuid": "47a90224-c95d-4dbc-bc92-7d9c83686eff", "comment": "Malware payload", "value": "ae09d6ed46429ad159b24f2bb830bd96bc3c513c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339454, "uuid": "5751448a-6d69-4a8e-aa81-0b38ce4110d7", "comment": "Malware payload", "value": "e217b573475227d2015d5b5216b96e0a6799175114546d3c15fdace9b151d9d93e6e9a6dd6cc9b43667c2b1a03435e67", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339454, "uuid": "4711dfbb-3e32-415b-84f5-29df5bb28614", "value": "4FF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339454, "uuid": "07bccbd3-8f00-4d32-b7bf-b052d16e6b27", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339454, "uuid": "ed02b2d2-a3ad-4dc1-b623-62e8678d2a7b", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339454, "uuid": "b1f18bfd-f2bc-4c62-9305-7e3afff552ec", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339454, "uuid": "766b85b9-7e80-44a3-96a7-ee75746efacb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339454, "uuid": "2dc93893-279b-4976-864a-52832012660b", "value": "33cdcc77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b435f9f-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620262896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262896, "uuid": "dac5c0e9-55cd-4d72-a4e4-0bb3b738fad9", "comment": "Malware payload (Dridex)", "value": "59e52114cb590014a0901c8d8d5f94de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262896, "uuid": "89aea8b9-6015-4974-8968-b24ab9deb8b2", "comment": "Malware payload (Dridex)", "value": "7e971d9f5dcd96ca8a8d6855c80a9d51a4ef44c5218b5135212c21edb6084713", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262896, "uuid": "ba191e7c-d33e-4412-b9a0-e4d57974644b", "comment": "Malware payload (Dridex)", "value": "d63e912ed643109992a8bc8d2a8f852b794ea959", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262896, "uuid": "93375c64-b703-418f-aecf-63ed93f32d2d", "comment": "Malware payload (Dridex)", "value": "98d4545194a4e62846f9daa9c9d6e08d1465976bf0c89a6eb02674193ddecacf036d496db0d9dbcca0548cdf3b492f00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262896, "uuid": "62b47e13-9869-4fa3-ad01-dc3e615a7de4", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262896, "uuid": "a37627f8-9619-4594-9d93-21285adb6341", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262896, "uuid": "b344bd5b-9861-4620-8b5f-b8a0a5290fdf", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262896, "uuid": "2751b302-89f3-46ab-b07d-be72945fe87e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262896, "uuid": "02ff2ecb-aff2-4d2f-aaee-ea437c6bae32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262896, "uuid": "f0c8abf3-6885-46d8-8441-8d6de1760d7b", "value": "59e52114_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024cdc80-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338660, "uuid": "c8bfa365-dbec-43c5-a90b-88f35e2c9ace", "comment": "Malware payload", "value": "3a2c257bffaa74689ba0f826fa6bf1bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338660, "uuid": "beecf58b-f83d-4929-90a8-b1e988518cd9", "comment": "Malware payload", "value": "7e9df53a642d30e8668b57000aa3a3137289cd15d8220c65a3fe46e339e8ff09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338660, "uuid": "ebc921bc-dc2d-4c36-8679-f869baa50a50", "comment": "Malware payload", "value": "cc05060b305fbdb19eec33ca3e2797acd75fa3ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338660, "uuid": "176784eb-c077-4829-a071-10079d5f05c4", "comment": "Malware payload", "value": "dfab4c396737090aba923b6bf9f4f11647c1779073e1e5aec709cd7fb405500372872ca250afce91db207c712838c5b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338660, "uuid": "cdb521a7-6e08-4f3f-8608-bb10c21da9b1", "value": "42F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338660, "uuid": "01122c87-1d30-49b4-9dbf-95a366d3e769", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338660, "uuid": "3429c068-c107-4aa0-b325-eca7ed30dac1", "value": "3072:BB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:f4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338660, "uuid": "489d12d4-3106-4746-9ce4-3747b4a142b2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338660, "uuid": "528a4087-f471-4404-a382-cf7c19df0c79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338660, "uuid": "3a3a31a4-744f-411c-91c4-782670ea192e", "value": "3a2c257b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de0db97-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277261, "uuid": "9b536704-e7d3-4ccc-a2d8-51c4e20061ed", "comment": "Malware payload (Dridex)", "value": "5a0329fd64c620a73efefd9e7626375e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277261, "uuid": "2e596e8c-89ca-41c8-9d43-d38b963023f6", "comment": "Malware payload (Dridex)", "value": "7ec70ce07fd1fb5e561c76d62f4328c5442b3b1e3d41f1ebefee036caad3a16a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277261, "uuid": "4d627470-2eb4-4651-8a3a-5688c9d234d3", "comment": "Malware payload (Dridex)", "value": "d89789804168a81afb6cc313787fe95c766a758a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277261, "uuid": "f8d154ae-bdd1-45fa-81b8-f8dca3da6192", "comment": "Malware payload (Dridex)", "value": "4540dee0fa89afca926ec5d623b7b61bde422b078ded5a2585f33ed4ee7c6a07db1ffbce853d8d2cfacc196e2699f396", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277261, "uuid": "cc820a3f-2544-48ee-9aa5-7535498b9163", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277261, "uuid": "c1ee7f52-09ad-4cf6-874a-e59d14e39c82", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277261, "uuid": "1079d7a2-1a15-4cd8-97b9-31d2a0847067", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277261, "uuid": "1cbde2e8-71d1-47d2-874a-b490cee5bbb1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277261, "uuid": "75ef2924-bfc8-495d-a257-1592975d0259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277261, "uuid": "2273878d-6c20-4610-aee5-6f0459478cf6", "value": "5a0329fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c55cb2-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331415, "uuid": "aebb3fd9-34a0-4101-8007-617f47dc8ece", "comment": "Malware payload", "value": "136551b301e5a007c7afc9878e17b4c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331415, "uuid": "aa8ea5a3-79c0-4e3f-b774-74d750bb16fa", "comment": "Malware payload", "value": "7eec01b57c8b20352ce655361b35607fb0b061bc2ab6698e194f5a7baa54f94e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331415, "uuid": "07d0c67c-f162-49c3-b9b4-b6e6ef130e4a", "comment": "Malware payload", "value": "601889e79590c01bcf9a009f9e35e52a00529aee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331415, "uuid": "0e5b3454-6389-4aa8-8a2b-f22e4bcc549d", "comment": "Malware payload", "value": "d05ca4dff273cea21cd0777a00ab3ea7c73a2b1cb6c02b7a343eedab5c8a7cd096fcd253709ad7fecca35d212cf3af55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331415, "uuid": "7a86adcb-33b1-4bb2-b7f4-b4a29f424f58", "value": "9EF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331415, "uuid": "190170ce-2ea5-4efb-8b04-f0c3a7e53d44", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331415, "uuid": "38a89632-e2a8-48a0-af29-6417fb89f980", "value": "3072:AUG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idzT:eERMVPG6+Y63HoG1QawL40Prx6KNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331415, "uuid": "885792fb-e19a-42be-94da-dcf2bfd456ed", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331415, "uuid": "02487479-854a-46ed-a414-c55f5dda4478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331415, "uuid": "59e7aac1-096f-469e-b4c9-603cbda4de57", "value": "136551b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc959e42-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338973, "uuid": "d19922a2-0295-40bd-92d3-807b81776764", "comment": "Malware payload", "value": "4e8d3ac54ca8187ae4a639d90420ca18", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338973, "uuid": "0c999c84-09ff-4fc4-aa34-16596fa0c324", "comment": "Malware payload", "value": "7f63df34bd787e4a267164e7e14c5a1446e2d486777e8a8e8957b082c4adf33c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338973, "uuid": "2506b94f-72f4-4ee6-abac-9e1d5ce3835d", "comment": "Malware payload", "value": "04d9bd8c60d796056c54f9b4715782100c19d366", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338973, "uuid": "6d19623c-7d8c-46ef-99e6-a38b8e7e8c65", "comment": "Malware payload", "value": "d80076f41bc7ddc6186491448395f619e9a47d707d548c45b306efb276c19c27af6a0eeb0d55c5ad0c98a40fe0866f45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338973, "uuid": "0f7cde0e-4ace-49b4-afd1-dfabe1c18bf2", "value": "64F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338973, "uuid": "7db2d98f-6f43-4515-8108-ebab6c3a8857", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338973, "uuid": "40de7c0a-b806-48d1-a7a0-264878089067", "value": "3072:0OG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:UERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338973, "uuid": "ae75af5f-79e1-422b-b701-fd004afafe53", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338973, "uuid": "7b0e9584-71f5-4592-abf9-8c7bd37e76cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338973, "uuid": "22ad4350-051f-40f8-93e2-f66b6a703a95", "value": "4e8d3ac5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fbaebb-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306150, "uuid": "9afcc916-415b-4f89-b89b-2d5f7223065d", "comment": "Malware payload (Dridex)", "value": "053e0455256d076693a60ff1486a4831", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306150, "uuid": "40c32e1b-276f-40b8-b7b7-0527e9fa5c76", "comment": "Malware payload (Dridex)", "value": "7f7ad2461e812460127caa85672b1262226d29269e782bd43e290c439f114f81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306150, "uuid": "d697fee1-ad96-48d2-bb48-434c3b2b0780", "comment": "Malware payload (Dridex)", "value": "91d79de75c0b9e2c1aab521fe7ae8cb6b9d96ff0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306150, "uuid": "608d3575-f872-41db-aeb9-5aa7aedf8b59", "comment": "Malware payload (Dridex)", "value": "173a5e459cdf75b7ce4b466f8f3a12be5d9556cd1139564c0325c41a6c5c4cc6787b8b3de647aaf0df4eb8edabe81452", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306150, "uuid": "35911871-3694-4608-b56b-e87286f75ae6", "value": "45F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306150, "uuid": "d2a3c9d3-8c9a-4f7f-9c25-03a3a0a75c8c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306150, "uuid": "39117799-de5a-4581-adb8-bc66cfa95171", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306150, "uuid": "c2a7b930-5d23-4407-83a9-ba093b18d402", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306150, "uuid": "739b3d34-2bba-4cc6-a5cb-6311cb2cdac4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306150, "uuid": "913c76ca-558a-46a6-84ce-e1ed638905a9", "value": "053e0455_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a49852-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316951, "uuid": "875524d8-f83e-40df-a3e9-9c0d88d39887", "comment": "Malware payload (Dridex)", "value": "2d6291323780a2ebb8b30c920f148687", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316951, "uuid": "04e1add7-11b2-429a-855d-3f5d2315de06", "comment": "Malware payload (Dridex)", "value": "7fb676ab40febd7843eb3efb71adc6cbf36def5856f474cdc907db8ec62725df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316951, "uuid": "27a9ef0b-2a4b-49e2-8318-8e04b8ae8158", "comment": "Malware payload (Dridex)", "value": "d2543aa32ff92cb6b2c77c53c91ac3fe5b3f4580", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316951, "uuid": "ddcf24bd-f4c2-49d6-ac15-9942bbd4a3a6", "comment": "Malware payload (Dridex)", "value": "efc7a4fc5524e476596cc18b0064c0c192d442afee7426e76698724e79c21330691473bbd487dcbdd0f84f06a94cf900", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316951, "uuid": "8c2142bc-886b-4b46-83d9-fe8e9cd8552d", "value": "14F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316951, "uuid": "9f9de7ae-f58e-445e-94c2-1f695a2d66be", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316951, "uuid": "9ff29853-be3a-415a-b31c-acdb99d526a1", "value": "3072:4IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316951, "uuid": "d6908bac-9719-44ed-8602-432866e1b705", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316951, "uuid": "b4d6f765-b96d-4f58-bc91-bdfb835249a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316951, "uuid": "d87379e4-3fa3-4cd6-82f7-2bab7dd7e42a", "value": "2d629132_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74246e15-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339281, "uuid": "8b3337db-a938-41a9-85f5-1d4e003120e6", "comment": "Malware payload", "value": "8ab61c95efa778dda11d31408d32ce26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339281, "uuid": "3370b50b-40e1-4a0a-af1d-c7671989e42e", "comment": "Malware payload", "value": "801883a06a14668be3b65afa8347cb432ecc4e394ea127b2a15caa43edc39609", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339281, "uuid": "a5b089b6-c295-427f-a40f-8f3b46c1d49b", "comment": "Malware payload", "value": "9f1f3a1de83fd5c4ec7656e2225911fea9fb9f30", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339281, "uuid": "c6d66613-9efa-4eda-810f-1caabb3c463a", "comment": "Malware payload", "value": "c1a996406bc9e72b58563ae1bf74f3c67f66d278387a0a80cfdbbbe9e33d7534679325a0f70560178eece0fa7ac54d45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339281, "uuid": "03f29400-4e8b-44d7-a1cc-7a19bc7a3987", "value": "3BF3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339281, "uuid": "d993dea9-9fc1-4eb3-8b5b-2d719afd66a1", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339281, "uuid": "524d5a27-74b8-4cbc-8a85-fc0a93c3d094", "value": "3072:NC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:M4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339281, "uuid": "6282f091-5d5d-4e77-851a-cd5e47203f59", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339281, "uuid": "0d736390-c061-46ac-9cdf-7f423cccd9bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339281, "uuid": "c3cbf1b1-caf7-41ca-b401-ecb11c248313", "value": "8ab61c95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ecf5d7-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339473, "uuid": "7d079d74-4283-48ea-aec6-89a7b72e6a46", "comment": "Malware payload", "value": "967ece51e3881eaf681b395519361464", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339473, "uuid": "ede685fe-5b89-4e07-b87b-f6e07d4840c2", "comment": "Malware payload", "value": "802b06cf9274d4e6997f7077a1e5afa0a268e1a19fb220743ae37311192fa7a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339473, "uuid": "2c3307ba-8d2a-427a-a8df-712ba24f17ad", "comment": "Malware payload", "value": "0d29c8692601daa941081a6900b0d64f84f24bab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339473, "uuid": "50dee51d-4fe2-48da-abf9-f320ff6b6b9d", "comment": "Malware payload", "value": "b280ea6dd6b84509d870bccf2075170eb5cd5922542592fd70d393b3ea454615628de2d8f00e21ffef1edfe32928d112", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339473, "uuid": "a62ea217-5fa5-407f-aa26-06fc1d3e2a89", "value": "B4F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339473, "uuid": "24238bbd-2229-4df5-bd88-9d6b62eae5a6", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339473, "uuid": "4ef4d20b-21a4-4232-8d18-4619f781ca46", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339473, "uuid": "aa9d0ef8-b93c-4e38-a306-37df4eb6388e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339473, "uuid": "9804bff8-0c1b-4035-8144-3b947eeee3be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339473, "uuid": "cc4924cb-a92d-4aa9-a888-c73465f2f3ee", "value": "967ece51_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595d42a6-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316902, "uuid": "899110b0-2675-492a-9ca9-1d1a1d9b6f04", "comment": "Malware payload (Dridex)", "value": "bec1eca7cefe9f29ac78eff50f757626", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316902, "uuid": "1ae1aa92-cb6f-4671-9794-a04c8dc0149b", "comment": "Malware payload (Dridex)", "value": "8031fc07e11be065ad9d1e84c1f573d6a20468c97d71a1cf7bc3d6b22c49e88b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316902, "uuid": "a1ea17f0-3eca-4075-976d-b8fbda69f0a3", "comment": "Malware payload (Dridex)", "value": "f5c5d262c6a0779431127e5d378be8d1b6514326", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316902, "uuid": "f2e64fab-b045-4a7d-bece-333227460ec5", "comment": "Malware payload (Dridex)", "value": "7bca61e18af26f4a092afc0d22cc5608aa81d6f6de9d5a0a964e11df88b00e04be84aedb9bb33ac922592838e4fcb65b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316902, "uuid": "d758bcec-2185-40e7-9ced-3d86fb5ddcb9", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316902, "uuid": "f9686432-1f3c-4701-b1fb-953e70cdf54a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316902, "uuid": "f394b63c-4138-4e75-887f-a9f324fc98a6", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316902, "uuid": "5ce8e2c8-622d-4888-b16e-d424304df643", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316902, "uuid": "d770582a-60cb-4439-8eba-2dd39115488f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316902, "uuid": "2a31c918-4925-4328-9db6-31396fa6ee35", "value": "bec1eca7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f39c70-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342102, "uuid": "5a98ee08-6554-4b64-8fb0-69a41230415c", "comment": "Malware payload", "value": "4f452e20d5bba54bbd436e641022926d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342102, "uuid": "ef66a0f1-19f5-4234-9583-f3b9b2acad6a", "comment": "Malware payload", "value": "80ae90f9e381312d6f04cdd94e6275f1094a55779b9b2d8f034cafe41d74c963", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342102, "uuid": "ba86d7d9-7bb7-4e88-8692-389457276660", "comment": "Malware payload", "value": "4e6647ecff374bd738d03d491e1da08c94369f70", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342102, "uuid": "29bb789d-26f8-4263-88c8-443837e1c8da", "comment": "Malware payload", "value": "5eaf664f403eb5e0dc1d828bc29221b26f7fc5def1aa460492bd4568cb9a307fadaeea90227a8e52a920297dab577ea9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342102, "uuid": "259fa29f-3a01-4fb9-83a0-047962af1375", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342102, "uuid": "bc6d111a-2be2-4db6-b53f-89e3568681e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342102, "uuid": "70d5f9ea-e346-4bde-b268-6f14875585ab", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342102, "uuid": "9f0ea3c1-4b42-46b1-85a2-3ac4806add63", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342102, "uuid": "18c13852-2672-48c4-b6a6-8706aff0bc8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342102, "uuid": "d963c1a7-6096-48ed-a39b-9d79dd973937", "value": "4f452e20_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f78bdc7-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338763, "uuid": "259cf466-9b75-459e-9b10-9890c0f5dcb4", "comment": "Malware payload", "value": "709965d1e73624987389aaa9e171553f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338763, "uuid": "e8489a2e-9134-4da2-9246-0f2174d2e680", "comment": "Malware payload", "value": "80d68588aa15768e30a04825081f66ad2f50f036626c62623e411032fb483428", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338763, "uuid": "436274be-9d30-4a57-967f-1fd139c1ac18", "comment": "Malware payload", "value": "5227cb33838656b985efbd0dafdfaa91c492bf69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338763, "uuid": "61a2f067-ad08-42aa-a5c9-32cffabd299f", "comment": "Malware payload", "value": "5d53e55abfefe9b216d8e82ceab906bf795dd5a5c1cfdfb4431bcbb7be16a9294301bf83c697c81618ceccd56b97a065", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338763, "uuid": "8ded6b85-3e5b-493b-9aac-fc353a0260b0", "value": "CDF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338763, "uuid": "ea50977a-06de-4ed5-aa2f-0ec15dd2cfa3", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338763, "uuid": "536b68ec-1e59-4ed3-849f-ee2f7ffdeddf", "value": "3072:nOG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:1ERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338763, "uuid": "a0a14614-0803-4c49-b6c2-4c46f4e7cdf8", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338763, "uuid": "46ea06f5-2a9b-45da-9d63-edff5a9364ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338763, "uuid": "a786a4b8-3c81-4af4-8495-696ed9345f3b", "value": "709965d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b09fe3c-aeac-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1620334004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334004, "uuid": "e7f95991-b140-4460-9dcb-76097abcb44f", "comment": "Malware payload (FickerStealer)", "value": "22a92a568fc21beb4ede99712fb38c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334004, "uuid": "763e05bb-1186-43bb-982c-21a7b0d945b9", "comment": "Malware payload (FickerStealer)", "value": "80f4e35d825fcd2816deb95b0a2694203238b769cbf6267dcca8d10d6e1394c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334004, "uuid": "a88a6e44-3b94-4608-afe4-018e178aeee2", "comment": "Malware payload (FickerStealer)", "value": "b64ab3f50c337b0de0df01c388889fd4d6065fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334004, "uuid": "1abcd2ae-d72b-4028-9a1e-d5a038a3ebbe", "comment": "Malware payload (FickerStealer)", "value": "020b4b0b2da815374ccb13ecd0540cf40c33f151df8b8606f9099945ec6e37103f47ea8fcedff92c88316c7efdc90230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334004, "uuid": "d163541e-0d92-4ceb-8dac-6b1b4aa62f8c", "value": "2E54D00179D0C476C492767A4C12DBB58EFEB861A9620E8F7BD80ABD5F147D1E72230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334004, "uuid": "ac6b28d3-0ef0-4c40-a65b-75397aa3578f", "value": "30bed5e9d92bd8de5e13f2991927fa2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334004, "uuid": "1c160fba-4a89-4278-ac45-7a7f559babaf", "value": "6144:DKXsLMIPq8wc9DD4RPLFcumXHiTIGCBrz0H/8v7zc:DK8AAq8FIPLKumXHg8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334004, "uuid": "f4c3b287-6447-491c-9728-b8603428c243", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334004, "uuid": "ce722743-bdf4-4ccf-9e97-c2e14a841df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334004, "uuid": "72e35a80-fa5c-42df-9ea3-096dee21086d", "value": "22A92A568FC21BEB4EDE99712FB38C80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1585804-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295252, "uuid": "9660d00e-423d-47d0-8a09-adfe8d48a8d5", "comment": "Malware payload (Dridex)", "value": "080f678a0f4c919867e50577a3d7f196", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295252, "uuid": "f6fc06bd-aa9c-4b3b-8437-be538000e5de", "comment": "Malware payload (Dridex)", "value": "80f51f079c367faf0356d6d982fb3bc73835dbddd0f1e2258c49f5588064d71d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295252, "uuid": "b2ac25b6-1de6-4a35-b0c1-7d64568a2650", "comment": "Malware payload (Dridex)", "value": "2372ee73daf2c94de9e7a1504e417d59c1d82470", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295252, "uuid": "8155f052-4cb2-43f9-baac-7bc378cc76e6", "comment": "Malware payload (Dridex)", "value": "7ac1d8d85476da80c7db67cc613018a6eb4a4acf03fff198ebe720c0aab0c7a6fdeff632379f33b5f7c5c15cee2c7bd8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295252, "uuid": "bc229ed6-bc7f-4d7b-86a0-0afd089c62a9", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295252, "uuid": "f671ef2e-6cd7-48f2-9ec7-69e263bb28d2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295252, "uuid": "74e1d5eb-30c9-4e03-b819-c08ca6e7e6d0", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295252, "uuid": "06f70be1-af54-4507-8396-8a0066382a1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295252, "uuid": "bf327cd2-acd6-40d6-a724-1d6a65af3946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295252, "uuid": "f2a0d822-2480-4ba3-b9e9-f91ea3daba4a", "value": "080f678a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859b90c5-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339310, "uuid": "70d7bd45-a316-4fa2-9c78-dc50d4a08162", "comment": "Malware payload", "value": "96ddfe24b3f580c612b63be15c008e0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339310, "uuid": "43b089fd-dcd2-419f-ad94-e5e543bcba78", "comment": "Malware payload", "value": "810bea2c9dd1d9012ebe0715ee920c70f536b1db2a2719c1d28d3cbed312a4f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339310, "uuid": "23a9c85c-34f9-4ce6-9602-53c0146b5c63", "comment": "Malware payload", "value": "5188cada9c1ba0e21b24f7fde5f2e676e3b78a6d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339310, "uuid": "5d0e6a0f-f7c5-497d-b2cd-8bbffcfdf268", "comment": "Malware payload", "value": "826fe7ba29279267d8f07407eb1773522323dfb61c80260357aad689d07e870758da8e01f50fb6967fda8263df7f2000", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339310, "uuid": "5b9054b5-3f0e-4524-a078-c298a2da390e", "value": "40F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339310, "uuid": "02264c95-fc11-42da-a40d-e76a8abd60ab", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339310, "uuid": "1a259880-4fb0-4130-9987-db642cf75eba", "value": "3072:0YG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/iddX:iERMVPG6+Y63HoG1QawL40Prx6KjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339310, "uuid": "b26c9b76-4f68-4fbc-a27f-b3cf2bf2b9a0", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339310, "uuid": "1cb720c4-d5b2-4176-a215-dfcb80d577b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339310, "uuid": "f82cb339-6e29-4f21-88c5-fde7c45e2c53", "value": "96ddfe24_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc15b6d-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320590, "uuid": "34c57339-6491-4970-9523-a2e1cacdcdca", "comment": "Malware payload (Dridex)", "value": "e36064311bbde048e790fa53fa752e75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320590, "uuid": "b0e533d9-0b1f-4302-916a-09d5bd8cd749", "comment": "Malware payload (Dridex)", "value": "81602882088848f472b823fa900020fb49d24139807df0135894a7709fe4af32", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320590, "uuid": "368274d9-4538-40b5-98e2-f180dd0eef40", "comment": "Malware payload (Dridex)", "value": "52bbfa2ecc22ba85606549c7213b600c32d6ea9f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320590, "uuid": "027b5ae6-0c9a-4b92-80d4-2d7ab3621766", "comment": "Malware payload (Dridex)", "value": "68ee7fc1bd59ea7f7ebc4dc1cca5a579dd3d4e03c03b980d840b5717f11ed2833abea3b6860ffaed56fb907c06219c4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320590, "uuid": "33b107cd-e3bd-4fe2-aa7e-213b31217c82", "value": "08F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320590, "uuid": "0fa75169-5ab7-4160-aa04-dbd471c761dc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320590, "uuid": "36444b86-8274-4c74-8858-1e2ad18bab9a", "value": "3072:5e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:I4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320590, "uuid": "3b671a6e-bb38-43b8-a1d0-d3dc2692519e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320590, "uuid": "87aebd9f-f2f1-47d0-a388-7d3a8a09fbee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320590, "uuid": "8bb6d443-1ed9-43c9-8d98-0757fe6cd14e", "value": "e3606431_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7442c9b-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280955, "uuid": "5a4f1b16-13c4-4645-89a7-d236d579198f", "comment": "Malware payload (Dridex)", "value": "235d31919abfd29b0a476eb5c22068bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280955, "uuid": "48960000-1d16-44ca-8562-23a585bafe35", "comment": "Malware payload (Dridex)", "value": "8179ddeddf9e49a2bad8b98f92fdf193c955d09137b7a4b32cf48f264ccb88e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280955, "uuid": "cae710de-3085-4243-bd9b-7a243b22c602", "comment": "Malware payload (Dridex)", "value": "28e7c819cafa63d2e13b39c7a94d432ccce57baf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280955, "uuid": "4fe71141-06fd-4e05-aafc-677cb2fd180b", "comment": "Malware payload (Dridex)", "value": "5cfaf91b5f6898307d49c91e718eed4612adc0969c60f80f19fed9b77767ad9fdaea216326ee77e3d3fcf50153d5faf0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280955, "uuid": "ccff3227-7180-4066-ace5-ee477e05b7b9", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280955, "uuid": "eabd5e09-f5c5-446b-84b5-fc9b47bf8f77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280955, "uuid": "4916332f-765c-42a2-8b97-17f90d2b6017", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280955, "uuid": "6cbccaf4-1686-434d-8261-a60e45f0f5d2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280955, "uuid": "bfb033b7-40d6-4cca-9a7d-665fe19b57dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280955, "uuid": "bbaa7a19-8e84-4dd4-aaa8-2e499d422c16", "value": "235d3191_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0747a9a9-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324066, "uuid": "552b4463-8c8e-430a-b2bf-046a01f05f64", "comment": "Malware payload (Dridex)", "value": "7b5b98ef2151e4f96af1004e1bf1b2ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324066, "uuid": "e6a1b5c2-12fa-4fd7-b509-8b5bc2201461", "comment": "Malware payload (Dridex)", "value": "8184a148bdd154efb5fd992dc058832d0b294d8544f4944cc53c4d46f4aac4a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324066, "uuid": "84b8c72c-60ff-48da-a826-c1e9e83545fb", "comment": "Malware payload (Dridex)", "value": "be6e8678e9ba8f5dbef47c0a1ea918065d07e7d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324066, "uuid": "8d4a5d2b-ff9b-4b1d-b4a5-113633ab803f", "comment": "Malware payload (Dridex)", "value": "76263dec40905d84e42320054a586fac9a916c096bbc97feeca2379ba33f2392b63805b3d96ee99abb245672022255bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324066, "uuid": "e3ce0047-e91d-46ab-bebe-8c6469811203", "value": "D4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324066, "uuid": "2d279657-0df9-4a33-a464-4358984b2554", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324066, "uuid": "94861b7c-fe30-4d2b-90e3-0d79e832c042", "value": "3072:qiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:peAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324066, "uuid": "b35e85bf-4654-439c-b5f9-5285cc0695cf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324066, "uuid": "302b1f30-1e8d-4fb0-897a-9dc316006b9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324066, "uuid": "e2aa5e0a-9814-4382-ada3-73cdb5f87ddc", "value": "7b5b98ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d2f40f-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277266, "uuid": "1e59f31d-ff48-4c93-8451-ffc9d544f4b7", "comment": "Malware payload (Dridex)", "value": "1f077728a1755547673584999df58230", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277266, "uuid": "c04b2d26-4e5f-4618-8ab4-9c39a6f597e8", "comment": "Malware payload (Dridex)", "value": "8186dce772635928fb63639fd9f64ab8092caeb05a69da76d232a560c7255870", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277266, "uuid": "5ce27d04-a6c7-4584-88a8-9dd8cac64f95", "comment": "Malware payload (Dridex)", "value": "7b244fc734f538cf228a2b6d0b0ede1702fca0cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277266, "uuid": "69cd21b8-9664-4c07-ae3d-f486094d4510", "comment": "Malware payload (Dridex)", "value": "02ed79c4ea8adb26ba4768c5b0f621cb17dafc6bb1f9a0f865731f61cd964f409a9ab8c49cd4e7a409adabcfb083db37", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277266, "uuid": "058ec5d9-7708-4ca3-8e62-c5db89b2b076", "value": "30F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277266, "uuid": "7c4308db-bf1c-470b-86eb-41a205f28c5c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277266, "uuid": "d445b517-046f-431a-9f69-2828486532ed", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277266, "uuid": "d067320a-69b1-46d3-8811-e46faee2db57", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277266, "uuid": "66ee7e6e-6633-4676-8cf4-a240d01a82f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277266, "uuid": "c353e25a-765f-485d-a6c5-dad958d51672", "value": "1f077728_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d682ec72-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288335, "uuid": "e6109e70-43a5-4227-8799-7aeca828b4f8", "comment": "Malware payload (Dridex)", "value": "c6466b9624fc9602053faca528940e5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288335, "uuid": "cb075009-4c35-4d1e-9e99-2a5a0a75a3dd", "comment": "Malware payload (Dridex)", "value": "81ddec465b10f661e05952e838d8fa17800d31c042dc38cda39373fea5cf5808", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288335, "uuid": "b99ba9e9-2569-486c-87cb-a7be17ad26ac", "comment": "Malware payload (Dridex)", "value": "9833de9f1873a0ea073e34e014441559dabaef31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288335, "uuid": "d2f30c91-601d-42e7-9d65-c8ef7dc1a995", "comment": "Malware payload (Dridex)", "value": "8acba8895bf2ffa9efee9cc3be0e11281914541fe81e7a4c42b8eaf4829b58d689339e4b17a1be1aed48dde934ec6539", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288335, "uuid": "cd1ab815-f614-4e49-8416-6b3646e6bce7", "value": "C9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288335, "uuid": "13869af2-5cbf-4159-a440-e80aaa1683a8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288335, "uuid": "b4680bf2-340a-4fa7-ac20-0a6901ad56b7", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288335, "uuid": "706dbee7-44c8-43c7-a7fe-bc3c692fa041", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288335, "uuid": "ea8c5392-3a02-433c-a687-45cf5d65d1e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288335, "uuid": "4a2901f2-f5da-471c-b768-e9826240f978", "value": "c6466b96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77d1d4a-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339420, "uuid": "eb35250f-30b3-42af-9b8f-9cc6695d2199", "comment": "Malware payload", "value": "818b25086dcf8951734bafeacde79eb1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339420, "uuid": "4bb357bd-ef23-4000-8c74-5d9a2f048b73", "comment": "Malware payload", "value": "81e855128b173f7ea0d3a0557862167650dcfff14f2da1c843f452fa0ab88ccc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339420, "uuid": "0a7474c9-c7e9-4994-b65e-4925417c9148", "comment": "Malware payload", "value": "00c31acf12d615495284d495f917d41680b7fd44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339420, "uuid": "cc00e339-4c03-4c73-b2d3-7bcda6c89ffa", "comment": "Malware payload", "value": "f97a459ec995b37e44c3a38a9c9c91275535c066421e7d3816974666d50e834dc7d586413fe6ae98c514b31be2ce54f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339420, "uuid": "9a7b2092-8a90-4f64-84b1-06cf4d67a00b", "value": "38F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339420, "uuid": "25764a9a-1fb1-41ca-945f-4d904acf5c33", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339420, "uuid": "494700a7-4cd2-4964-b62e-967a47ca0d35", "value": "3072:XjG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:iERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339420, "uuid": "c9af4765-2c01-4c60-9feb-22196b2eb7ea", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339420, "uuid": "91ca6337-02ff-45e1-9cde-9a87b5ebb465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339420, "uuid": "2d817958-abb1-403e-8ae7-4ab45bb36072", "value": "818b2508_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38319fb-ae67-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620304651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304651, "uuid": "b1e3de31-2cb2-4f19-9206-6a87c4a4f394", "comment": "Malware payload (AgentTesla)", "value": "ee7c05c530262450d2c5ace98ebbf8bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304651, "uuid": "a04e8070-3ff3-4934-bc8c-01121ca3519d", "comment": "Malware payload (AgentTesla)", "value": "81f18d7043fe45aff8f00823b709dc0e0de30d0bb4a7eff9765ae0aca64b246a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304651, "uuid": "c77eccc7-96f3-46ae-abff-df5b023241e6", "comment": "Malware payload (AgentTesla)", "value": "01a2dd508cbee4a77fcef0c8cfdeff78d8d22653", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304651, "uuid": "6373bb39-01bc-410e-9f40-912fbf183681", "comment": "Malware payload (AgentTesla)", "value": "3bbd2a0aa786ff5ce10dad8cffbdb02a4b0ed217ff4fdd3a2eca24fa86f41285f86dbd1514436256a38dd57940255d52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304651, "uuid": "73863ac4-c2e9-4952-a004-8e27d8cdc842", "value": "59156AB8766464F6D3171E7263DF4C0343A52270B92AEA4E9F6013BD4A53F132F3598A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304651, "uuid": "6cf0781f-168a-4a1d-a552-e9209cbb2bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304651, "uuid": "9176185d-8e1f-4cd0-9e62-9ba7892e9f3d", "value": "12288:xgoLLoS60/K7yh0/Gt5TapEdX/jbLI3ls0NYclrzApsh/638PGY46srSlP:CoLA/Gt5Ta+X/j/I0yRhG8ub6GSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620304651, "uuid": "c3bce516-1f32-4dfd-987f-24d001b71ea0", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620304651, "uuid": "104416c9-0c34-45b6-af1c-ec86bc5954ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304651, "uuid": "f883acbd-671e-41c3-b5cf-3be845bb810a", "value": "Sample_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05809c03-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620298722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298722, "uuid": "ae0a0334-c7e9-4940-8844-e3fcb81d86e0", "comment": "Malware payload (Stop)", "value": "c9521c0437497e7b7af255429a93c8b2", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298722, "uuid": "5624a978-d69d-42fc-a5e7-2c291299f9d4", "comment": "Malware payload (Stop)", "value": "81fb516d3efaf5c684ef50221e3f4bfb084b0d718d59bac7f6bbe8ea4c632f27", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298722, "uuid": "f5f9f3d3-4835-4090-9e4c-60721f97dbc5", "comment": "Malware payload (Stop)", "value": "95da658589e8447a1a06908abb3def7d10c3901e", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298722, "uuid": "a0d0aee8-1f00-4863-8c9e-6c225012eb06", "comment": "Malware payload (Stop)", "value": "44c511aa29c4dce15c2bd7e91e99e6b09507bd8412061e02269527c212bc4c29d1812ea6f4a13dd009b78b56231681de", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298722, "uuid": "ad32d968-629a-4022-93df-59b57f70667d", "value": "981512A5F671CA4AFD1301743C5298E1CD073B97EB9404FE248CBA5BEA65018316FF6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298722, "uuid": "9a642016-b1e2-497b-b0e3-6febd9e49aed", "value": "ef8bfa67cab8f52c3f5ca31f772f6178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298722, "uuid": "55f0d046-5edf-4bd5-8b18-8ccfa16b1c31", "value": "24576:bhPfM0uupZYB58aJ31X2NC/eAGbfRxRzyP:dP00uQYblJlXFWRbp7z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298722, "uuid": "87e7a245-ca55-4f49-97b8-e2b5251466bc", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298722, "uuid": "e6d8caf3-66dc-466e-bf45-e099ce1de353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298722, "uuid": "daaea81d-c5c5-4354-bc5d-122bfe059cda", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7417ba-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309663, "uuid": "62ff7d5f-ed9d-43da-8e69-32fc1505aee3", "comment": "Malware payload (Dridex)", "value": "7179660e6963c21b26ec17a10c2ac8c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309663, "uuid": "b04226cf-c68e-47af-9bcf-ef97e6c2f8e3", "comment": "Malware payload (Dridex)", "value": "81fea97b0fc7750b08bc838838c83502f054527a6085c29d424735c02702d056", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309663, "uuid": "02c22c70-5ec3-44a7-b55b-7f9a34007658", "comment": "Malware payload (Dridex)", "value": "3a3fda0185589e7b7c9dd3a33e2214f9a85b2571", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309663, "uuid": "bb832b76-ea5e-4210-8238-b9a50dd41d45", "comment": "Malware payload (Dridex)", "value": "9aff1404b731378ed965976aa5fe2da3637080b4986d6a76397bd0da0c23a8d990edb42446b177f26922f777b3df5bd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309663, "uuid": "f96f72c1-dfda-477e-8514-eba443ce36db", "value": "CBF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309663, "uuid": "ad4d790d-2a76-4d0c-9f12-c450e46eb8ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309663, "uuid": "f74f1d59-e875-49ec-ac5d-397c552085de", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309663, "uuid": "22bee725-e9bd-4195-a782-dfda3a9ee215", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309663, "uuid": "393b3bcc-112d-402b-abe8-ab004b8c03c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309663, "uuid": "1483ab0e-77be-41ba-a662-b620f6e69314", "value": "7179660e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f01919-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339258, "uuid": "a6304275-3d4e-4553-b9a4-cc58400ab783", "comment": "Malware payload", "value": "c46a51f9ff1ec3a2390af9f36765c625", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339258, "uuid": "3b686fd5-f73f-4468-aec7-3185344e1631", "comment": "Malware payload", "value": "8236a47b2230c5cc9df745b9ee7c418a0ddf8c210674009c889f0a75c33e08c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339258, "uuid": "bc050aff-3242-4786-968d-5a9be5ff7304", "comment": "Malware payload", "value": "1911f150ccf37c7d2bfc176ead2d8f76360257f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339258, "uuid": "a45e5a9f-9c28-4ad8-b42d-73cf5a557240", "comment": "Malware payload", "value": "00a9d65cfce5d6c6064185ff2845302360b756a77195673e01fed6b463c5870c00d946e6edf4dd9832caf0e1bf6179c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339258, "uuid": "61e40186-92a6-4d3c-9322-223d72d56507", "value": "20F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339258, "uuid": "2918300f-99b7-44ad-8242-26fe0782865c", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339258, "uuid": "33e243fa-7caa-4e19-b44f-0dc45a38b872", "value": "3072:b0G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idWR:XERMVPG6+Y63HoG1QawL40Prx6KYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339258, "uuid": "21cb05aa-3a61-48a7-a0f1-9a27280952a7", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339258, "uuid": "2714a7c2-91a4-4752-aa23-83e8a6dfc8c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339258, "uuid": "9fa91997-83f0-4c83-a317-fa885dcc5ab2", "value": "c46a51f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22b12c0-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339411, "uuid": "82488221-c0a7-4698-9dee-58887da8c182", "comment": "Malware payload", "value": "3564a012b05d1e0d31e7a8e8e8b062d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339411, "uuid": "6145129f-57b6-42e8-9fc1-7379f27fcf59", "comment": "Malware payload", "value": "82c6237b1337c4eacf9a9d185317cf4aa80e8f5b925413e599a395558c882459", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339411, "uuid": "3ecfe7a7-1a02-417d-9b6a-2a6c1374c93f", "comment": "Malware payload", "value": "19db09b0afbb9caa672e6b097860df7f89244c1a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339411, "uuid": "7ed94ee5-b55f-4c71-9f09-78d78124ab83", "comment": "Malware payload", "value": "1b58ece34422b20de8ad4e3d7bb55dd48df617dc7945777e87bc5c29f52765cb9cf9b149ce5de44eae3094f2a063adad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339411, "uuid": "1dcae73b-9962-4afc-8298-6b28978c31a2", "value": "D6F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339411, "uuid": "cc4cd373-2ea4-4392-8be8-f769ab773e41", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339411, "uuid": "71acb707-f395-4661-b18a-57c9ad3aae06", "value": "3072:l0G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idWR:ZERMVPG6+Y63HoG1QawL40Prx6KYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339411, "uuid": "7924227e-161b-40ce-8d02-09148549e3e9", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339411, "uuid": "5bb063a2-2721-429d-b122-5ed752d42e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339411, "uuid": "e31567fa-02b6-46b8-83ae-2c0833126e2b", "value": "3564a012_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c550a8a-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339160, "uuid": "9265a5ba-e15f-46fb-9c7e-6b6ea2a9606d", "comment": "Malware payload", "value": "289489e3eb7681d4b3b8758307e3b870", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339160, "uuid": "5e1d4fc8-1b58-440e-82a4-ca7b99ed3e1b", "comment": "Malware payload", "value": "82d570668a6712279a311680c36acb4496ec597dc17bc75649f996aefaa8a4ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339160, "uuid": "df2a8005-bad5-4aaa-bb4d-f221973ec823", "comment": "Malware payload", "value": "9e8a89b51bee2cd242db218925fb4169ba66fdc6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339160, "uuid": "b9c933bc-51e2-4b66-8c8e-b2e9925e7bbf", "comment": "Malware payload", "value": "aaf92b23f7847fdea3342cd3534181916baaac6233351580e65d91814f00680b70e0d1359a5e452ed4a8526a51bce0f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339160, "uuid": "1a75b09d-50d2-42fc-b5b7-4b0929557bd2", "value": "73F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339160, "uuid": "3d0d9669-7da1-4434-b792-83133d0b02d3", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339160, "uuid": "8586f754-301f-4fa8-b423-c1dc7bb8f719", "value": "3072:dQG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idGJ:xERMVPG6+Y63HoG1QawL40Prx6KEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339160, "uuid": "ab4a95ab-4c80-4394-a911-c7babfed6965", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339160, "uuid": "2d8bce1a-daf6-446a-9431-7f6c685f26b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339160, "uuid": "4ba5da92-dc9c-4e09-b6ba-99778732773d", "value": "289489e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cd1db5-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339194, "uuid": "55ce6e7e-5667-4bf8-9c2f-f836a53ff7b8", "comment": "Malware payload", "value": "e4861fa791b8fb219e41c0390d5aa039", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339194, "uuid": "76df35ad-113a-4078-8587-c6142d15f43c", "comment": "Malware payload", "value": "830512bab1ab525de3564a6cbcb25a9428c4626803bbc23adc0e4171d7f3e7c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339194, "uuid": "1eb66391-9314-42d9-b1ab-652d5a886e55", "comment": "Malware payload", "value": "afe10e154720322412597cff49babeea2048bbd7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339194, "uuid": "e03816f5-5ead-438a-80fc-7a14ca6f8f82", "comment": "Malware payload", "value": "b1ae8e402e148d92469f64b237656e89e2db9aea1bd23bf460f4868bf4c5f0a8a09b1f4e1d82067e2b3441abfc59c08e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339194, "uuid": "0a577ec5-29de-482d-948c-328cb5aeb1d7", "value": "BDF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339194, "uuid": "8f576da9-af73-41fe-bcea-b14b7d538573", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339194, "uuid": "d6858243-1f4e-4d4c-9e87-fd6c4f55309b", "value": "3072:UC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:J4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339194, "uuid": "b8604a95-1a77-45e1-ab54-e26fa66dad1e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339194, "uuid": "8a87a56c-3d66-4d90-a9aa-6abab158d5ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339194, "uuid": "ada4b969-7bbb-419f-b97b-b21961b7565e", "value": "e4861fa7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c7033f-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339094, "uuid": "e6e33215-b633-44e8-8ca6-25847e1660b4", "comment": "Malware payload", "value": "ce11f1e5fd4bc37ad42b2b05d7d38d84", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339094, "uuid": "a1eb84ac-bfaa-40b4-9c89-bae5e137b160", "comment": "Malware payload", "value": "83089d8d223574c86b8ab78a432e1e8c973b361d2eef2e1729a520ef1466609e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339094, "uuid": "ee96d21f-2acc-4842-9a98-552cf02d8aed", "comment": "Malware payload", "value": "5837622baa36d2c53b8639f8821176d938872afd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339094, "uuid": "7cb089ea-80ad-491f-b3ec-e2bce4c3985b", "comment": "Malware payload", "value": "6e27da02130df2e65a478cbe22db537a0a9aa0fa50a49735e3d65d594a284901b92b2c97cae01c8419626611210c8e24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339094, "uuid": "53018bbc-9364-4ab4-9453-0808968501f2", "value": "57F3C004D167E6D6C51A583212EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339094, "uuid": "0a6a4e2b-ae82-40ce-aac4-39b736556494", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339094, "uuid": "b07fe131-176c-4631-81b9-95cc669d71e4", "value": "3072:HVG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idyB:kERMVPG6+Y63HoG1QawL40Prx6KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339094, "uuid": "69de0792-e30c-4eb7-b083-b36b330143fb", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339094, "uuid": "7d6f878b-227f-48f2-a623-20c2bb51aa4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339094, "uuid": "ca6b9c3f-aa3c-4d62-be76-36b314d78ef0", "value": "ce11f1e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514eb732-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620270073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270073, "uuid": "6ea5350f-f6f5-400e-9bc5-dceaf74073a6", "comment": "Malware payload (NanoCore)", "value": "eb28f275f37ea2b924d62f03a28a6a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270073, "uuid": "90de021b-62ca-4e67-9327-0f8e157a2ee1", "comment": "Malware payload (NanoCore)", "value": "83196e763a2e2a7415896d9ea61b507a57cd8e22e39970edc25328b887098301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270073, "uuid": "abc0a8c7-5fb2-477e-88d1-c6fe577a92c5", "comment": "Malware payload (NanoCore)", "value": "8c3771e581925848c5f93807f28a214b4d0411a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270073, "uuid": "5c7764f0-f945-40a2-a113-baad51c530a5", "comment": "Malware payload (NanoCore)", "value": "2e69c4de21140e70ecc22c13f96c1abddb58c9392c8979a968dd3b6a467d773cf5867c5d9cef519ec2bf4e019c8b7dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270073, "uuid": "e1a77d4d-e0b0-47a9-b54c-23f11a439c70", "value": "7C35BD2266989924D53B27349522C13847F6BC03D772C60DAEE87CDB3B776C1AA67313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270073, "uuid": "78ca0fbe-127f-4e27-9333-c8947200f1a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270073, "uuid": "6a038181-321e-43bd-accd-1e6f877f297e", "value": "12288:5WLo2vPpelKf112gy4cqJ+odgWqhSAfFxQRAcdtXDj/EqYPbbk52Ye80ksDM:FIb2ijj8fFxQRTdtTAqMb452YHrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270073, "uuid": "426ab62c-27c8-49cd-bee8-f9d19dd672b4", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270073, "uuid": "e4fe2d87-bb9d-4c66-8960-6fb2b90a85e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270073, "uuid": "d6b10c37-451c-4fdb-a460-2a4e5edd684a", "value": "Payu forms.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ff2f65-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338901, "uuid": "c7ff7f56-6336-43aa-a99f-fb0aa8aa11d3", "comment": "Malware payload", "value": "cd715d235979ef30bad16ac30ba1cf35", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338901, "uuid": "5730b994-1cbf-4790-ab8e-0bd4b5562558", "comment": "Malware payload", "value": "8320ae4a5f2278e737d6c0485eb9ee0e929d9d07ff788b7a297bec23fa00e670", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338901, "uuid": "bd9dced2-c12c-4e04-ba70-f67b956bfa96", "comment": "Malware payload", "value": "1a59ffb029dfb7c4287aa456fd8943f221c61ebe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338901, "uuid": "7dcc323c-a689-4163-aeda-e345ffd26644", "comment": "Malware payload", "value": "8b8da74a2709e880910203d89003af8c9556e4366527527bc383174ba42fb8571a821cce8f344944c67dba7ef8a6a887", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338901, "uuid": "9b35abbf-a5fd-4baf-8d4e-c912ce043865", "value": "B5F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338901, "uuid": "70431cdb-f5dd-47bf-b89c-9d0023409876", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338901, "uuid": "c6f93cc6-690f-4f44-90e7-05f30c00c14a", "value": "3072:qC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:74KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338901, "uuid": "9c704c9b-6d6c-4b6a-b3da-57ee454be836", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338901, "uuid": "72b51c3f-d0f3-45b6-a082-2b98081c2e40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338901, "uuid": "70485801-c7d2-4409-a480-7907ff8ccfd5", "value": "cd715d23_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010ac117-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339087, "uuid": "7f458b3b-1cda-4c2d-97d1-587d43984115", "comment": "Malware payload", "value": "69dff0d63933acb39853ae1a1876d12f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339087, "uuid": "1f99aabe-6f37-4970-a2d0-c8faaaa553ec", "comment": "Malware payload", "value": "8328c8e92889e2fcb4b4bdc86489fed7c54c8eea75c1c9df7ac1c7523b045462", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339087, "uuid": "7f0df228-9b8a-4290-a051-9f74e79af0e9", "comment": "Malware payload", "value": "fac2ebd0779a0305345269c2a26ecb1ab31fda01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339087, "uuid": "4b416461-ea2c-4bd5-bf68-c724dcba7893", "comment": "Malware payload", "value": "ee367db1ac7074e9d8a701cf569565c3a6ef424369828b58cc46525b4f78c69253c40bb7170991935d688ec63cfd24a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339087, "uuid": "702d3a56-0c5a-4e5e-80b3-23efe6417f8f", "value": "5BF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339087, "uuid": "dc89fbd1-f174-44a0-9677-ff04c269c718", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339087, "uuid": "04f28743-6b96-4799-aec1-190faf8cbfb2", "value": "3072:NiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:PERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339087, "uuid": "3e7cf7e3-f1a7-405f-be37-936c925e7da0", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339087, "uuid": "6a3860a9-ea1f-45ad-84cb-ef9d28fc22cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339087, "uuid": "edcba09d-3af6-49e8-ba11-38a862b5530d", "value": "69dff0d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23d2862-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339063, "uuid": "43877456-b457-4763-b40d-d5509a83bc0e", "comment": "Malware payload", "value": "5cc748781301c81a0fec8bbace4afbb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339063, "uuid": "d3913452-e1f5-4936-b4bb-3e69b95e2e73", "comment": "Malware payload", "value": "8331ee11eba097c260c4981ca84a04e9edd40bc7498e30a9ce526e931be0dd96", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339063, "uuid": "f3962de7-86a2-48b5-8a07-ddf7a2a03b02", "comment": "Malware payload", "value": "270c3e75555c24145e080ed2e2be5af26204a22a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339063, "uuid": "cb4a3e5d-2f46-45ab-a57d-698f3b0d8da2", "comment": "Malware payload", "value": "ae0eef94ae5269dbc3c5525f58839479988631c32d8383f73b9e365145f73a4b563e76a0c35296632c4965c30dc04172", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339063, "uuid": "8b7d47d4-7d70-4e82-8c3f-f15f693fe742", "value": "99F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339063, "uuid": "4f44d2fb-fbae-43f3-a7cf-ed387731a684", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339063, "uuid": "f99db36d-5690-4bce-8bee-7c9fde16694a", "value": "3072:fLG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:yERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339063, "uuid": "e024d637-9e96-4ec1-b661-00222c6d4911", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339063, "uuid": "b23f6ccc-1cf3-4afe-ab6b-1471f2d571d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339063, "uuid": "c2230a5a-62be-4f32-a2d8-10a08efda4a6", "value": "5cc74878_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb07b43e-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320609, "uuid": "719dd58c-9765-4dbc-926d-9c8a0d0239fb", "comment": "Malware payload (Dridex)", "value": "0442f8624e07d4b328f8657f2de9596d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320609, "uuid": "aae2e957-2055-4af6-9abc-e18497db5b54", "comment": "Malware payload (Dridex)", "value": "838a853e1d393e2a1f7c2755a45eabfc8826a04079a03383500361bb2dbb6022", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320609, "uuid": "37cac0c2-d2e6-4bc0-88cc-76090ff1ff74", "comment": "Malware payload (Dridex)", "value": "d0b7380948c040c14d691cc02e45bf2cb2384788", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320609, "uuid": "485e1a69-6b38-4706-9681-25e4e7f7a28f", "comment": "Malware payload (Dridex)", "value": "f3df51accd076f4503a554e205a491adf1ce7d8dc88819055a07681c011945396a3579e1ebebb0fb5c1c667a62fded03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320609, "uuid": "88e790d3-10d5-4482-8d6f-df77389e4c97", "value": "98F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320609, "uuid": "0d4decd7-bd93-46dd-b325-540488000052", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320609, "uuid": "2f9cef43-b8f5-49c5-ad65-fb987682b5d9", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320609, "uuid": "5280cd05-4a8e-4053-9023-30e790d5a719", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320609, "uuid": "edf018ed-46fb-4ab4-bad7-4a1c1805fbcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320609, "uuid": "1d0f2813-2a7d-48ce-9c76-2de8bc9021f8", "value": "0442f862_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf1e7fd-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339240, "uuid": "8ef9addb-0621-4a46-a375-36cb19367021", "comment": "Malware payload", "value": "3d86695ecad0f07b2de6eb8787e8bc11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339240, "uuid": "89fddf12-cb27-46a0-9c30-b21f0226ed17", "comment": "Malware payload", "value": "838e401f81ee486b279e0cf533e01b588a1105ae82d906cc38a8e4ed4791d033", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339240, "uuid": "6bf2cde4-e405-4d31-81d2-13ab01756f7a", "comment": "Malware payload", "value": "e079dbadd932e478f1d5f0b6328deb146cf91486", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339240, "uuid": "196cd039-52ac-4e68-9d92-88640e90f66d", "comment": "Malware payload", "value": "6dad426e89a8cfea32379987b1334795e32b2dbb27aa4c8b31f7e04890fec9bc7497e3375b6ee3277af9b65f582e1fc7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339240, "uuid": "cf6becbe-d5c1-4ca6-8fc6-4eb1df374f7b", "value": "B6F3C004D167E6D6C51A583322EA3B3BA6314150D748F885EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339240, "uuid": "99b7f30b-c214-4d5c-8740-e2f69e8906b9", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339240, "uuid": "6dd77986-ef9f-434e-a2ce-8b59b0c95e1c", "value": "3072:++G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/id9l:eERMVPG6+Y63HoG1QawL40Prx6Kvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339240, "uuid": "efc01322-bdfd-411f-bc38-15b5fe02345f", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339240, "uuid": "41e66aa0-5442-4adb-84a5-f863c0425197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339240, "uuid": "7a05b342-d9a6-4312-a249-2953887113d6", "value": "3d86695e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ca2912-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339476, "uuid": "0b85fdb7-c545-4f4e-80dc-28ff22e89d3d", "comment": "Malware payload", "value": "a39d0066fc08eabe601e5c4748d40cc8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339476, "uuid": "0f1757f6-e516-42c0-bbd7-049996a43c66", "comment": "Malware payload", "value": "83a337975d0a98653210ee4b509855f7f4a393e8ecef04f681f0d98e4096b3b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339476, "uuid": "f71bcd25-deb5-48b3-a477-fd3b74a62f31", "comment": "Malware payload", "value": "d347863aa86b89ffd1aa17aa2070c4acf57dcaa1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339476, "uuid": "31dd0508-7c94-41b1-900b-f5244b7bb30a", "comment": "Malware payload", "value": "d9d2630cea2e6ff1292042af8e7965adae01cc837e6aae9606604554d5519b2576bfd76ca76d409c9c4807f6584b47fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339476, "uuid": "0133f67a-86c4-45f8-8f73-e6c49a38b82e", "value": "13F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339476, "uuid": "54bce5f9-36b1-4881-9dca-31fe175eda90", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339476, "uuid": "1d52adc3-67b6-48de-adff-24b62570804a", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339476, "uuid": "c8bff6fc-9b83-4cce-a4f9-cb4bb06c115b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339476, "uuid": "d7313ae5-a638-494f-bf05-8f9143ce3527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339476, "uuid": "8bc35ed2-4eae-4e6b-bc23-c821b2229148", "value": "a39d0066_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711c0e97-ae79-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620312217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312217, "uuid": "a6143a10-6d4a-4d33-b61b-e8fcc2a41388", "comment": "Malware payload (IcedID)", "value": "b099701b7b7724a72a02fd847bc8fe70", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312217, "uuid": "177859be-58ac-4702-9847-3ad4cad4b244", "comment": "Malware payload (IcedID)", "value": "83dbeb39be0b373bc8ea3c34c2ea78c5750a48bc1ac7699c84890f30e8e912bc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312217, "uuid": "9baa0db1-b917-4372-a3e8-ebb9c53db549", "comment": "Malware payload (IcedID)", "value": "2385b9d3aa12d4c7ed4b8601cfeede5c445f0d1a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312217, "uuid": "7f201535-fd19-457e-ac43-5223f7b4b4cb", "comment": "Malware payload (IcedID)", "value": "04022def11b4ef86eb580c609cea1c3eb0bebd3d684f2274435c422e222734b7faee3e19e95c556a445ae4cbc2809c11", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312217, "uuid": "cfdb0933-6608-48ec-91b8-d1761a8666b5", "value": "5C732620AB699B80ECCA79375345CAB1D3324FD0574373E6FE6CBB4D2768981482216F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312217, "uuid": "1fc252cd-43d0-4d19-84b2-0b1301975225", "value": "1536:eFsrZxoCOkB1bTDkNnhipFnY5IE2vYjsRBFe0:eFSX3DMInY54vYjsR/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620312217, "uuid": "0d8cdee1-2a02-48ea-8c4b-69c414ee80a3", "value": 77738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620312217, "uuid": "e92b3568-ed61-4f3c-b8e2-ee2b0ee9927b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312217, "uuid": "296c3485-2b13-4b16-8d45-5b859a10fb16", "value": "intelligence,05.06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0eb0015-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331329, "uuid": "aa88f344-aabb-482d-9607-4bceed819042", "comment": "Malware payload (Dridex)", "value": "6742af217feafb33916854d298b30fe4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331329, "uuid": "b81e061d-8511-4821-9869-c08537345653", "comment": "Malware payload (Dridex)", "value": "8492a9c3aa41d5cdf04577bd2ea3dcee74b52fa1818efe61116e9d421f18a0c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331329, "uuid": "c6e0fd36-1594-4803-aff7-475c00389532", "comment": "Malware payload (Dridex)", "value": "0ce95a4670e4b68b20482348226fa8d681f60ee6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331329, "uuid": "384a9bda-880f-4ca9-abc8-07c87f343110", "comment": "Malware payload (Dridex)", "value": "b1c8bcb01f97a68f0be786183b30c624f9fb1afd781fca8ed7c061b170e26d92b0c47ff4b2435c76f83e29ee9dab1911", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331329, "uuid": "c01c4c54-c5b5-424d-bb35-6ada0e8bebc4", "value": "07F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331329, "uuid": "47e43bc0-6bf9-48cc-ab2d-74e8bec0b04b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331329, "uuid": "c36b3a01-0c97-4d45-845e-81f92e8fe953", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331329, "uuid": "9e0fce51-dba4-4b5e-9604-45db457efb75", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331329, "uuid": "98d954ae-27ac-4b14-a6d1-daece6666121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331329, "uuid": "be974fe2-fcfb-4d06-bdae-43ff7e133ef3", "value": "6742af21_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7811e65-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291719, "uuid": "cb4e055f-6e31-4956-9661-49f2754d9435", "comment": "Malware payload (Dridex)", "value": "dd8497788d23f058d92b0a58d40ced5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291719, "uuid": "52f6101a-2305-4138-bcd8-a3520db8d374", "comment": "Malware payload (Dridex)", "value": "8493a8d0950a138eba825f6777bc334131cf20fa67101256d2376407459f605c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291719, "uuid": "dad24114-6bc2-4621-b64e-d2d55717cd72", "comment": "Malware payload (Dridex)", "value": "6b3d8268461dc9214c50f6960948a995768d431d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291719, "uuid": "4fcc5f67-a3de-42b0-8522-dec08cd32dc0", "comment": "Malware payload (Dridex)", "value": "b7f1f3b236fe7c4052f7dda0d4aa68f8abd0c7738434c0e5d614bde93949af7e3dc660b7de30547f9cbf6b06debd276a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291719, "uuid": "9e68f7dc-7c0e-472a-81e0-8dabf34a8120", "value": "02F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291719, "uuid": "897f0fdf-a433-4306-b8c7-6339c911a475", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291719, "uuid": "fe737588-fe5a-4061-87c8-a14bc95c9932", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291719, "uuid": "dcf1dcd3-d20b-4f95-aef9-1f101836db0d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291719, "uuid": "c14e3ed8-83ea-46f9-b2f3-4b05a0fc86b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291719, "uuid": "ba45df90-509e-4f92-b5ae-de51ac307058", "value": "dd849778_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4946a5e-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309753, "uuid": "eac7fcb6-0d25-47a0-bd29-edabb85ee293", "comment": "Malware payload (Dridex)", "value": "1531176ab8279d78ebf3cadcd4f99269", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309753, "uuid": "161934c9-9e6c-4cf2-b396-493288aa219d", "comment": "Malware payload (Dridex)", "value": "855854c77254f1d59706a5e4553410de6d4992ba6874a92eca089e3ff45899fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309753, "uuid": "6128eef2-6774-49a8-bc62-3a45522cd3d8", "comment": "Malware payload (Dridex)", "value": "8726276c3d762e06f8aa7787fc5ebd0730e87f8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309753, "uuid": "17e27f49-cd9a-4bf0-8f04-f54a1d6d445e", "comment": "Malware payload (Dridex)", "value": "0cd48bbd0f219d331743ad5a0e02ed85e9876e1a920367c133a342b6cc45a6587a1d838db1a638cb5cfe855c142bb692", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309753, "uuid": "97e08275-7e99-4d63-8f1c-cad8a53d24e1", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309753, "uuid": "6d2044bd-fbc9-4d2d-bd13-bfe46c22c2e3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309753, "uuid": "a984c817-8e69-4004-8ea0-803cd3d766de", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309753, "uuid": "5b59058f-f9c2-45a9-8202-2474645c0fec", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309753, "uuid": "17632834-4a58-4e2c-bacf-745ea95ae968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309753, "uuid": "0fc6bcce-48e4-4092-8fa7-8767dd38d8cd", "value": "1531176a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afd1d6e-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339319, "uuid": "e9d66f2d-70e3-4b5a-bf57-9db76f429b96", "comment": "Malware payload", "value": "8907f12a76f318e1c24fe627a221396f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339319, "uuid": "3e9a2d12-d8a4-4693-9937-e020c5d6a3cd", "comment": "Malware payload", "value": "856ac4cab32656ba2caea443d04bc249c4dbb033c664c13bd435e4506675ed56", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339319, "uuid": "d16d6747-e63d-46e3-a174-b7f609325f63", "comment": "Malware payload", "value": "697eff60edefd503a99a7dfc28661552decc8ee6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339319, "uuid": "3d6b3f06-1c2c-4995-84cb-c35af98fd3d0", "comment": "Malware payload", "value": "1e49f8914db6adf86a20e924c626ec4f8351aaed43856fefe9509a02eca04dd443adec80c10c562201e25b03ba6c11b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339319, "uuid": "371b1714-53e2-48a3-9fd2-7b4b84a5daaa", "value": "22F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339319, "uuid": "84121525-a309-41e8-ad9f-ac61bda887a4", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339319, "uuid": "aaaa356e-f75f-4828-97fe-f6945eacb523", "value": "3072:RNG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idJd:WERMVPG6+Y63HoG1QawL40Prx6KLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339319, "uuid": "817005c5-9d32-4360-bb25-f2aeb0a577bd", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339319, "uuid": "8a25ce70-266f-42b3-a10e-31ab881d699c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339319, "uuid": "4f479ec9-d4e1-4523-8fec-760cd7d5bcf5", "value": "8907f12a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867731ec-ae61-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620301945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301945, "uuid": "2bb9e730-37e2-4134-865e-0f3625cc5a93", "comment": "Malware payload (Formbook)", "value": "a995d24b27548f0215eaa0d87dc140c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301945, "uuid": "b771c8a4-f0dd-4256-afbb-81cb16ea4b8c", "comment": "Malware payload (Formbook)", "value": "859db52a7e6fdf6f93350d27b7917853b8b88a2536721328ff60a98f59a93b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301945, "uuid": "ae5d9229-0611-4460-a147-84ff7b83c368", "comment": "Malware payload (Formbook)", "value": "d2adc518df40843623413b5d5310ea4069fdba2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301945, "uuid": "864cef31-fc86-4e8b-83b4-51e9cd80a862", "comment": "Malware payload (Formbook)", "value": "1c1ad04172883d83ef8f7603499dc5f011eef6c8d396d4dd600e8c6d56efde6d24be0226727740eb7a6b4139a6c6b5d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301945, "uuid": "da124e84-dc77-42ed-b697-436b69ca6e60", "value": "2B34122073E0D4B7C8D246701CBA5B3ABFD9A15441E5550B93889EFEB5137C31E2F2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301945, "uuid": "3453b1b6-d47e-48ec-85af-12a5cc40d1f4", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301945, "uuid": "d75903a5-7758-4c19-90ff-087218eba696", "value": "6144:L9X0Gg3eqVA8tWumewBycvdu5wGPTY+6hPW:l0V3Hr9SycleDPAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620301945, "uuid": "8c856850-54aa-4b53-b1cd-21869702c800", "value": 231103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620301945, "uuid": "9a83c2e4-902f-4a05-8fc1-e26f269d76a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301945, "uuid": "a60b6ad8-dd1b-443b-ae95-25452b0d651b", "value": "NEW ODER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857087d2-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316976, "uuid": "985de3b0-4030-4ca2-8517-f7cb1fa98e4a", "comment": "Malware payload (Dridex)", "value": "55a23b723c78178ee5b964c6f099309a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316976, "uuid": "7b5d4f27-857d-4327-9829-5b74b9f6a0e9", "comment": "Malware payload (Dridex)", "value": "85a1d1c598e4a25f6181683c245055e9c95e34c4c6486f847003de18924feb99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316976, "uuid": "14cd303c-5a40-41d1-9590-a6b0c09c58b5", "comment": "Malware payload (Dridex)", "value": "6671dfbe16ef3fdccf8ccad2d567c5ae08ac1739", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316976, "uuid": "7c5e7945-23b1-4cd9-9214-1b3f64083a48", "comment": "Malware payload (Dridex)", "value": "d1afce49ab6229957872672cb39474232a5018d6b5a8231d2ad5e88fd61d22cf73a1b0028187e63cc867252154b7eeb2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316976, "uuid": "11f84e46-4120-4c3d-b7aa-a042621f5615", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316976, "uuid": "ac8fbebe-be05-4868-97f0-647375c457d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316976, "uuid": "a26cfebf-3f2f-4291-8db0-a1a227b30571", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316976, "uuid": "ecbd1b12-953f-40b7-8b1a-f47022386cf0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316976, "uuid": "313d86d9-0553-4104-8194-feb8346bb941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316976, "uuid": "fb8d5915-1797-4cf6-9007-84a7a6465b02", "value": "55a23b72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906abc09-ae3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620286500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286500, "uuid": "13badf73-52a7-49c7-9dbb-b268780fbb7c", "comment": "Malware payload (IcedID)", "value": "1c6c7215d039881314d66edb35b389ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286500, "uuid": "6895cb9a-ca98-4d63-9c9e-cfbf957cd091", "comment": "Malware payload (IcedID)", "value": "85bb2d449a7ead4f54667826941269a4d87a980825a958bb10db7d6e72aae60b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286500, "uuid": "53b67621-3c81-46d5-9132-6fdf6e8b1eae", "comment": "Malware payload (IcedID)", "value": "cb1515790ba1cb352a3f4bc506452b678aec2ace", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286500, "uuid": "f1b42fca-dc65-4743-8d12-46787e66209d", "comment": "Malware payload (IcedID)", "value": "854767fc040292defa34e34328e27f8caf81076c50c42fc47a57b6c08ed269dd0c8895ce96944e33b5e8ed39938e89c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286500, "uuid": "874da8f3-edc8-4750-a737-f9ce67bc21ce", "value": "9CC35DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286500, "uuid": "ee621a68-37d2-469f-82b2-4a2cd68a90f8", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286500, "uuid": "2b24d686-dae0-47fc-9603-aee91abd8b5e", "value": 119398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286500, "uuid": "b9343989-c17b-4431-9242-cf0691a57365", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286500, "uuid": "415baaed-304c-4e50-81ff-4b6fd0085d5b", "value": "1c6c7215d039881314d66edb35b389ab.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b0b338-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295287, "uuid": "89e33f00-1b07-4daa-83be-b4bd7056eaf4", "comment": "Malware payload (Dridex)", "value": "85f389596533dfef6474880ffdba5058", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295287, "uuid": "56b23d5a-af46-4300-a662-716548470a93", "comment": "Malware payload (Dridex)", "value": "85fccf401ec88b561621c401b123b63ebb6f9608daa3cc5934ffc4b54cb220d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295287, "uuid": "6eb64d5e-224a-4e3b-ad09-ec74564d8d16", "comment": "Malware payload (Dridex)", "value": "7cfba200613c6c171c22558f9c497824a12755e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295287, "uuid": "4204d4e0-72bf-4438-87ee-3344564542eb", "comment": "Malware payload (Dridex)", "value": "0078b669012b043db6a7f5a79d9518a7358c7c15ef43dcf4af8859636cb736b12f70de8acb2fc3d9216e4ab967190f2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295287, "uuid": "4f404016-084c-4352-ba10-fafe0ed036e0", "value": "BBF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295287, "uuid": "df501ed1-5553-4eb4-8dc8-d388efe623cd", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295287, "uuid": "8a61f445-0e69-43c3-a442-0c8ebd7dc391", "value": "3072:ZWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Z42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295287, "uuid": "6ec315f4-68b9-4639-a509-d60bbc5d5b95", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295287, "uuid": "b2f80c7d-83f1-40ae-a58e-ede8004574a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295287, "uuid": "95a5b572-f750-4469-ab9e-5f5b5fc4b2a0", "value": "85f38959_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28d1541-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331332, "uuid": "b1aab48d-37b8-4166-839f-325a4770ef53", "comment": "Malware payload", "value": "9e58662533a0c345d2cf1a0e9570293c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331332, "uuid": "a497d8ed-b8b4-47c3-b6a5-56eb129118cc", "comment": "Malware payload", "value": "86071f8a676708680d143179cb29889c49b15b546fd2446e0c7e446f5db1d7e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331332, "uuid": "9f449bf6-39f3-4193-af22-81482c0f7917", "comment": "Malware payload", "value": "996e15acf4adeebc2263b33a86f81b08ba436809", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331332, "uuid": "1c6d1b56-7c3f-4aa1-964c-ed7f07c59ec2", "comment": "Malware payload", "value": "3e73a192bb081f567c519a7e43e85aa3c23941838381c5b7c76370ce9028985e462ed394e386e736d6c1a8f298246a21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331332, "uuid": "f14b6580-64e0-4136-be27-4496d22038eb", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331332, "uuid": "4a1840bf-61db-4413-9233-654acbc49abf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331332, "uuid": "62a21c0f-5a45-4e4a-b3b5-58ce8ae6d029", "value": "3072:gumNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gfLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331332, "uuid": "42eaf534-6f03-4b59-a0be-d33a18f02db4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331332, "uuid": "594074d7-5e62-4db7-87df-486eee31558e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331332, "uuid": "4a78319f-8a53-4864-ba9e-3a0982fd01c6", "value": "9e586625_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20af1ece-aeb5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620337852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337852, "uuid": "f7cacb88-add2-4315-8872-a9f02b3a8653", "comment": "Malware payload", "value": "e2cce68a81438b2ceeea09aadeaddb41", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337852, "uuid": "1d354b7e-3534-4335-8f89-e37d37f5e869", "comment": "Malware payload", "value": "86926685c52fc0eb80f8d256eff2fd0e34b1d4580c5861ec230b90370d68b9fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337852, "uuid": "ca285165-58ad-4c47-90d6-a7862cb2e4bf", "comment": "Malware payload", "value": "5e175d1dcf82318aa059d2c0095c6bdd0c810d49", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337852, "uuid": "27496134-54ca-451e-af05-975a5512778f", "comment": "Malware payload", "value": "06ebe15333bdf258825cfa546a2e5f6437817e0160e53673b50a7300c693fa401932af6f780c2364e8406771c630b370", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337852, "uuid": "fac9522b-2d70-4c68-a542-1f927eba0c9d", "value": "72054AA433E4E6BAC58E4375A5943D3153F18C11DAA9BB46AC8CF9F0AC62FE15B011D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337852, "uuid": "d3a1de9a-0fe4-444f-b220-8171ba0cd8f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337852, "uuid": "8d838302-7a5b-4f86-9680-8383cca4e766", "value": "12288:B1fxhwL8mLAHefRIZtbVqrTwqEZ78RmzG6k9p8TE:jZyJAH/ZtxqEZ780zyp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620337852, "uuid": "21834a09-62e0-4f78-bfc5-ff903733e4f5", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620337852, "uuid": "5d3b2162-2af4-4acc-a8f5-6142b17cf168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337852, "uuid": "7dbdf258-c0c7-46f9-959c-31ac47d853fc", "value": "SecuriteInfo.com.Trojan.GenericKD.36850358.14162.31045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ccef9c-ae03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620261627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620261627, "uuid": "1b3a3896-69c4-466c-a737-4f73a5b84b3d", "comment": "Malware payload (Stop)", "value": "4a44d19c6dd86e7051df6055508ad99b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620261627, "uuid": "a2c9265e-1b3a-4813-8c1f-dadd9334aacb", "comment": "Malware payload (Stop)", "value": "869bd0ca39150a6e0f87609ca7e927211ba9cf636b69c33c3cd09db85922dd94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620261627, "uuid": "e166149c-e340-4d5d-908d-d9b413ea6b85", "comment": "Malware payload (Stop)", "value": "44d1fda30e250570c5a6141b1791b48febd5615b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620261627, "uuid": "18ffc2a6-b243-48e4-bbe5-1592bd68dfaa", "comment": "Malware payload (Stop)", "value": "ee911486b83604fef399e4035fb2b5cbb5cd28c0bee92f860db2cce8ff4f89b0e5c2344a485e1ddbd2eef21ebcd748c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620261627, "uuid": "4728a3d8-e9ca-42d0-8aa7-5c0ccf6697da", "value": "6705F1B1AE90C831F8B735F489B9977C692CBEA05B6010CB62D4BAFD16345E1AC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620261627, "uuid": "bee8e562-89a5-4ad4-8f24-09eecad0205a", "value": "109eba5b6c2cab48fa70b23e2f10f43a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620261627, "uuid": "5422a6d7-4843-489c-824e-b7ad247770cf", "value": "12288:86XHCPz2fWj06KJl9idAF6UbCKtphJIYD8SDtG177bkeUvIy3+yNVFfFp:5iPzjUlkE6ihS2RoXkRvBbfFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620261627, "uuid": "712f3c49-461a-4666-8027-3412b299320d", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620261627, "uuid": "c4b27842-8826-4763-bf71-ac264611e6b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620261627, "uuid": "952a7029-1b7c-479c-aad6-1243fbb7868c", "value": "4a44d19c6dd86e7051df6055508ad99b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e4037b-ae7b-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620313279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313279, "uuid": "4d0666af-62c7-426e-9ab5-e0f142b8abae", "comment": "Malware payload (ArkeiStealer)", "value": "7b664652debf14435f7cd8c2cc6fc0da", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313279, "uuid": "67cedde0-4d94-433c-86da-f0572f4bed5d", "comment": "Malware payload (ArkeiStealer)", "value": "86b8e5e4868bd3d427a2aaa35d362660a8624315227cee5c607f7458e467b2c7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313279, "uuid": "a068f978-75ac-403c-a7b7-4b53c1945b9f", "comment": "Malware payload (ArkeiStealer)", "value": "b4fda1962c48c2eeae8bd995b4c7087d54fc17e6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313279, "uuid": "72c72bfa-64e1-4837-bc49-173d4940594e", "comment": "Malware payload (ArkeiStealer)", "value": "94a264873d814402acd7ff0bf809826bee9a186e52db1c94724837267b486a08557ef1b1e1e94a97f0505f5ee66e3fd5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313279, "uuid": "534355a0-fb29-4c89-89cf-de70f48e2eba", "value": "6DE40221F5C0C476DD2311758816EBB19E5AB87116311ABF2BEC36B6DF282E1B62530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313279, "uuid": "af2c1073-094e-4bd7-a23a-2028633c6084", "value": "de4966d3d1bf40715bc56116d419d4a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313279, "uuid": "5deff6d1-a954-4f1a-a2fe-5642c0894998", "value": "12288:C+CZoSk2fdDMDV8SOsfvv2k8lgjvLrD0kPDK4mJO7LC/RERznBCB5Jzmr:C+CZoSkUdDMDV8tgvPMgPrD0cKdJOyUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313279, "uuid": "cecc33e9-4fe5-4237-84c7-ba0ba776bce8", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313279, "uuid": "d376c1a5-6fae-4596-9581-616d83f5cad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313279, "uuid": "0155f8f5-b47a-45ec-ade8-785d58cc7acd", "value": "86b8e5e4868bd3d427a2aaa35d362660a8624315227ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c35793-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306137, "uuid": "bf66f34e-af2a-46dc-aae9-0be297427b7f", "comment": "Malware payload (Dridex)", "value": "e6605141bdd1a91e4001dc2cebdf15c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306137, "uuid": "2caea969-b48e-4dee-82b3-e816ab805095", "comment": "Malware payload (Dridex)", "value": "870fcf2b2ec0e0cad5035809699ec5509efb1d70a1a12c41a119a630694b4a6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306137, "uuid": "8f77c6ef-b89c-445a-aa97-390ab42080d4", "comment": "Malware payload (Dridex)", "value": "b67ebb6b31916680eef769f2fa2b646c9ad2a3f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306137, "uuid": "6316596c-3a69-47a9-a5a1-1fcecbc02406", "comment": "Malware payload (Dridex)", "value": "fda40d1f7d1f978f7f860b93ae77ae9b3dcaa0494d4bf631ec79a35700bc229bca1a2b1b40c755da0b1935407f90a229", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306137, "uuid": "8f60b5b3-1432-4343-9676-6ed69dfee890", "value": "ADF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306137, "uuid": "a502f1d8-d240-4754-8f51-25251c46f167", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306137, "uuid": "59dcf928-0d19-4e20-a8c5-b21f71a16a34", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306137, "uuid": "38e4625f-1045-41b8-83cb-41822a850d40", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306137, "uuid": "8da393d4-1341-4e33-8ec3-95f9b78732d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306137, "uuid": "a124ad5e-c7f2-45b3-b1a2-9ac929695083", "value": "e6605141_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf4b2a7-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Phobos)", "timestamp": 1620302359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302359, "uuid": "2645b87f-0b7a-4f7a-9546-e32c36a1a9e3", "comment": "Malware payload (Phobos)", "value": "ab7b66ee5385cb473b9c15db3e239692", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302359, "uuid": "50df0e89-0722-461c-8991-904cd80207fa", "comment": "Malware payload (Phobos)", "value": "8710ad8fb2938326655335455987aa17961b2496a345a7ed9f4bbfcb278212bc", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302359, "uuid": "b49fd2bd-7c30-444b-be4c-132a9949ef9e", "comment": "Malware payload (Phobos)", "value": "5875f07b7b8174284ca15e4d5f53942e0d736024", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302359, "uuid": "71ef7198-4dd6-4453-8139-de76037987a6", "comment": "Malware payload (Phobos)", "value": "e9dbd87b06e87719bf12f8351df127c0f14a4d82a95971f58793643c84be05581a307e884ad683db5f60a25bb26a97f7", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302359, "uuid": "9cab3768-0f4b-41a9-81cc-b1fecdcda222", "value": "1753BF4570AD94B2CDB14970253A6F5F8ABF640140B888974F394D8A3ED5136EB3E376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302359, "uuid": "d9fdefbb-5029-443f-b0e7-56c5a65d2ba5", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302359, "uuid": "d5de3cd7-c826-416c-b4be-5bf79a094088", "value": "1536:XNeRBl5PT/rx1mzwRMSTdLpJil7Qi9TMk:XQRrmzwR5J67Qi9TMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302359, "uuid": "1c8852a3-481d-48a7-9480-1bf901ac17cf", "value": 63504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302359, "uuid": "74743f13-b367-4ccf-b6bf-99cf4cc171fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302359, "uuid": "0654b86c-55bf-4d30-8688-aef914117fc2", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de389e85-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338600, "uuid": "2c4d68df-e2be-4335-9f29-dc9005784706", "comment": "Malware payload", "value": "059e75838c24284db76bd697f0992d87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338600, "uuid": "e7f1e2a4-b752-433a-a5cf-4786e995bf70", "comment": "Malware payload", "value": "8759851158a13878988c245b9953e0a0419d75bb85c177f1b196283e7023d7ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338600, "uuid": "0c79230f-6d9a-4405-9598-29af8e8661bc", "comment": "Malware payload", "value": "c508046b2b50cb625a45a7643a6121ccbdba1792", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338600, "uuid": "dc8eda68-55e9-44bb-bc64-98ab50cbc6bf", "comment": "Malware payload", "value": "f6012f53750854efee40edbf7befc8e7010e894c182496157cafcce36b696f82a61f8b3a9cb0fe3f1a3c5a118955b2ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338600, "uuid": "bb7c3a4a-6f28-43a2-a7e9-154422be397c", "value": "DBF3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338600, "uuid": "ace7fb25-98ea-41a4-8177-1bf40c2a177d", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338600, "uuid": "b2eb9ccc-736b-45df-9b7d-10062c5d992b", "value": "3072:akG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:kERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338600, "uuid": "b9e234d5-be5f-4e6b-9478-0b2cce7718d1", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338600, "uuid": "9ea62cb9-72dd-4639-be17-b16d14328969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338600, "uuid": "2f3e7fb6-adc6-48ab-b317-a6917454868a", "value": "059e7583_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8860a5-ae1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620273660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273660, "uuid": "a6ed8a41-624d-47d6-92b1-531f8abb4b36", "comment": "Malware payload (Dridex)", "value": "74d079ae7b4714f955d9efaed196edb4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273660, "uuid": "c74eb7bc-dc5f-48bb-a93f-67d991204f72", "comment": "Malware payload (Dridex)", "value": "876f83aeeb1798c27ac76b269f4f60c3727536acbc1f379474ef62c5611e878a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273660, "uuid": "d7b9e1a8-db90-4538-a5ef-5f210bdb4563", "comment": "Malware payload (Dridex)", "value": "5e5b01f2a70512db6739966118e29447be980c7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620273660, "uuid": "29dced91-6989-4a77-bf0b-06146453a8e7", "comment": "Malware payload (Dridex)", "value": "b4d7d81c983d618b5e1a9ad145ddcef1101cc177f05a8152fa32643f89051464a2c0c5b209410bd360ee62ee4c28bab1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273660, "uuid": "481a15c2-e79b-4269-a128-8b4e6fb85d19", "value": "D3F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273660, "uuid": "0beb0ab4-b361-4b95-ab1e-a67d163e7a91", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273660, "uuid": "5061fe1b-d7f5-4608-9f71-74e498c6421d", "value": "3072:MWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:M42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620273660, "uuid": "197b4daf-b23f-4afa-9e72-f1f4f4f8462f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620273660, "uuid": "9c04cff8-3bb2-438f-b556-25353988fd48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620273660, "uuid": "4ef2b2c7-a105-4970-b4d5-c777a43f49df", "value": "74d079ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2d95f3-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320556, "uuid": "c72d8ba7-38de-4120-bfd4-1433ae32cc34", "comment": "Malware payload (Dridex)", "value": "4d3ec140f03322a7d5cf6cc01cf81464", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320556, "uuid": "8f6ab0fa-9086-4627-b6d3-909ebf8d466c", "comment": "Malware payload (Dridex)", "value": "887691d4c83bf3e9fb59959f4c5574263e4d55db23f05c283ed769af5a80e47a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320556, "uuid": "3c5dc858-bf7a-4b05-92e9-1d8d7f4af771", "comment": "Malware payload (Dridex)", "value": "d49d8bad70c8364b21376c5e05e3318d0d7d4b08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320556, "uuid": "c64d2997-dcad-495d-8dd9-937812bca24f", "comment": "Malware payload (Dridex)", "value": "659ee4a992766e506b61b66510b1bb355aa6c22ee74fb9dd6a054c25183fd8bcdbb6059c0bfabc1b4b873a09917a6797", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320556, "uuid": "921f3d30-c89b-468f-97f2-720f7fd96e8d", "value": "6CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320556, "uuid": "fa27c83f-7623-45c1-aa28-f653c6d97578", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320556, "uuid": "a9f0e5f6-7732-416d-886c-506293dd8848", "value": "3072:llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320556, "uuid": "a062e15d-7368-4d89-9ca4-56f438107878", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320556, "uuid": "64c56a16-4fbf-4402-b012-3bd317c7b1f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320556, "uuid": "5af071e1-0422-402d-9259-1711c3104fb8", "value": "4d3ec140_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a398810-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1620310327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310327, "uuid": "f75bea47-0d12-45c9-b8a1-fc04f906af9f", "comment": "Malware payload (DanaBot)", "value": "51209196cdca1e7988eac671f69a58a4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310327, "uuid": "1ec4461f-8a0e-4d7a-888c-8c87ea7e546c", "comment": "Malware payload (DanaBot)", "value": "8884c731201c65b7db739e95839374b509ac0cd4a2b18b7075864f56d13c9bd7", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310327, "uuid": "5467c090-cffd-46f1-bed9-d8cb7f81736a", "comment": "Malware payload (DanaBot)", "value": "eabe5ca552932cd3d94e95eaacc3449722cadae6", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310327, "uuid": "2771653c-7996-4b47-bdb0-cff2419cbafc", "comment": "Malware payload (DanaBot)", "value": "219e3f98140ef0cc82ff0ee2d99b9e5e18bb10abd531f1bf2c4f1200bf43a635974d470ba9cc78807535243fc936f43d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310327, "uuid": "bf6ee742-a08a-41b9-805f-f57d231627a3", "value": "3B563347B160D8B5D91345F38460BBB4AEDD74A26B640DBB30ED39B7DF65280B72230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310327, "uuid": "121d83e1-9a17-429a-9e8b-a66a691872ef", "value": "f7ec5170de034aa3644c4457a2b957d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310327, "uuid": "731aa3fc-cf54-40d9-9e09-a5f25abb9c4e", "value": "98304:dxo5yv5c5c+ZuQCqey5zHIYJBFOOPH2G9DwgOfH6O4kMtz4811pXyz:/txc2+Zu+eyzXFOSwnfHkts8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310327, "uuid": "94f2ef21-df17-42ac-8798-ce0930e98647", "value": 6368256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310327, "uuid": "a938869a-c562-4759-a82b-fccf7b10f3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310327, "uuid": "8c78d64b-9ca7-4a91-a980-84ad16df0e19", "value": "cvhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5836d0c5-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339234, "uuid": "357253aa-31ad-41af-b4be-123e61d06272", "comment": "Malware payload", "value": "88305ecda31e4008792eab19d6eea748", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339234, "uuid": "d7a77981-1edd-4e67-a9fd-a92a6c07beea", "comment": "Malware payload", "value": "8899c71ef914b653c9d518e88c374641a8494264d47c836f1e861b367991b937", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339234, "uuid": "54c9c256-7dc2-4a5f-81b9-42902c89378d", "comment": "Malware payload", "value": "ae679f470c47711a4b851bc4840d1a5a6b85e132", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339234, "uuid": "88ba3cb3-901b-4ae6-b2eb-471ecac0a6a6", "comment": "Malware payload", "value": "a98e8f3ae42b6d322fe782fb19ba3ebb888f5f745650ef4c059283a3cc1ea30896d759bdaad56359c98b1a38d6d5bd27", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339234, "uuid": "891fac0a-68cf-419a-87be-c9ebc01fe21a", "value": "96F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339234, "uuid": "79b9d9cb-c2e5-4771-862e-256b95fdc043", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339234, "uuid": "99d49d17-e688-4f57-9a11-f4df214c5dec", "value": "3072:+LG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:lERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339234, "uuid": "71f3bf59-c08f-4725-a6e9-e4bfe1e3e31e", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339234, "uuid": "3053d859-a3a7-4384-9f7d-2f17f57b9a89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339234, "uuid": "ed3d7a9f-4b04-41a3-a2a1-d5e2dc1cf7cf", "value": "88305ecd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b5729f-aeb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1620336674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336674, "uuid": "90ba3d27-a59d-498a-8cba-a1efcd6c7447", "comment": "Malware payload (CryptBot)", "value": "39af410be83df2ea318ff40ebd292201", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336674, "uuid": "0e5155dd-2c0d-404a-ad5d-810cfd92f613", "comment": "Malware payload (CryptBot)", "value": "88d72c7267e4bd769e27280525a6de98fd5c9e1689f2d91e1fc818b868b348f8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336674, "uuid": "d990253b-cdb4-4b82-a9c2-cd1959e33752", "comment": "Malware payload (CryptBot)", "value": "dce9ff4751b9f65eb7614d389188ff1f4aca885c", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620336674, "uuid": "25e3321f-09ef-4f93-9a96-f7d2b8bbd4d8", "comment": "Malware payload (CryptBot)", "value": "099622f9b8e2214b6aa73cbb735050f7dc439d120bc85cf13a54c05350558221ee37106d6935f3a287ff3965ca33c4f4", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336674, "uuid": "162ada04-6898-440f-afce-c7065dd2f1ee", "value": "13050221B544C4B5ED1714724C11EBB08E6A786616715ABB3BCC3AB9EF383C1BA2534F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336674, "uuid": "f410fb54-f7b1-4b61-a870-b4f543228e72", "value": "f7ec5170de034aa3644c4457a2b957d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336674, "uuid": "79c3a67a-b9cb-4527-9215-aa386ef1ac0d", "value": "12288:GaH0WYXfBRawMRw54VmaPodGGon8tefXTASqnuSg+BlHCzmr:Gg0jvTzMRlsxGG7tePcS2uqlHCzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620336674, "uuid": "90aa9c75-0cea-4cb6-96a8-b5f6eb32f0eb", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620336674, "uuid": "9d0c75e1-fd79-4107-a51e-6846f20d2e4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620336674, "uuid": "bb89c94c-ca1a-481f-a638-026fa93f5512", "value": "88d72c7267e4bd769e27280525a6de98fd5c9e1689f2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb573da-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338951, "uuid": "c3111e75-1363-449d-8be6-46cc6370cf36", "comment": "Malware payload", "value": "d623b78b2d5a29cd38c99b853303aa9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338951, "uuid": "8a86bc00-7543-4b89-9674-d4468da2b33a", "comment": "Malware payload", "value": "891e27d569eb2ae2d9780b3af0f90dbd959b623b6c2b9f645d454b749ad15854", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338951, "uuid": "763783a7-586d-4b25-b74b-063c155a0780", "comment": "Malware payload", "value": "e5180df5e136f681245faebb235c373ed188d882", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338951, "uuid": "cdca7774-9804-49f7-8096-30d26f134c28", "comment": "Malware payload", "value": "fb19f0c3067f45f8d26f815d77fa8f75c6e1e3f4c44d45e09bdadce7ca54a387ead5cd813c678fdc60a79ec3cf96ed1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338951, "uuid": "04829240-4e3a-41b6-a04e-1f3e014219ee", "value": "A0F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338951, "uuid": "9d87ef65-4f47-4018-920e-cd8352ef49e5", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338951, "uuid": "b2b44381-39df-4a65-84ca-3f9ec560653f", "value": "3072:7jG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:2ERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338951, "uuid": "3b0c309f-a25c-4749-994a-c946875038b9", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338951, "uuid": "7e1036eb-8088-49db-bfbb-16ea4736ea97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338951, "uuid": "b99ac7ab-bb4d-4be2-9f2b-141a70029a28", "value": "d623b78b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127d0d63-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620285000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285000, "uuid": "5c2a1bde-86af-45bb-8b4e-b9f57307f7ce", "comment": "Malware payload (SnakeKeylogger)", "value": "70d45e752d7e30848eab637e90707ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285000, "uuid": "b3ee80de-0d63-47a7-b6b1-d1cb49d0ec8c", "comment": "Malware payload (SnakeKeylogger)", "value": "8950abaa629ab6bb45a0bd6de1e67a9f97b27cab05cb68897f94669caf229016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285000, "uuid": "0bf064c4-2c50-4e34-81c0-22fefba60419", "comment": "Malware payload (SnakeKeylogger)", "value": "627c142b96594966eb391cc610f81787af63e4a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285000, "uuid": "7d56846e-d4be-4334-9758-9c1953bb264e", "comment": "Malware payload (SnakeKeylogger)", "value": "57325f8578f1df96f795c04bea4bb0eaba41796452809b1dc73cabc5a5de05a962b64327135035d23cba693e0d7ac878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285000, "uuid": "6d322e62-e6b7-40b2-bc7c-6652e5be43be", "value": "B9E419A8B11457E0D3175D3363CB4C0682751974E93AE93A4F6033BA1A7FE1F2E39989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285000, "uuid": "8d928e9f-ad44-4d83-a975-b2cbfb4c80c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285000, "uuid": "965f637a-1f45-4c35-b3c8-4f61814e6397", "value": "12288:RooLLoS60/K7yh0kbMe5PGQr5k8RAbmih4XJb0RpEzrFPi:RooLA4NZdrmEhbUOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285000, "uuid": "57fd89b7-40eb-4010-b6c5-9e2a61558b75", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285000, "uuid": "8e2b45ca-f936-4ad9-a572-039c6e3a5086", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285000, "uuid": "be8f1ade-ff94-4f54-9242-13eb3316d23e", "value": "stock from Jilin Batu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265e7653-ae58-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620297918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297918, "uuid": "be4482cf-8531-4a38-955f-eab6fd0cdd55", "comment": "Malware payload (TrickBot)", "value": "5afcb19142f88f3c05ab69351cceeb70", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297918, "uuid": "a8ea1503-722e-4567-9900-6b793beb9cb6", "comment": "Malware payload (TrickBot)", "value": "89591fbf63f1c182f87402dc5a6ad27b79c158129ab5ac75cc1139a2396b528e", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297918, "uuid": "e64b4e68-dd03-4f54-bfaf-cbf3ac39dcd6", "comment": "Malware payload (TrickBot)", "value": "c5de28ea9e0bec2c5ead9e2083a829116f407d3c", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620297918, "uuid": "bea8bc63-0fdf-45ad-8418-c97a109318b1", "comment": "Malware payload (TrickBot)", "value": "c2a76b664a90d856452e1acaca5e68d7374a4e123fbbba073b07656acae5f4726b826cbd4aa2f7aafd6dd7751f59c073", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297918, "uuid": "41a085e9-8022-4169-8a08-6d9f54ada81e", "value": "BEE4E002FBE0903BD6B285310FE77B3A57F9A9905B755EC763909B0D48321C16E3636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297918, "uuid": "45e94941-a391-4888-8b05-8a733fdde219", "value": "82d7aabbacaf14bba1c321d3fe1f95b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297918, "uuid": "7ffdda9c-ce74-4b89-9176-90ea3b6f37a8", "value": "12288:3Y8Id8iWYsK9t3o4iek/WGtMqZtEfl4GnFfTWokO:i8i9B9pd9sMqTaRn1bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620297918, "uuid": "675e67f8-5cc0-4195-a818-9d3badec4ee5", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620297918, "uuid": "779d0900-0f87-4ce3-a861-25bc2e8cfb70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620297918, "uuid": "8e89556c-2729-4580-b3e0-92f81890827f", "value": "redbutton3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a488c896-ae67-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620304573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304573, "uuid": "a939fdd5-0ad0-416c-a17b-4ab93754d2e5", "comment": "Malware payload (AgentTesla)", "value": "00ec5f0cbf17f89406145e934f7ccee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304573, "uuid": "dee57ef0-831b-4b6a-9f42-60b0606a5052", "comment": "Malware payload (AgentTesla)", "value": "89e309b2699b6f2bbb98d3c8f5efd31b1e57961c18bd0f3f633272a5b4082b02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304573, "uuid": "863f8ac3-6d00-4eb1-9841-5943d27bbaca", "comment": "Malware payload (AgentTesla)", "value": "d0615578d5b8db49f21e74b431271bb8a2663b42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620304573, "uuid": "279bab69-43e6-402d-b9e6-6a71f702f2b7", "comment": "Malware payload (AgentTesla)", "value": "fc36cc80939b50858d85e950fc4f3d7bcc2b468f8b9b4f80c9b5b1993a2c447cb260cdef758f0c736fbc74cfa22904b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304573, "uuid": "09dbda4f-cfed-48aa-828f-f42d87a01e30", "value": "5D1528EC751074EEC65BDC22EBCE1C25D6202176972B9607932303BD9A0ED57AF348E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304573, "uuid": "0cd55faa-5a6c-426e-8626-8896cdb4789f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304573, "uuid": "be361629-9796-4865-bbf2-e8901786a985", "value": "12288:HNBfR5oLLoS60/K7yh0q6J8BrP1fEUpnDeO93q/vvkTx+JAZ+TK7peLzFYLAAvUS:HNn5oLAqS8Bx8UtDeOskoJAOK7pePFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620304573, "uuid": "8b437157-1fe9-4732-8445-53e062d0db9d", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620304573, "uuid": "fefed856-cc70-4587-bfde-72f8bee6c5e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620304573, "uuid": "a3c89d32-60ea-46e1-89d7-0d9fb489d7b3", "value": "kellyx_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807692b9-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620316967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316967, "uuid": "92c1916b-db77-4e2e-990f-3beb9bfd8dd5", "comment": "Malware payload", "value": "7f8b3a9abd3230283b6af2f9a77ee7da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316967, "uuid": "3c588dca-668c-4ca9-98ae-5dbd52e8c153", "comment": "Malware payload", "value": "89f00407704de8685478fe9ad60a06c038571ef687386567489032910f4459cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316967, "uuid": "d96c3506-22e3-4bba-a4da-553a799f99f7", "comment": "Malware payload", "value": "ba2abb881ca750df281f32fc1a8c4ab86adee9d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316967, "uuid": "3b781600-9909-401f-9958-8aaba51e8cfb", "comment": "Malware payload", "value": "80718a706f3ef33b3a93d297313d66e7d769bef7600e4c41bb2bfc09b995490235b457740219e2d0e60f3bab9a1c7b1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316967, "uuid": "cacd4b83-20b7-4150-9d66-f9de490ac02e", "value": "C3B39C0BCC095AC7C11E93FE6D075DF96E0E1719D8D22FEF40221F8A3A656631E4B16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316967, "uuid": "4c2eb997-80ac-4798-afae-b0e124e0a05c", "value": "3072:ngQvKINbjvw548LMb/oqKO8NnS8+60Kc/A+:qAbT648LM7D98Np+ER+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316967, "uuid": "b28204f2-ba2c-44f3-b044-23549ee04022", "value": 112057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316967, "uuid": "a82573f8-e00f-4ab6-bf8a-ea672e315285", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316967, "uuid": "fb4be2f8-e5e9-45d8-8eb7-e7c6bbcbecdd", "value": "7f8b3a9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9842b01-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339021, "uuid": "d148abcb-8909-4b7f-879b-a494c3511c2b", "comment": "Malware payload", "value": "93aa7d1fba8406f55c6dda0a983d3d9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339021, "uuid": "10fe437c-e72a-4f71-9897-00cafff7fad6", "comment": "Malware payload", "value": "8a3d8c530e40e34c0b105f42ad1a3702f293823865ccde76df6d3136a4ecff07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339021, "uuid": "91a3e199-4651-4c14-bf4b-764dc6eae594", "comment": "Malware payload", "value": "8fd7fdbfc33b3716d17ba1773c3d5906cebe38e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339021, "uuid": "3c9e8a48-a7b4-45f7-bca0-88f605e826f2", "comment": "Malware payload", "value": "4afa806bda3bd7948f85a59321e0abf5f53c1bdd333b3f737781b373406efe58f74c1c022772eeaffc5489744b818a7d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339021, "uuid": "eab7b62e-82db-4535-b73f-ec5cd11b6201", "value": "22F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339021, "uuid": "b18e5e5e-4425-4899-8701-dc93aa34c923", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339021, "uuid": "f7340f16-f298-49bc-9a7b-637e65051c54", "value": "3072:kC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:54KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339021, "uuid": "cdc80147-a5cc-4c7b-b9b4-4c0caf336797", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339021, "uuid": "21b428ab-1463-4dcf-b137-552b7bd85a1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339021, "uuid": "07011bfe-0dbe-4fd8-8b67-48c62e2680a6", "value": "93aa7d1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8046ab6e-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339301, "uuid": "991059cf-67b5-419a-8ad7-606fc0dc0973", "comment": "Malware payload", "value": "e4256f95d18b5e2f41e5ac47c6ee2031", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339301, "uuid": "8d18dea5-f542-4c32-a26e-07122dbba112", "comment": "Malware payload", "value": "8a5ae41acdcc423ec445f545d8399bf11c5f55f740ec5a32bf3750112e720c21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339301, "uuid": "af5cd942-6efb-47b3-91b9-75bac0d9aac8", "comment": "Malware payload", "value": "c143e2a0d882b2e93e3ee7ecb3a9cc6bb6d9715d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339301, "uuid": "13305dce-9c3e-48d4-931a-7d507f424d51", "comment": "Malware payload", "value": "06f14bc2d842b79db912655f0d09b9315ad5243ea8d5c8c1d1357cc8063a7d2a7d9b326f702bfec356449b68bfa99608", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339301, "uuid": "b98a3b1b-0d87-46ab-b418-0d951c3696d1", "value": "D4F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339301, "uuid": "d7125476-8a8d-4778-b0f5-d629b2f15346", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339301, "uuid": "bc190957-2d31-4408-b343-e499bdc09c49", "value": "3072:wC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:14KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339301, "uuid": "fea3fe64-7deb-4182-a5da-a8da68b8d07d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339301, "uuid": "f1fec469-27e1-4317-a9c1-fdaf4284f0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339301, "uuid": "41701fa5-4de0-47c7-9c0d-1e628a41493a", "value": "e4256f95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e09b74-ae39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620284768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284768, "uuid": "06f30a13-9123-4ad0-b4af-02b8b4d570f7", "comment": "Malware payload (Loki)", "value": "0731bdfc48a6e0e8ee67320c7dac7b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284768, "uuid": "42d64490-9360-4d19-9eae-30df902daeea", "comment": "Malware payload (Loki)", "value": "8abaa16d8c8878bea5bc52bd5f80500333df51ee8e3212899abafd9d299131fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284768, "uuid": "58c15fbc-6863-4eb2-b37c-11e8b2ea79c5", "comment": "Malware payload (Loki)", "value": "f7cd506035b96675a05e2ed699ab3fbf8d1a643c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284768, "uuid": "edd09701-9eb4-42d8-b59d-863336d6f948", "comment": "Malware payload (Loki)", "value": "6bbdfe932c372917264ca7116aba60d965d1e88e84f296fb0cab0d3224955c07f4cabba50b4ea9032b4216ffbafb17eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284768, "uuid": "2d25c579-3096-42ed-8fb6-9d9f9ad422a6", "value": "63058D04B7E45BD7C2CF43BAE199271193F1D416A28EBB8B6948FAF53C9339189011E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284768, "uuid": "b291c274-82c1-4425-98a8-d4fa9fd27cd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284768, "uuid": "a19660e2-4e98-43b7-a609-b9015e0a717b", "value": "12288:oH61fxhwL8mLAHefRIZtbVqrTwqEZA2wxXfNyXACaMuYvKZ:ZZyJAH/ZtxqEZ1wxvNQvs3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284768, "uuid": "9ffbca97-4531-42c8-b716-db7bd45057dc", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284768, "uuid": "2d9a56a4-34e0-4d02-ba65-f4685cdf14b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284768, "uuid": "a4f1690d-aca4-487f-ba28-fcbcb19c8094", "value": "SOA FOR APRIL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377b6ca3-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620313409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313409, "uuid": "1ba74688-e12c-4a59-8525-a90f5cdbf69a", "comment": "Malware payload (Quakbot)", "value": "f38e14fe7a9040962f57a2ad4a2c0adb", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313409, "uuid": "c0f92d85-4d85-4915-9b6f-a9076a052726", "comment": "Malware payload (Quakbot)", "value": "8af305e7934fa8645a6fad829ba796e4329124d6f94773fc00bfe4e2d61aaba5", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313409, "uuid": "7db99a80-3f12-47e8-b02f-5ad04f215003", "comment": "Malware payload (Quakbot)", "value": "d2d75a383175953290f758a59cae816fb84498c9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313409, "uuid": "4317ec73-d5c4-462d-9ca8-246e28887912", "comment": "Malware payload (Quakbot)", "value": "4084b53158ba331de0f7ab921a61d6a2575ded44a5b2a57b2df4e72fccd81d37be00ba56daf7fc32c1da29393baa9a45", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313409, "uuid": "f056a7f5-40c1-4fba-99ce-71b17c9933b6", "value": "1DB39C07CC095AC7C11E93FE6D075DF96E0E1719D8D22FEF40221F8A3A656631E4B16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313409, "uuid": "bcb24924-896b-46cc-9203-78cd6ddb8823", "value": "3072:TgQvKINbjvw548LMb/oqKO8NnS8+60Kc/A+:WAbT648LM7D98Np+ER+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313409, "uuid": "7693cd0d-e6be-46c7-a960-3f56d412da19", "value": 112057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313409, "uuid": "e3ae3995-fb8a-47bb-967b-486672a1e113", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313409, "uuid": "3c1a6d4a-61bb-4acd-ba15-93b7a31e492a", "value": "f38e14fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d996ea8-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324157, "uuid": "99ffb129-b064-484a-871a-c14b0e8a262b", "comment": "Malware payload (Dridex)", "value": "5cc4c299fc5783434e3a8a1b11212a97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324157, "uuid": "94c2b46d-d0c5-4585-815f-cccfe8b1d130", "comment": "Malware payload (Dridex)", "value": "8b00e0a8664a9f106eebfb6f8b2f568583c66aab52b7f0b7f758cb954c4d7c38", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324157, "uuid": "07d768ec-7c2d-43f6-905f-3d50e989850c", "comment": "Malware payload (Dridex)", "value": "690767a757765dc1d1711fe21b242ed237b2cc95", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324157, "uuid": "2ca9b965-79fd-4515-a5ec-827e6df1c84a", "comment": "Malware payload (Dridex)", "value": "9c6efe388e45598baec433e09a70361e2aa29562930aa81191c2a6a6fe0260ec1179a5031510dc5d157682f05b36e508", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324157, "uuid": "07168b85-08af-400d-9e38-3c28869069e7", "value": "0CF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324157, "uuid": "697b594f-5f51-4d48-8930-0766712faf93", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324157, "uuid": "0cc3a048-468f-4c73-9522-089609b46be3", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324157, "uuid": "76ecd4cc-0569-4a34-a704-f6d0646e621f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324157, "uuid": "d0fcd9c2-920c-426e-9c50-ca4e819e8c94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324157, "uuid": "d09c49ad-c1cd-4cf4-bd82-0ecc6ad4e8da", "value": "5cc4c299_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ddc651-aea4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620330806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330806, "uuid": "9f826727-32d2-454a-be4a-5f88bbc16335", "comment": "Malware payload", "value": "a4fdd182c052c420520377e94442376d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330806, "uuid": "2f7453a0-489b-4666-987c-d4cb9677fedc", "comment": "Malware payload", "value": "8b7963cb577113f618ed39f5d2f13bbdc34a5000b454b3fea6082f0c828ee683", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330806, "uuid": "e6c9367f-10d9-4e70-bf68-315bb2fecfd3", "comment": "Malware payload", "value": "65c328dd4da25babe0c8afbca4a0bebf1919899a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330806, "uuid": "8440cc7b-2088-412c-8b48-fddfce31e4ad", "comment": "Malware payload", "value": "16f697cf5273e84d9087f7d847677857ad51541f6be1609aa7a6652950cf0c5ac48990cdef6768155a336856592cb0a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330806, "uuid": "149c4fed-a9a7-4354-ab81-1b91ced9886a", "value": "3BF18DDB2D7DA03DC19C623223D9D6FA02E931C0A3799EE031A4238B51CD95CA81C26B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330806, "uuid": "8ba70725-089a-4447-939b-4aa7660aaccd", "value": "c2f626b813898e29edd1e4185d7dac83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330806, "uuid": "8b5af9e9-8c5e-43b0-9e2f-93a61635e145", "value": "192:rLam5elt+M7++V0AoyjjkQVhIFpvTn2GC36Bg:3amPAoqjmFpviMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620330806, "uuid": "d380a37a-9b60-4fe8-9e39-6aec52e75a17", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620330806, "uuid": "3f816ba6-ec2a-4868-927e-2ac75f767d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330806, "uuid": "af9d226a-d9dc-478b-8bcf-70d2ec84e7c5", "value": "SecuriteInfo.com.Trojan.DownLoader34.17590.11308.12580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3c9b91-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1620299081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299081, "uuid": "9b16b878-92a1-4f29-a8e4-0a5473cf9831", "comment": "Malware payload (Sodinokibi)", "value": "bd3c693ecd17dcd9e60b08ab963121de", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299081, "uuid": "bc92547f-13d8-48a3-9113-085c2c03597d", "comment": "Malware payload (Sodinokibi)", "value": "8bd2067d088dad4df24e11244f5b72ce1fd22b686e2ce9ba6ee8711f8f6a836d", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299081, "uuid": "772c2ce6-d634-4a26-a097-cdba04650d57", "comment": "Malware payload (Sodinokibi)", "value": "3480a1dbc4bcc1bb06a7fbdc82e892ec5ba3d6ab", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620299081, "uuid": "60c0a946-b46b-42fd-853a-3476b83b565c", "comment": "Malware payload (Sodinokibi)", "value": "75fe12dc3fc7c335456f343097dd2e6ce9e91432a2a70a5fbba3caffa623d775e92eb3941f144936487a23d7e557eb61", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299081, "uuid": "ea948049-a594-4f21-945b-564cf759fccc", "value": "866623636372018AF4D28C3786277EE131F507574B43BCBC18EA6DC032B75A4B666A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299081, "uuid": "e9d18af1-568b-4d1a-bd57-bbaf440c21fb", "value": "eabab411b973d1270d6217e2aac2ae07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299081, "uuid": "cb73a2a2-445e-421b-a931-99d7f1df27bb", "value": "196608:WAQqTimgaxfnKTMZnd+X60zmS1v3ob7Uif6EbXx:fTNxfwMZgX6+eRhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620299081, "uuid": "31ad2f71-deef-4a21-90a9-4a15ab9af1e9", "value": 6661124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620299081, "uuid": "5606d526-a54c-4af4-b906-4c66580ee940", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620299081, "uuid": "370c2564-0af6-41d0-8bbe-4fd72121f10a", "value": "seu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b447089f-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280977, "uuid": "16081470-ebaa-4d62-919d-1bc6b1279d76", "comment": "Malware payload (Dridex)", "value": "ac4dd57bc04cc86bf889d490f028aa16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280977, "uuid": "91cfb87e-f28d-4581-adf9-a68c222ba94d", "comment": "Malware payload (Dridex)", "value": "8bed92281e4c28a08fb798db3b196e36d561e9876b346090306fb3d2fd87dc2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280977, "uuid": "e318d312-5b9f-4ef9-82c7-369b07f52697", "comment": "Malware payload (Dridex)", "value": "4d125e524e9e6033f08570636966f2acbe493481", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280977, "uuid": "ad2e2907-1684-4877-9608-64aaa4857593", "comment": "Malware payload (Dridex)", "value": "01f212a4afa1f18c391e47069f118cc9dc889240c424e1cdd3fb48ba2a17f4f06e6ba41605542d9d2c92414f6e1029a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280977, "uuid": "3a98d157-0217-4fa1-96bd-0c8a30ef7531", "value": "CEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280977, "uuid": "6b3d846a-d1fe-4b4b-923f-b82fca027f43", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280977, "uuid": "5497036c-3b14-4b3c-acb3-a45a4a3db8e4", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280977, "uuid": "cedd664a-6c34-4de7-93e3-5a5750efbc98", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280977, "uuid": "1851391e-060e-4fb9-84ee-a0911dc20931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280977, "uuid": "df489b3c-fe0f-4805-b959-74e5018868a2", "value": "ac4dd57b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6180af-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620334922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334922, "uuid": "efb81438-89b2-4321-a2b8-32bc1ef1e697", "comment": "Malware payload (Dridex)", "value": "a801eff0289b8ff8fc402dfb3576e46a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334922, "uuid": "bfd02b58-1d65-4845-bfaa-bd8e574c3d33", "comment": "Malware payload (Dridex)", "value": "8bf15a4c06e21802490d3bdaaec57ab5fd13995da6bdff39bfd10ea20e06223e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334922, "uuid": "976b55a3-f9ce-46d6-864f-682a4dcf65bd", "comment": "Malware payload (Dridex)", "value": "f11c83d9fbb74ef6073db8639d67eb448901209f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334922, "uuid": "558b6bc5-b1d0-401b-a3c9-719421fb37f1", "comment": "Malware payload (Dridex)", "value": "015deb1e545f73669d0c94e8b87fb8350fa439e470a34b923d64fa3abfbdd5ffde638d361d55872a7f1a1e8b03b42bcd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334922, "uuid": "abfa944b-d332-4458-8a44-dcddc11d68da", "value": "04F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334922, "uuid": "460166f5-3815-447b-b2b3-98d635a7f26a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334922, "uuid": "7eae18fc-1cf8-44d4-951c-b7fd00a6cf0f", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334922, "uuid": "d9b1237b-55b1-4cf9-b15a-ae45fa4a6569", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334922, "uuid": "47bbcabb-2347-4cdb-baa9-eee7381b6cdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334922, "uuid": "0a1d047d-6f75-4839-a006-1c526cad18cf", "value": "a801eff0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e650a731-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284497, "uuid": "3529e829-e63f-4999-9943-60c4b019e5e3", "comment": "Malware payload (Dridex)", "value": "223be7fa974294972ca5a87527ada2f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284497, "uuid": "c921ce75-160d-4d21-a830-3ae668c50fa6", "comment": "Malware payload (Dridex)", "value": "8c36ef80681029ef6d3af89e378acca675079fa3c0caf0489ebeb26d8b962d15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284497, "uuid": "33b7db7a-6771-4152-9efa-9fdbad44b6a4", "comment": "Malware payload (Dridex)", "value": "c6ebc59dfe6bdbe1a86c7c2b2ab5d8b366b4d0aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284497, "uuid": "e423499d-5c84-498f-a9f9-c135df1142fd", "comment": "Malware payload (Dridex)", "value": "79d2d7a3e5a1f50aa6ce96da1c5443df8bad41e62f36360b2a838fc7c364828fe310633081701e8f2ad757f5324fe9ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284497, "uuid": "22189c06-7c54-49b2-a154-03904b5b7e67", "value": "05F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284497, "uuid": "67d3fdec-c1c5-4043-9b1a-e1a5032b7e75", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284497, "uuid": "2a99f8c0-de2e-4561-80cd-aeb483613ad9", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284497, "uuid": "642b8e4e-7cff-4f82-af75-2948fdb5d572", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284497, "uuid": "ee4012b7-b782-4f19-b9b9-dbac066e03b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284497, "uuid": "0c4457b5-f455-4b53-9734-3284b16a1101", "value": "223be7fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dac6ec7-ae2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1620279086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279086, "uuid": "07410516-d7b0-4850-a2a7-c2518aaa4522", "comment": "Malware payload (Pony)", "value": "9dc95ea15630572772323237f6107680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279086, "uuid": "afce6da2-d311-45bf-b0f0-9d8210fd9131", "comment": "Malware payload (Pony)", "value": "8d11f53d7d30a23d2429e63814478ff7c1b03c643e50e62dc3c1f26f6e13a8ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279086, "uuid": "39f77e04-9b79-4b24-a30a-949d3866cbc3", "comment": "Malware payload (Pony)", "value": "abd782ea5f110159c0afec285594c5c4b9661400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279086, "uuid": "b750e2c9-3cbc-43ce-ae09-13e9b4190525", "comment": "Malware payload (Pony)", "value": "60f6ef80b3338667b1b26186326506df74daa223858b919e2ae3bd7b740cb4ec98a40e130f99dfd46a7fbc50c0269f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279086, "uuid": "31225020-e945-4a0d-9bd4-c72cdc97f2d1", "value": "CE341269B7982F8DC4E48638E50D6D20F321BE521CA3A89E8241E1975FB47144DFF1EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279086, "uuid": "7dd03502-9b90-4b28-9b99-48e3882910c3", "value": "705c756d9fd1066420cba63735fee305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279086, "uuid": "08579737-e9b4-4bc5-8b63-7d40e84b0790", "value": "6144:NnNyeq/qdpo9tUv48QIVuu8FpR/ofg9baRC3xh5mU:NNynC4t43ipGEMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279086, "uuid": "0a9c8d4e-0dc5-41bd-b7a9-f0ccf7eb4220", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279086, "uuid": "557e4afb-403c-4b41-9272-d2a02913fbe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279086, "uuid": "db1397f3-86ac-43f9-808e-c49bdd72a830", "value": "8D11F53D7D30A23D2429E63814478FF7C1B03C643E50E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef08289e-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338628, "uuid": "3e8ae27a-9c5f-475a-905b-abc291e7a33f", "comment": "Malware payload", "value": "537b562bdad10fdefc51ca49aea2465a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338628, "uuid": "16f72972-2070-4a50-ba44-d497f793e6cc", "comment": "Malware payload", "value": "8d5e0a0ed75d979757f015355668cf4f88c80ff8c3b144132797f2db01fca468", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338628, "uuid": "c436a92a-f2ba-47ad-a735-4dac5ab49248", "comment": "Malware payload", "value": "dc1fe4071013bcced45648a79afa05876be6b226", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338628, "uuid": "a72bf806-14b1-471f-b22a-069064a240ff", "comment": "Malware payload", "value": "62da0eb515583427819fd271503e078da9c132d602e6cbfa619faebc6a8cac4dac66468c3cf80c9bb8d00d1428d02728", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338628, "uuid": "a14c407b-8d5d-40c5-9396-e843496dfed5", "value": "77F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338628, "uuid": "add81bdd-e51e-4d45-b49e-793c6e72483e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338628, "uuid": "e2597ead-62c4-4f4e-a2d3-602326e70e0b", "value": "3072:zB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:d4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338628, "uuid": "ffeaad33-9eb3-4997-b998-3d0e538275a3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338628, "uuid": "264e0072-8b47-4369-a5e8-fa5f3bd3300c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338628, "uuid": "fd616eab-f1e6-4ea1-aa8d-874aad8885be", "value": "537b562b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d7b8e7-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285650, "uuid": "645d4212-d8c1-4045-8691-625833092d7a", "comment": "Malware payload (AgentTesla)", "value": "409538c1e72829899747eafa3c7fcd13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285650, "uuid": "758057f4-ac87-4f78-882e-fe8068af6053", "comment": "Malware payload (AgentTesla)", "value": "8d6d3a77b9e0a01010dcb122f1557be9e6727c7a18c38266e1656c21582c302d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285650, "uuid": "b394837a-858d-45da-b012-e32d20a77e0e", "comment": "Malware payload (AgentTesla)", "value": "04dbbea26d4ad02f3983b97e1c8fd12c415d067f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285650, "uuid": "6b18624e-4167-49ee-9a6d-06e80fdbdeb1", "comment": "Malware payload (AgentTesla)", "value": "fb7298f882fe9cd31b004047cc0815507c4b7b2e46a7f61f90588174266d3dd46dd1b0b4cfd8afb8672671335b848334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285650, "uuid": "46ea2c77-f517-4d8d-9474-8bb7cbce0eab", "value": "DF2529EC751074EEC657CC239BCE1C15A6202176972B9607932303BD9E0EE57AF389DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285650, "uuid": "198b80fc-b640-4071-8f2f-b71ae2182025", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285650, "uuid": "0119c2d1-0398-4197-9212-2ed6f5453fc3", "value": "12288:FE9IDwFCmKjfa1oLLoS60/K7yh0R56SC2tnw1YMKqWrB4t4XviETVGrAJ294hNM0:FyIMCQoLAR5ZHSgFXvzgE+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285650, "uuid": "8efb781f-5119-4e0e-b258-b0ff80924999", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285650, "uuid": "44dd67d0-9da8-4e26-a7c1-4d404e87993a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285650, "uuid": "93aa711a-e8f4-4231-b41d-176ffb1fdfca", "value": "DHL TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25d4c74-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280947, "uuid": "769a5102-4a22-4f11-b803-3ec869cc4dd3", "comment": "Malware payload (Dridex)", "value": "87b0a7a84453c3e365fe396290217add", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280947, "uuid": "e4bcd65c-f419-4f6d-9144-5e6e40743a32", "comment": "Malware payload (Dridex)", "value": "8da1ef0e235533b30ea871695498c66d182792139848aabaf119b464357886cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280947, "uuid": "d4e03ca3-4e30-4eb5-94ae-f6f40c00806a", "comment": "Malware payload (Dridex)", "value": "d51956fcf834ba6bc0c151f1a4f9e122da7c3069", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280947, "uuid": "58d50bcc-2734-418e-bd37-30aa28539d57", "comment": "Malware payload (Dridex)", "value": "1b9e26e21330fe7f95ab6fce3373bb0ef41f69981953e7a18cb307f0c4dc0c9cf6cefae809d1d59c00ab0e5d5d1e3366", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280947, "uuid": "a3be7325-09d4-4f19-a5f8-e14da7668ad4", "value": "CFF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280947, "uuid": "becad550-669e-4a29-af4c-a3233b47cb91", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280947, "uuid": "b0514aa0-331a-4e5d-9c52-efcd6202c136", "value": "3072:QB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280947, "uuid": "ac840b54-e1d7-42a5-8c37-079469682510", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280947, "uuid": "12ea593b-b906-47ef-9a09-31eeb9ce05dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280947, "uuid": "3f9f41f9-d69e-49c1-a9db-d52a5335b64f", "value": "87b0a7a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc9afae-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288078, "uuid": "428abf97-23a9-4b21-b4de-b0ed9ead58a0", "comment": "Malware payload (Dridex)", "value": "9c89e8c0cde65f81f42b62653b1d1027", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288078, "uuid": "bc7b3a9a-3f52-4242-83c6-379c52516be8", "comment": "Malware payload (Dridex)", "value": "8dad879340a42ae3816e91ec50b8297c4bce155fb349b52f09b0cf8d9c3be527", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288078, "uuid": "31a9fa16-1899-415f-a97d-3223695eec17", "comment": "Malware payload (Dridex)", "value": "139fd6a3eb012cc66446cf98b724e28af9bdf78f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288078, "uuid": "c7c2f50f-ac28-40bc-a0ae-53de3136da78", "comment": "Malware payload (Dridex)", "value": "f76ebc011b8e7cd0ae9326e33aaef6d5499ff9255e5b32ca4733fa817c275c20cee500f8c9e30ce8336db0068a7e88f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288078, "uuid": "22261ab9-7cbf-4df6-a3b6-315ed44528f7", "value": "B0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288078, "uuid": "02cb3bdd-44c3-4d78-9359-b86ac1d638e7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288078, "uuid": "728d985a-4e53-42f1-bcd8-97a0bbecd616", "value": "3072:Ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288078, "uuid": "df5d91a8-95f3-4946-bd63-06deddf7e02a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288078, "uuid": "88750e9c-1a63-4760-a2fe-75637e1bce84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288078, "uuid": "0dcdd3db-634d-4407-b871-7a8009fe208e", "value": "9c89e8c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805272bd-ae0a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620264569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264569, "uuid": "89ce4d40-a6d9-44a8-baf1-2c9dfa161248", "comment": "Malware payload", "value": "c578926294a3518355e38b08a219a6d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264569, "uuid": "652ff689-6e9a-4aad-a249-7022d74a5932", "comment": "Malware payload", "value": "8de448e9b04ab122593fe24c71cffbc4005565cf40563a2bcbcc7c10f4a28c29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264569, "uuid": "cfa2b2e9-8644-41c0-b0f4-6d0d3b200399", "comment": "Malware payload", "value": "396d60e2e10a6852d68dfca32ac6c7d4ba58a144", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264569, "uuid": "7e66342b-3ee4-4413-b11d-f7675ea2175c", "comment": "Malware payload", "value": "5fa007411f07839332119fa9b3fd0620fae26aec78155bcbe0f9cef9c932255885408586a2d0f364a4f94a13d7360a6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264569, "uuid": "4ec0cf52-923a-4866-a172-1359f8348314", "value": "46D5F6C1F9DB41F6D1078DB288A6922F6B30460883B0CBC7DF682F59ED5B6D1067B625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264569, "uuid": "e3f60971-b40a-46b1-9441-944f6a71467d", "value": "e724bea03515dde29f2b2b282d64f822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264569, "uuid": "cb4823c8-e1a5-4873-adf9-7e694cef6fc0", "value": "49152:q4FvS4FUmDHIdbZDaZsisRS0UR+XAG3kMd7pTWvf7lYp0xxTirpz2Jh8WxW:q4FK4am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620264569, "uuid": "414153c1-1d32-4d7f-935a-490aa444c294", "value": 2913792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620264569, "uuid": "4a098c9c-2072-448c-a20b-fe1f5ec54272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264569, "uuid": "eb1991fc-f2fa-4a64-906a-5b6acab3e1d1", "value": "leivion.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bef88ac-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306088, "uuid": "507e613b-7911-404f-9351-af36dda78dd9", "comment": "Malware payload (Dridex)", "value": "8c6057f6ec51bf04692549669d031db6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306088, "uuid": "cd82d44a-24c4-4ca7-927c-bcc549bc4c2e", "comment": "Malware payload (Dridex)", "value": "8e791216912e8c6561909d836545db0c0ffeff271a569967e0d5e25980ab5c24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306088, "uuid": "70f12308-d0bf-4c82-ab4d-eb249af5e8d2", "comment": "Malware payload (Dridex)", "value": "a5de45fbe49f874640fc3cd3e10b584a38a46018", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306088, "uuid": "9b04dde1-7fc1-4f58-afc5-5d6942a76763", "comment": "Malware payload (Dridex)", "value": "466110cee95662f7edb373cba12eb57daa4bdfcdc5659b0c9cbe8436ee1041f9b4595abee37d02f21716da710bac859e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306088, "uuid": "341688de-0828-4f81-a3ea-3fc4a39b2a7a", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306088, "uuid": "f21f12f7-ffbb-440e-a389-82b2f4c93038", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306088, "uuid": "caaf69ff-b668-49de-a169-4b688692c627", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306088, "uuid": "8384e0c4-72c8-48ab-a6df-49e63894b08a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306088, "uuid": "16ae47cb-4809-452b-9a15-c8ef4a38d723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306088, "uuid": "b89f769a-585b-4678-b067-07cfb36b39c9", "value": "8c6057f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8782608-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620309733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309733, "uuid": "edd804f8-cd7c-4624-a811-a721c0f7364a", "comment": "Malware payload (Dridex)", "value": "d7b34deda1dc4e4c3ab134551084e49c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309733, "uuid": "720509c0-dfa6-4d66-b4fd-a78861649e84", "comment": "Malware payload (Dridex)", "value": "8ea3133e3e9c58c6b0ad5cc0f66e386b5158019b520293dc0f3ed378854c96af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309733, "uuid": "1ddb2449-f470-48c7-9aa5-1aa75f78aea4", "comment": "Malware payload (Dridex)", "value": "282857b49c9f291d5b379c7ae23c6c4a4f1916ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309733, "uuid": "03401cc7-800e-4be9-9001-ceb0bf3ee6b7", "comment": "Malware payload (Dridex)", "value": "f17705bcc93eddc7bd5c6b25bc6a3b3fda36636ed7aad4557b95026747ec2fe0404f3a92a935f895b8d232a21a2562a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309733, "uuid": "45aff0c3-f62e-46fd-b747-5d39fa23c6c5", "value": "27F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309733, "uuid": "591ddca4-9f64-471c-94b9-a1cd2b775d0f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309733, "uuid": "036bb4ed-c4ce-4ac9-8f4a-0b73d2317a46", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309733, "uuid": "0ccbc78b-af3e-4d2b-a0f6-9ffb38c7e59d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309733, "uuid": "5b42bdf2-4f30-4690-acb7-3d2da1364b0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309733, "uuid": "e73df669-0172-400f-9a2e-cf8445c5d909", "value": "d7b34ded_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b85f752-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285606, "uuid": "d31111c5-bb9b-4184-8636-2a0c1e68b22f", "comment": "Malware payload (AgentTesla)", "value": "fb779c6a57ba03f705fec9ce65b702c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285606, "uuid": "75c8d072-5690-4e17-90b2-2df8275a247c", "comment": "Malware payload (AgentTesla)", "value": "8ea91fdbe1081523d28e5b8328e2e63f9ee639712039236ffb31a7ce1025f371", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285606, "uuid": "ce9efdc2-8f0b-4185-a373-271d6557e011", "comment": "Malware payload (AgentTesla)", "value": "0e067baf8e9e4f866066de026651e9de767d6d89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285606, "uuid": "b4357405-af04-4702-ac32-8a049b4bbc96", "comment": "Malware payload (AgentTesla)", "value": "10a6d193f252e3a727b6ed4eeacd03699ecc24259877d4a849f1f9f52c148cc68c6ba86a56f98c9f9c8d75431ffad65f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285606, "uuid": "99f24bfc-b436-4346-be0c-d4a3e4ffa01b", "value": "5D35AE1252C898A4E17B23748862E13947F27E07E672CE1C6DD97C9B3B33681967721F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285606, "uuid": "f4acd7bb-f043-4751-835e-2fd5ef095618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285606, "uuid": "c9f61ef7-e1fa-42ac-a85e-9d50e5b9aece", "value": "12288:7uP1tWmnokMCUtecrZhxGG56D91RthBigcoejq7MglO:7YtxjUte+hxGW6B1DHRUqHlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285606, "uuid": "0fd84524-6d2b-4963-b5c3-c585890c5618", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285606, "uuid": "f6048a3f-5cf1-4cf3-ac7b-1107db6e1763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285606, "uuid": "900887bb-fa1f-45d8-ba01-1352e2ff428c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee989c0-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270123, "uuid": "1ce510f8-9f96-4ba1-ac17-12ad8d7dd759", "comment": "Malware payload (Dridex)", "value": "22c78f650efa222e68c172e8a4384dfd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270123, "uuid": "f491379f-98c3-4b4b-8170-2b526e77a8b9", "comment": "Malware payload (Dridex)", "value": "8eed41893c205683013ffabd169c83281d5910a7b7e3c0935af668340acd82aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270123, "uuid": "e2cceab6-e71e-4165-970c-55d6a344c6df", "comment": "Malware payload (Dridex)", "value": "98938cc6a9ff0bde71f8f68ce5c2b0264ab533c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270123, "uuid": "8551df5b-2f05-4e46-967c-aba33a3878b6", "comment": "Malware payload (Dridex)", "value": "cb72c3813b110d37e4b4cd9c9c0ed4dd6694e2d46a373328de37dffcd0ffdffb03113f8b374973d7f7ce88d2e9cdcc00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270123, "uuid": "35166d64-e181-4350-8c32-04d4bf88473a", "value": "25F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270123, "uuid": "a9caa692-e975-45e3-bcaf-6066303a86b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270123, "uuid": "8f8d4cc6-bd30-4d6d-97c9-6d34137ae157", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270123, "uuid": "7be09a9d-6311-47af-8346-32de0a2ed7ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270123, "uuid": "0d3ec2dc-d543-476b-8a39-9cd6df1cddb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270123, "uuid": "bc8d95e3-9798-424b-b1fc-fead7211d598", "value": "22c78f65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18766998-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331396, "uuid": "599cd86e-3bcb-4705-bef8-5d5bfda306db", "comment": "Malware payload", "value": "93b2236de3c4d3632a91a2cba7681a75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331396, "uuid": "e164e5df-8fe4-4d04-8e85-c87efeb38043", "comment": "Malware payload", "value": "8f7eac908a40a5cc3613becbfe82a16c579c23ac77d4c28331146753ec6c8387", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331396, "uuid": "df174923-4243-4243-b827-d81b015ed2cd", "comment": "Malware payload", "value": "beebf092fb3771e03c5c29f87c5fdfe5f71a5a53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331396, "uuid": "b9a192fd-3fff-41fe-aafc-6d2b3f0a535c", "comment": "Malware payload", "value": "4c5d07be288ff9a1a1cf9eaf007eb3e1c42646b81d428c7ab33319ea4bcc0bd212a00b80a7937cc79dcf03d6a031f5c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331396, "uuid": "85cd06d2-c0ef-4a14-a4a9-2fe53cf0af6c", "value": "70F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331396, "uuid": "715327a4-a6bb-4fc5-bb6b-b47fc1c0c57c", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331396, "uuid": "77ed4889-4df1-4ba3-bce9-86aeba1c5aad", "value": "3072:IgG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idxc:GERMVPG6+Y63HoG1QawL40Prx6Kzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331396, "uuid": "ccdfd04f-fe2f-4f75-95a3-1139d91dcb1b", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331396, "uuid": "9e42578e-12f1-45ae-88f2-a6dac2d99592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331396, "uuid": "b759527e-7dc0-4898-bf1c-f35828a01e84", "value": "93b2236d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f417cf5b-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284520, "uuid": "8b788637-1d5d-4f09-a32d-edd18dc40461", "comment": "Malware payload (Dridex)", "value": "4815310aa215f355250f44d395ba8da7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284520, "uuid": "320daa7c-785d-47ee-adf4-0c1223ebc88e", "comment": "Malware payload (Dridex)", "value": "8f944dbad4f34e002293034df8da2c646b33c433612347d02579f37b458e126f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284520, "uuid": "327c3d4b-aa20-425d-b697-ef30cc661283", "comment": "Malware payload (Dridex)", "value": "0495fe9211b259326bcc318bd25527ea05513ea2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284520, "uuid": "af924495-efe6-473a-aede-42f50eaaa97d", "comment": "Malware payload (Dridex)", "value": "634d267c48a79d1620890123ca29ecbde73e862eb462f3f3f09892e456831174a613a0193db20b5e6f4297279b9fd643", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284520, "uuid": "ba2e99bc-b1d5-4fb8-8035-1ce5469c795c", "value": "B5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284520, "uuid": "c9864924-c97e-4060-b59e-93f6d909c932", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284520, "uuid": "9c5e4db3-f139-485c-92c8-6a96c7a6a5ec", "value": "3072:Ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284520, "uuid": "180931b8-1cf5-4e2b-88db-a29ef7550897", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284520, "uuid": "bcb5d3c3-a2d1-44ba-9b5c-b1761f0fc8c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284520, "uuid": "da3e4934-9d92-48e3-8852-404e1a0c0a3a", "value": "4815310a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba12843-ae6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620307886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307886, "uuid": "4283a9ff-53ee-44d9-ad62-4b4ef4a44229", "comment": "Malware payload (NanoCore)", "value": "3d4f3aef381b1d5eb863123389b7f187", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307886, "uuid": "2482a925-c79c-466a-9ff3-49de03d813a6", "comment": "Malware payload (NanoCore)", "value": "8f94fe68e4decbed1a460bbb09116e1f41fc6987bce37ebb6fd09230d3f89d61", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307886, "uuid": "07fd0f4c-07d3-4449-9552-240b14e19b00", "comment": "Malware payload (NanoCore)", "value": "ffbadbc4280dcbce95a1da4d34cdb03ebe8864d3", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307886, "uuid": "9b149184-56c1-42e0-b55b-2f1c67d86a1f", "comment": "Malware payload (NanoCore)", "value": "d69d7d72ca5f0b4e04afed7010cde61297efb9887629d123bc49f72f0987a46f19327971aca6536c2215efc567e2a3bc", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307886, "uuid": "63b06f3b-9e76-44d1-8889-5e629f68f307", "value": "5BC4230B3A61CD57C882833025B7A7F2EB98C20176C99ACB6FD95744ED532CA295F1C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307886, "uuid": "4dada5bd-a33b-474d-9817-cb91affd52cd", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307886, "uuid": "1b061193-f1e4-4def-93f4-9c8a95f1d15b", "value": "12288:l0VpoRuiXGEpA1IgYLuuinRHzhLsiK3Bs3qGBXFbo1/RXjI4EmYu4:opoRbp8WKZnKBi/HKqbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620307886, "uuid": "83b3bc36-7968-4b76-be38-cf6cfaf7505c", "value": 591725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620307886, "uuid": "4eb89c8b-33b4-4e18-b0e4-622eac63f48c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307886, "uuid": "768bb781-07f3-47e3-a304-0608cf37bec5", "value": "kn(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbe7187-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288344, "uuid": "7845fba2-2029-4eda-88e8-8308c959b5fa", "comment": "Malware payload (Dridex)", "value": "9121586614a428b4a18461a00b50c5e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288344, "uuid": "18fe5ca7-b952-48ae-a435-b18b05608da4", "comment": "Malware payload (Dridex)", "value": "8fc9a3b9a78ba6cfdf57a1dbc8042627f5cad5bfd7b71bddc4466d65f58fb71e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288344, "uuid": "d47750f6-0874-4aed-a700-5a907b283fb5", "comment": "Malware payload (Dridex)", "value": "b8b8a25cac09c69d69fbbe7894dc665689f282f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288344, "uuid": "f75fb255-0fa7-4714-8cc3-84bc62f6ce8a", "comment": "Malware payload (Dridex)", "value": "b863f7e03488b82bba9f94720b058ad3c8dc0b68afd1d9e901b428879de7288afb7cfb86fa840086fc3b2417acb25d24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288344, "uuid": "66b78aa2-f5f5-417f-bcca-e753aba875ea", "value": "A0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288344, "uuid": "772b9651-44b7-4aae-b466-768366c7b85d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288344, "uuid": "e4794f4e-2b5a-4238-9da8-262a8558d8a7", "value": "3072:5lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:5lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288344, "uuid": "ac7b21bc-40a8-45a2-8445-9348f65110e9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288344, "uuid": "03d5def0-ef85-46bb-b7fd-b1dc24e2bd7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288344, "uuid": "d839b981-e09a-4127-9010-d5c51eda42a5", "value": "91215866_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67529cf-ae7b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313300, "uuid": "8f491e7f-9b22-4caa-a214-2e36e85e9c6c", "comment": "Malware payload (Dridex)", "value": "e5e071092f868690ffec9818c5e1df43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313300, "uuid": "37d42e3e-a5de-4a69-ab92-ea365d480fbc", "comment": "Malware payload (Dridex)", "value": "8ff74d6a75c81d2a0a1bbd21cd9beb17a66af964b37a67ccbd9d41a8ae819487", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313300, "uuid": "4a412bad-7627-4c80-8ef4-a0618d136637", "comment": "Malware payload (Dridex)", "value": "1c5bfa1fa724c82d76bc1f055031cbdeead1ce3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313300, "uuid": "ac474b19-6576-4399-aef6-1756a4fded05", "comment": "Malware payload (Dridex)", "value": "104781feedf99d44f3f500cc80743ec4570b3fbb53dd2eb443e306a2ee1e424ae9526d24ebde128568fced1304188f33", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313300, "uuid": "03552a77-4318-4b04-a293-41ce12ad8eaf", "value": "5AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313300, "uuid": "4c575ab3-4e7c-4400-93fb-1dacb948d208", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313300, "uuid": "ac94add8-8cb3-4b5e-aa46-a7c3a9c34414", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313300, "uuid": "d00c53db-b07d-48b5-adff-606f58d08a7d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313300, "uuid": "92575503-ea9b-4f1d-8c6e-cbbc53660205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313300, "uuid": "95dc563a-a4bf-4d6e-a9cf-a52713cdd07a", "value": "e5e07109_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad60033-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298865, "uuid": "1250ec1c-d318-4e86-91b8-fd9315cfa881", "comment": "Malware payload (Dridex)", "value": "4063d45f2f9f6b17ad28e0a08a47a157", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298865, "uuid": "d303a666-73ec-4fba-86f7-f4f67f082198", "comment": "Malware payload (Dridex)", "value": "902d76182eeae90fa56cd648df7693770d9932f7a9285b97416b0fe473dc61e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298865, "uuid": "5b05e6e8-9f6c-492b-8a22-faa99281f610", "comment": "Malware payload (Dridex)", "value": "ae22aa538844f36dfbf13c57bcc9e80b501acd7e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298865, "uuid": "de1a4909-ec33-494d-a2b8-13bf0271e88b", "comment": "Malware payload (Dridex)", "value": "9b6daa1140ec4953e527dc0847cbe67b5adf8e02ff34b6e254d8601e7cfafc72dddb8316b69a12474142d2c283c3f4ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298865, "uuid": "692e4e97-8f29-4e2c-8c1a-a73a1cba0edf", "value": "1CF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298865, "uuid": "71df0c65-84e0-49d1-9f50-7d9593a0c138", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298865, "uuid": "81643236-20f4-44dd-96c4-14b2dbd0bbbb", "value": "3072:AB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:p4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298865, "uuid": "76ad80dc-b341-430a-916d-303ab60231c1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298865, "uuid": "9e1035fb-1e4a-42be-a31d-164220600fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298865, "uuid": "03646138-b49b-4a11-996d-8f4399733562", "value": "4063d45f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecbc4d2-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313448, "uuid": "376c911a-89e3-4945-aac4-0a5889ce4677", "comment": "Malware payload (Dridex)", "value": "289b7c6e19d18c7de61ed3150e663d62", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313448, "uuid": "7d9eeeb2-0067-428e-ba57-5fe062252172", "comment": "Malware payload (Dridex)", "value": "9038d39124263b3a3b6f89fdc90eccf08c523c4bb143f531ecf24dd83f04a58e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313448, "uuid": "14d5fb49-7006-44e8-81c0-57af99d6abe6", "comment": "Malware payload (Dridex)", "value": "8969930963a490bd504483784a6a89fb28660d54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313448, "uuid": "756c1c04-37b5-4680-b627-8eec1a245bf8", "comment": "Malware payload (Dridex)", "value": "87f41805ef701b6bcff630a45782f9d03285cb03c3e7545a69ec15566751660759a3300c68d696d0b6f43a99c7d7cea3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313448, "uuid": "7aa37b88-3ce3-469c-81e3-7b78e82c3150", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313448, "uuid": "29b60240-fbc6-4f48-a6db-ff18acbbd479", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313448, "uuid": "c17c8721-6fba-461f-8732-a06d9ad533ea", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313448, "uuid": "472221a3-e223-4d41-bfee-7784caf48f28", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313448, "uuid": "49553d1f-baf6-4a49-b183-b41605c6bc1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313448, "uuid": "b4996b0f-298e-4afd-a717-595bf79177b0", "value": "289b7c6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4578a3c-ae49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620291687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291687, "uuid": "9c5aced0-9153-4eaf-b8bc-10287bf510c4", "comment": "Malware payload (Dridex)", "value": "0ddcce992f5b742114e58f110990cb76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291687, "uuid": "4b6a68b5-b372-485c-814f-89dd52606acb", "comment": "Malware payload (Dridex)", "value": "90447d364f3ab10a34172df44786253409b51f9377bc0dcc17189edb187d6045", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291687, "uuid": "dd9f4ea4-361e-470e-84ae-3b81cbf2e1e6", "comment": "Malware payload (Dridex)", "value": "2548b775f8db52a2857ad403a46ac6c2a0ea39da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620291687, "uuid": "27a111b0-dbe0-4c31-87a3-0da48e7044c0", "comment": "Malware payload (Dridex)", "value": "2326d96ebad4b94951c0c337033f4025285740c3bfaec15faba2218c7b860de91d2613249b95b0fefdf4c6abe8be0cd3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291687, "uuid": "be64f79f-6a28-40d8-81eb-57bfd08a005a", "value": "8FF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291687, "uuid": "6a1e8885-f88d-4df3-8074-2c6c999350bd", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291687, "uuid": "fb04a4e7-24f4-416b-9f7a-13e4882be6e8", "value": "3072:VB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Y4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620291687, "uuid": "ef5b7936-7c2c-41e1-a7b5-72bbbfff7141", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620291687, "uuid": "49ca9a57-939e-4a22-8db2-18c9721a1f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620291687, "uuid": "abfccc23-68e5-44eb-803e-df46a8d3e9d8", "value": "0ddcce99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae927833-aeb4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620337661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337661, "uuid": "c0704dc3-d237-4d58-bc23-10995e410a66", "comment": "Malware payload", "value": "5cef87c65c9a2545eb8c9151a5fa1e1d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337661, "uuid": "234d4846-e69c-4486-81c7-88091257f6ac", "comment": "Malware payload", "value": "9088e5ed27f14a67077827ca9ec4bf6cfa24b4ec669d253e593a1a2d0c66b9da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337661, "uuid": "561b9d68-7b45-46dc-93f6-56efeccad3e5", "comment": "Malware payload", "value": "2a29b9a456130dc31712e196e77082ab21256abf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620337661, "uuid": "7277196c-28cf-4a7c-a327-7491d2fb81b0", "comment": "Malware payload", "value": "f1e1cfff80a4da14e08fb800d41d643065f56da63c19b44845e07fc6a99be5c5722b94ad3b96dfdacfe9799b26ba5d61", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337661, "uuid": "3d9c9d45-1c94-4300-9316-e8b0830816f7", "value": "5E44C07BF26438EAE67F4237C98268DD637235324956EECE016457C30E637A1DE26E04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337661, "uuid": "04ffb093-6985-44ef-9f26-2b6b87b822a2", "value": "1b67617243a922f784610b5e37db7c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337661, "uuid": "2e29798c-9a8b-4071-8f0f-17da55d0c3ae", "value": "6144:obpjhQX5nE8CBatjBq2PkD+rXpAF7TCc4QWoE/rzcPzny:0jGE8CBejtkD+r5Pdrzcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620337661, "uuid": "44f64a82-ddb2-45af-8446-22059290a2d8", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620337661, "uuid": "523499f7-665a-48f1-a35e-75093c5e809d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620337661, "uuid": "43faff78-d446-498a-8ff1-9b9032da9616", "value": "ster.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530e3255-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620316891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316891, "uuid": "6ba2c360-8172-474a-be53-ea8f6854c18b", "comment": "Malware payload", "value": "21d2628c81d4122a211041f93fa83e1c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316891, "uuid": "4e186472-a769-4d9a-9d61-27a7177c1117", "comment": "Malware payload", "value": "90a4424704c9c68f734de6f7fd896f16e4256afe59fbe7626b3d45d5a601d604", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316891, "uuid": "232bbb14-bb3e-4dec-8043-95e958a6d9c1", "comment": "Malware payload", "value": "b0b9c440102d6015d16961b7a382f99b90377b80", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316891, "uuid": "4f180c2a-74fb-408b-a09e-5fd6f4609a22", "comment": "Malware payload", "value": "26b123ce25384ef97ca5a9f038ba239e8f52adb553554ac68daf1d287c3fa4bd8c820cef417381c8c23a7c42b072b0dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316891, "uuid": "4fcfe960-fe12-45a5-b6da-85e4acb5a2f3", "value": "3E6301C2E43634CDC6696004453520541EECB5F94BFAAF5F5C7A63222B3BD9B42D2A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316891, "uuid": "9f43fff0-d223-4e8d-86e3-ceb7d02c857f", "value": "1536:pzNwwvuxRQ8t6Y5+6HmdquVSatCP5wMH21nTvSnlptbT2j8280TZC:luBxMu+ldqutchj21nTvSlDbihhTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316891, "uuid": "c3595262-345a-4dd4-a2ff-714eb8c2154f", "value": 70269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316891, "uuid": "071e02c6-cdb9-4e31-ac67-87a071d0625a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316891, "uuid": "6e186f96-d78c-44f0-97b9-79ac7e99355c", "value": "21d2628c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4775c2b-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339040, "uuid": "a00e0b49-7e71-4ee3-a243-5034c43976bd", "comment": "Malware payload", "value": "c4199c333d0da5f17175af551be6a061", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339040, "uuid": "89018ad9-ac64-497e-9bce-e8fcf76bcfaa", "comment": "Malware payload", "value": "910f278ebf65fbd5ae7f1737b106bea8b94b9eec1cce2b62543b493c303cd12c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339040, "uuid": "bfad082c-a676-413d-857b-7677a014eaa6", "comment": "Malware payload", "value": "eef66ac98615da8ecc86deb867636e2d4680d590", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339040, "uuid": "1cd9a092-bd71-487e-b24f-691d7cbc693d", "comment": "Malware payload", "value": "2fcc28ecd57c959e2e52561a33a3579b3e2c267d79153e08c167cc6e22450f3e672ae81210c1875d58a774c16c40bcd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339040, "uuid": "84ecd522-0256-42c9-812d-915f26e4f70f", "value": "D4F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339040, "uuid": "960ead17-3d61-4b5c-995a-6645b63788f6", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339040, "uuid": "8f74c933-9c44-4f2c-8b72-7434ea550288", "value": "3072:6OG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:qERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339040, "uuid": "9c6cdc68-e807-4cf5-89da-5497562703e8", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339040, "uuid": "74b01c17-fcc5-4d47-8c10-9b3556e2d1c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339040, "uuid": "a6431e4c-b1fb-446d-b439-da53ff2d2002", "value": "c4199c33_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db1ed13-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298870, "uuid": "fc2e095a-41c4-4d8b-a9d0-f611088d9373", "comment": "Malware payload (Dridex)", "value": "9e5c36ff7ce03793f9708bdfc57b51d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298870, "uuid": "a11b0d2a-73c0-4297-9603-e57e3a8424a3", "comment": "Malware payload (Dridex)", "value": "912a09b298a2e8ca4be233812dbf0c9526e0b3a51d195c9796f6e974c16edb7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298870, "uuid": "cb9e0562-21a4-47b5-8361-e005ad20e209", "comment": "Malware payload (Dridex)", "value": "9980c7a79c10f30e6b0a05053fff27f44ab1517f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298870, "uuid": "e2d81f58-e4c1-488a-95d4-7f1a3c69b26b", "comment": "Malware payload (Dridex)", "value": "7c387d35330e8538df7cd46b6aa95b31bcb2d7bfa2c84379280b153cf81e4c182f22375bf8a5a14ffaa342f28de5c502", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298870, "uuid": "7691a6ea-5707-44fe-97e2-b73d3fe31077", "value": "ACF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298870, "uuid": "f930459b-b82c-4cf7-8364-ce9f3513c43c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298870, "uuid": "431bca84-28f5-4250-bae1-52b7dd9b20b2", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298870, "uuid": "2c15153a-72b4-4d3f-9f2d-d3243e6d45ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298870, "uuid": "2d08c624-849f-4e5b-bbf0-a2f2ec21652b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298870, "uuid": "c9cd1552-de0f-442d-b3cf-911d22165e97", "value": "9e5c36ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff50f4d-ae2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620279359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279359, "uuid": "6c3cadf9-acf5-4458-9e82-25e11723b94d", "comment": "Malware payload (NanoCore)", "value": "d8a0f0e6634d84575bb69ff9b8a1e89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279359, "uuid": "f80e3272-ee8f-487f-8c42-37d42f24ed33", "comment": "Malware payload (NanoCore)", "value": "913574659edd36ea6a7617997395486def7ca9acae904d7bd1f420df371442c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279359, "uuid": "2efd3d56-df9e-4d9b-92b3-c28554ecc38a", "comment": "Malware payload (NanoCore)", "value": "d2128e6475064aff887f0f8722dfaa858551302a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279359, "uuid": "73bfd999-589c-4627-9314-09221a6ee232", "comment": "Malware payload (NanoCore)", "value": "eeb7591cf71d857148e41e96041ce9ad749b32946202f81faeb54fa8e3861ed4f4c9df42ee7cff66cfdfc817a8a15dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279359, "uuid": "d3f15582-5331-4aa8-aa2e-dc0b98bc4610", "value": "6535AD2222589A24E07B633484A6C13947F67E03D276D75DA9E97CDF3B336C0DA67213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279359, "uuid": "b46f5c31-9d5b-4c40-8580-6458843a6eb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279359, "uuid": "2f7f6cc1-fa8f-471f-9a78-9779f9a045d7", "value": "12288:Lx/a0ZnoXYX+3XCOavgbIz4Deh6WRGguPW2qoRrIdZBpmoM:L8T/ggbIz4Deh6WcPHqognpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279359, "uuid": "e639af8f-0dde-4757-97ed-c0f205b11e9c", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279359, "uuid": "56fa3275-7ddf-485a-9953-d7ab93a8bd2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279359, "uuid": "ae45a2ac-2cc1-4f6f-ac8c-ad101da17ebb", "value": "PO 39483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0400ffc9-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277245, "uuid": "a351af7b-684f-4fe7-bf15-ac1a620bd1ee", "comment": "Malware payload (Dridex)", "value": "444c485f52410dcd9752360a927515d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277245, "uuid": "07b9fbc8-c041-4dc5-aa14-42ca9b0e19db", "comment": "Malware payload (Dridex)", "value": "9179fa908cebb8ce1342c88f6dc987ef3428121a4ddbfaf406c83b2c46851720", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277245, "uuid": "1b1e61b0-ca9d-4e91-bb7d-547eb32887b8", "comment": "Malware payload (Dridex)", "value": "813b35ae16d22610e6c535051d7fa19728ca8b3b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277245, "uuid": "ef13bd87-1b02-4441-b4b3-c248cb483dd7", "comment": "Malware payload (Dridex)", "value": "23bdc814fd41510dd5777c90e8aba5168cb4d8d3ea6af404451745f1a97fe696c4a04baf7096c815b71dfe86a075a5fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277245, "uuid": "0902df70-ca11-4872-adf2-f889940cef91", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277245, "uuid": "7d2ca866-1e19-4768-8ffb-5742c0231cd5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277245, "uuid": "637239f6-5f9b-4e70-a2cb-ba82a980c3a8", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277245, "uuid": "b044b340-d92c-47c3-91e3-d9f556b8caa8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277245, "uuid": "f3af2f68-47ac-449b-bacd-4c368a04b780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277245, "uuid": "5398df0e-c3da-4676-9012-896dccc2a43f", "value": "444c485f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65408dc6-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339256, "uuid": "0381eba5-dc3c-494c-9070-eabd14f2f52f", "comment": "Malware payload", "value": "1ad4acb29a0b72029b6932da5125a857", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339256, "uuid": "d9c6867c-9a5a-4841-84a0-fda88e5f6fc7", "comment": "Malware payload", "value": "9181687e3a36905dcbe3ece6b418bf4a2465412653e2d94bf8444e466bec7b68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339256, "uuid": "f1656edf-8a52-4aeb-9a90-c0b5a30a0430", "comment": "Malware payload", "value": "1c6fafd7d19c043332e84d156f4ed1661dfe532e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339256, "uuid": "24e3abc6-873e-409e-bbcd-0a364b1d933e", "comment": "Malware payload", "value": "bf205b03a567f1c72f67cf11af4b129f0f7888879cd9868d4dcb05d3446c4db641c65e70fc98ee86baa4f7b71454c18d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339256, "uuid": "78b6288a-e81a-459a-8dce-dba81c3ea1b4", "value": "65F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339256, "uuid": "56098d7e-caa7-4d24-9ea4-618fe354b111", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339256, "uuid": "b91cd99b-32f5-4d3a-b9c5-6aecdafaad02", "value": "3072:4iG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:gERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339256, "uuid": "dfb53c65-3618-4d66-b89b-c7044a1a6d38", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339256, "uuid": "029de9f4-e816-4683-9cef-576625c9e05b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339256, "uuid": "b2a315f7-4b14-408e-b9ac-07765e9fbe56", "value": "1ad4acb2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb3dc76-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324132, "uuid": "787e74b6-561a-4fae-b907-ec3e7c993ad9", "comment": "Malware payload (Dridex)", "value": "cd78cc3913bcc42247aeb10fa58369a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324132, "uuid": "49156ed2-3dc9-4b20-8d36-028d55ed8279", "comment": "Malware payload (Dridex)", "value": "91f5ecea41f37d1beb97dec65fc62020962a273d9fca274909cafdb8bb46efdd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324132, "uuid": "9818283d-58e5-4206-923e-4a407fc71e16", "comment": "Malware payload (Dridex)", "value": "585e0e70be2fb5d0bd28fba6f29cf14d5ec1d1ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324132, "uuid": "86f1bda0-d428-4a77-8ddf-7e8822cbcc0f", "comment": "Malware payload (Dridex)", "value": "3a5f85006061d88876865fc55044396668bd746cf2e14fed117bc7422be914ef89bc0a1a003c5931b442dc34745cc6eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324132, "uuid": "4befb295-6195-45a3-b609-9d5020c284d5", "value": "B4F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324132, "uuid": "9f731c45-917b-407d-b8d0-5547d341c713", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324132, "uuid": "5c919c1c-50fa-4dd4-a9c3-0dfb954e08c3", "value": "3072:5WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:542IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324132, "uuid": "3ecf60f8-6e97-47af-9d5c-5ba81eb07825", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324132, "uuid": "8fe8e810-1edd-4b8f-a2e1-4c251e60356e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324132, "uuid": "7276bd0a-852d-4c8f-86d8-0dc2f92d1c3d", "value": "cd78cc39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671560e2-ae53-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620295879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295879, "uuid": "3edc6acb-fe0c-40cb-9c9e-c6e00d7de1f4", "comment": "Malware payload (Loki)", "value": "12b6c8af3571d571a6b57590d2bf86d3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295879, "uuid": "c4eeea44-bc8f-4d1c-aefc-be7862caa29f", "comment": "Malware payload (Loki)", "value": "920cfa0bc03efe3d5cb364c52dc4fc9c7af072a5f1c16db0f6035ab83c299485", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295879, "uuid": "f9ea39d9-8317-48e2-b2be-3b5a4787e1e7", "comment": "Malware payload (Loki)", "value": "9d78122224066ab5821a0b5ad41b00fd3fba2795", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295879, "uuid": "4caa1da1-385f-4d57-bce1-e976ea2b1693", "comment": "Malware payload (Loki)", "value": "ad849394f06964e04ed9b108861bea72143124642bc8505869d1d59be9d49c486ac8eb218bd2f71e513e6e3ca7bfee68", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295879, "uuid": "7536087c-24b5-45bd-b24d-40e17b3216b4", "value": "8094230B50FE4A67091D32332CCBFE252BDAD93EDE053E91C7EA272391F406689D514A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295879, "uuid": "740ff741-0cd9-4429-9747-0cbb2dca8cf6", "value": "12288:rQGdCOqASz8ecMDQ+aJHnjI9+TZ8LHOT5cVjqKdqn9GfEg:rQGgh1xc1RU92IuGbKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295879, "uuid": "c74480b9-1073-48f5-a262-674f7d0b6583", "value": 411887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295879, "uuid": "56f06506-6f13-4754-8384-55319724e98c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295879, "uuid": "e1125429-cf94-4eae-8635-dc330711f38e", "value": "payment_PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa46c045-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266491, "uuid": "4aad79d5-41dd-4874-9db1-b816621fe9d9", "comment": "Malware payload (Dridex)", "value": "b0f20f75dc63497d45b45fbf68c80389", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266491, "uuid": "cb95bbed-387b-4b50-a78a-ddde48150442", "comment": "Malware payload (Dridex)", "value": "9258e2d77caf7e8e6917904cab2d85fb37f52ca5a6794419e0f5e1b2f0d00dca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266491, "uuid": "cdd83e8d-cb64-41d1-8108-ffe6cdc71fde", "comment": "Malware payload (Dridex)", "value": "c5733ad02f2e9266b8d769e5524ac16cf1c71b67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266491, "uuid": "b15c7b21-4978-4b42-9f99-d30ad89cb239", "comment": "Malware payload (Dridex)", "value": "0d492119d2af40eec72373806d3bd2efd39adfa6eb7383711f4b96061651ed26ad92822e2ccea26cbfd213988756b33c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266491, "uuid": "cb4ff907-dde5-4db1-8a63-aa5f42332ee5", "value": "24F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266491, "uuid": "4c7ebc47-c41a-459e-8ecf-4dc8ae321367", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266491, "uuid": "3d186e1e-d38f-44c9-bb84-0396644a5157", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266491, "uuid": "406dd0e8-b549-4751-8bf6-483bc6270d7a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266491, "uuid": "5a342545-0213-4441-9c42-d6ab788407aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266491, "uuid": "5099f923-9119-4e51-95b4-a9e249a01c2e", "value": "b0f20f75_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81262338-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298930, "uuid": "9123a16c-603e-4985-b15d-7da2357df35c", "comment": "Malware payload (Dridex)", "value": "ca111d8857c8d2d6acc310f296caa891", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298930, "uuid": "a4388b9c-2118-40de-b441-8643af98e7a3", "comment": "Malware payload (Dridex)", "value": "92d284871b147968222e9c75c3f470c7311ee367a577c6e0296ab3af57c2b821", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298930, "uuid": "6264393a-2e44-4c5c-8f70-aa894561c19a", "comment": "Malware payload (Dridex)", "value": "8059b142db8a36e5899541db6bd491e677d12e03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298930, "uuid": "99229774-9408-47da-be07-c725127393a7", "comment": "Malware payload (Dridex)", "value": "40723975a59639545316a36352a82a5b41467c9cec4065dc4575df2a8ddb69c3ee052caa14ea955f42785306cc8c5525", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298930, "uuid": "4f620f61-1184-4e11-badb-13bc49f09cef", "value": "D5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298930, "uuid": "8ab2ae3e-0a29-40fa-97b6-42b52ac831ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298930, "uuid": "dfcb6459-9438-4d0a-8fb2-670ccfca4c25", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298930, "uuid": "e048265f-1c29-4f56-9577-02ab2b772c1a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298930, "uuid": "79a2a4e7-a895-4572-b602-d52932d6b20e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298930, "uuid": "eda8c3ef-dfa3-4347-9780-6f86119b4d40", "value": "ca111d88_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdceb535-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331351, "uuid": "bbe76184-6055-4ca6-85ff-a991235ea7a9", "comment": "Malware payload", "value": "9402181f724c5b968f75e137910209fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331351, "uuid": "90a4d3a9-f546-4dfa-8776-872f05035189", "comment": "Malware payload", "value": "92e63688b5523b34c073da3a1c3f6adacaf4821586095effb14d73222a22f9a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331351, "uuid": "31c0eb72-7fd5-4733-b012-37ed2a2b4cc2", "comment": "Malware payload", "value": "e95564911fb3639c3b2983d136543c96729d34cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331351, "uuid": "51503860-5f6a-4e08-9f66-e9c2476491fe", "comment": "Malware payload", "value": "521b2692694571e8042bcc77cd5c9dd041e37c31942e768bd47c653d3031ecd5b8e1949eb3ea36a0c694e11dd0e62c73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331351, "uuid": "736b695c-2157-4578-8777-4e7c95c6a9ff", "value": "C0F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331351, "uuid": "8de128d7-fa5b-43be-b6fc-5316f12a9d44", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331351, "uuid": "28670b9d-17cb-4684-b534-1d336e166a98", "value": "3072:dbG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:UERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331351, "uuid": "ead45bec-bcf2-4360-831b-94d6fac82abb", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331351, "uuid": "7647edda-b909-4cd7-b5a6-0aad7e557abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331351, "uuid": "e7e697f2-2f01-45b7-8b0f-14a9090a0039", "value": "9402181f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e268664c-ae2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620279766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279766, "uuid": "15eeeed0-705a-4783-86e7-40dccd2c570e", "comment": "Malware payload (Loki)", "value": "9ab93ee5d5c33f5d2e24d7da3d7c0548", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279766, "uuid": "6f6e308f-1ecb-4537-bb87-1e5bbebcfe20", "comment": "Malware payload (Loki)", "value": "92fa3ff0d5172b171d48e6a2b6ea7f9a64acf8a1da47da598666067ad8bfa000", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279766, "uuid": "72fb07a1-fad2-4511-9316-93d94c9f9b72", "comment": "Malware payload (Loki)", "value": "710bddfe47d9a612c9733b762d21d4acb3149713", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620279766, "uuid": "44bb1669-219b-42e5-96d7-3610bad1d62c", "comment": "Malware payload (Loki)", "value": "b122e87d1c17689ed5ae3e0864bbee4b61d08516d62ef809ac6f3c039ce824e89e4fa490bacae770578cb0373b9a4635", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279766, "uuid": "4675c81b-c4b6-4406-ab9e-9e9c16c1a5d8", "value": "0AA423C5FAA945DA0B0A5FE912922CD55B030F7A36C45B62C307F9A78F014868CBB7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279766, "uuid": "f9c299dc-11db-4c6e-983d-1ee394deca13", "value": "6144:LTqy3/ty9Cvl4kTXXvsV+VRNPPtf8N842XrM3KbJlO1hICVeS20GewMEWWI2zp/c:Lmy3GC9rTXX++QNmXrMad+e/dIGT+Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620279766, "uuid": "185f8032-be5e-4ce8-aac4-3d6af8ea772a", "value": 477656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620279766, "uuid": "564770d2-e29b-44cd-adba-bb8cbd1a85de", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620279766, "uuid": "3275d8ed-1870-4e78-89e9-2b284bc5ba19", "value": "Original BL_cargo arrival notice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbf5581-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270044, "uuid": "8893ea99-4df2-4bdf-b501-39921a1c7f53", "comment": "Malware payload (Dridex)", "value": "25d1d9e83df5b6af1649ad43c7c4f457", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270044, "uuid": "2ab7c216-1451-4fa8-a260-dcfe1967a118", "comment": "Malware payload (Dridex)", "value": "932397629a19b844f5bd85e470eb6914b3fe1b6da2887142aaf150904b74cfdb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270044, "uuid": "9461afda-0713-4746-9865-a12d52b74e15", "comment": "Malware payload (Dridex)", "value": "fcfa9485921aee9bb25396fe69f6ef5dd65cbde0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270044, "uuid": "247f2bf4-ca73-409c-aab0-3cde36b6601c", "comment": "Malware payload (Dridex)", "value": "bc9ff9bcc8f049ee18e762eaf20817a40938696eb51d87c67eda5d869ac908c02a683ecdd814e7d124182b9899841f14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270044, "uuid": "a6fc845f-2271-4fa5-b154-95b7d455ebae", "value": "A6F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270044, "uuid": "da016f3f-f7ab-4e3e-a7b1-75945da66fbe", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270044, "uuid": "a3ba8c37-2fca-42fe-8136-5d3e754ddd8d", "value": "3072:qWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:q42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270044, "uuid": "c96ef966-51b0-4523-a0a6-55a1ac61b099", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270044, "uuid": "5b2a2f97-1880-4637-a5c2-eed1fdb227a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270044, "uuid": "60fe833c-2e9f-4326-97b8-bbbff24b4879", "value": "25d1d9e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327f36b2-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331439, "uuid": "a730bbc8-273a-474f-abc4-e5f60a611b82", "comment": "Malware payload (Dridex)", "value": "33c05975e7afe1aa4e58f4f3a274c283", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331439, "uuid": "65644180-a76d-47dc-aa27-81dc4777a071", "comment": "Malware payload (Dridex)", "value": "934c456268808f2e3603b16d013dc8fcf9f7a41ed433e79755dc5019b95bb184", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331439, "uuid": "f104287d-e5d5-4807-82df-ee4f9be86c46", "comment": "Malware payload (Dridex)", "value": "5dedac434e84f59a3c9084c4bcb4e14b5a2fbd51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331439, "uuid": "7b01a8c4-d466-437b-94c1-043128783596", "comment": "Malware payload (Dridex)", "value": "b2fecb1ff47010c90713cbdfe3cf02723de19ce4acf3ac878d3e7eacae04cc7fe765a7344c9d3f4df9b4df0119cd1202", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331439, "uuid": "8768099b-d10c-4518-af0a-4c311461a06c", "value": "A8F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331439, "uuid": "03177d42-c8b0-4a5c-a8ab-0fafff970063", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331439, "uuid": "cc6e1c9f-9107-4024-9444-4704d81d153e", "value": "3072:1UG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idzT:VERMVPG6+Y63HoG1QawL40Prx6KNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331439, "uuid": "bc4f56c6-0b9c-4b3d-b9ec-0a82caed6a00", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331439, "uuid": "a9c2d869-798f-427f-8c2c-94aefd80205d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331439, "uuid": "3517a079-6eee-4e09-981b-3db7cfd6463d", "value": "33c05975_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3712d9b0-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324146, "uuid": "e2374284-b46f-4b67-80a2-4dbd3d0f8418", "comment": "Malware payload (Dridex)", "value": "c027a8d7f109d360f1b63ccdeb08f3fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324146, "uuid": "e30bf7b5-f831-40da-a49f-f2b748f7fdc8", "comment": "Malware payload (Dridex)", "value": "937d9291b78cd8a6d0510bbc61378d4bb4788bb62541b8a25b7641aab33c0c40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324146, "uuid": "85702e20-d95c-4b03-a432-5b1cd4204f04", "comment": "Malware payload (Dridex)", "value": "e9c7cd9f6d5541a4cec5653014dbcb03fa7da3ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324146, "uuid": "f0101047-d8bb-4f09-8dd5-498242ba9c67", "comment": "Malware payload (Dridex)", "value": "f08da6a6c066a5e743fa643c2e7ea2340c1312ef59644866ee809182d69b441c6d3dcbdb33c12ace9e6f2f106d8e4c48", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324146, "uuid": "c8586af8-99e8-4adf-beb3-cbd067303b1d", "value": "E0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324146, "uuid": "7aa9fd8e-a87b-448e-9005-5a31d8fa6c67", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324146, "uuid": "c304b960-31e0-4c27-b4d9-6477542575a9", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324146, "uuid": "f7aacd54-efdb-42d3-873d-741ae1486d2c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324146, "uuid": "1bf27536-8587-4961-8960-fc99fc41de0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324146, "uuid": "c51e35fd-017c-42fd-9ed0-7afa340465a4", "value": "c027a8d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d03b36-ae3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620285142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285142, "uuid": "344a8076-3596-488d-a8e8-b1d377dfc56f", "comment": "Malware payload (SnakeKeylogger)", "value": "169b159346753e92169ec203e22dabfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285142, "uuid": "5c78c1a7-d646-445c-b2d0-bcdb1ce7e4b7", "comment": "Malware payload (SnakeKeylogger)", "value": "9384918251945136a9f8a1972064b7d88b8d3d12d78249b6866f75f22152a6b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285142, "uuid": "b7f5f7ca-1cb6-421d-8ae3-b4fa79f6e4f2", "comment": "Malware payload (SnakeKeylogger)", "value": "5b5a3ab22bd3905a749fad6db067168911f26929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285142, "uuid": "bada42fe-2771-4060-9500-c850bd88880c", "comment": "Malware payload (SnakeKeylogger)", "value": "80af51c855933ff47a6e0b7442b6c9687ec1711db7d94d61429dbbd9e55a97f45e7ee15f480adbff5caeab19cf2aca18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285142, "uuid": "4df0a3a2-cb5a-481a-8fc2-eea72c0560f0", "value": "3D259C2262989924E17B63748462C13947F67E02E776C31DAEE87CDB3B336C1DA57213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285142, "uuid": "aefc2a68-f1dd-4904-88ba-ad20550ae9a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285142, "uuid": "666ca254-f26b-40d2-8d1b-bc69c92265e7", "value": "12288:eGAKqenoKs5J32eoVODvJH1YkNpYiYT0BeclX2VQdM:e6Rsz42o4CiQ0BFF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285142, "uuid": "276023ab-1375-435c-83d4-30a9938d1435", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285142, "uuid": "a01238d7-38db-4f75-9ddf-f76c11920755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285142, "uuid": "9d4fb9b3-b2cb-449f-b58a-cad65bed85ef", "value": "Potwierdzenie Transakcji_20210505_123255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a264dee4-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339358, "uuid": "253b3660-504c-4cf3-9355-efc8de898b6e", "comment": "Malware payload", "value": "cf3782364555b16f4d3b3fe143f09650", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339358, "uuid": "c5b84866-7608-457e-859e-389cc10ab914", "comment": "Malware payload", "value": "938c5481ede1966de8addadbc02e572e8cc82405e84c12fdfd5481c587186ad5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339358, "uuid": "9f3c9f98-d2a8-46b6-b8ca-74877eb7f0c8", "comment": "Malware payload", "value": "3ace844817d584b059852454c5079d9d431a55fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339358, "uuid": "bd5e1e8a-c009-49b1-826e-631cb1eb4335", "comment": "Malware payload", "value": "9698f7ae82d5f304b8cd4352d6a3dc3a9592bdf43181977fd88385738fb18635324a1b490ee2565226e915f62fe576d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339358, "uuid": "743db797-44c8-4067-ab6f-4d789f766f44", "value": "92F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339358, "uuid": "07e8d75b-dd97-44d0-a3c4-3777367cb5cb", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339358, "uuid": "5251da4f-299e-4e65-a19f-dea10dd41e82", "value": "3072:9eG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idDf:XERMVPG6+Y63HoG1QawL40Prx6KRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339358, "uuid": "2fc55a14-4043-45b3-bb2c-da8a322c9a3a", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339358, "uuid": "1f41722b-6edf-485d-8ed2-f53b76e525ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339358, "uuid": "c69a49ab-8082-4fd0-b22b-65c1970038b0", "value": "cf378236_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f890ad-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620320465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320465, "uuid": "039c0941-0f88-4b6f-bdb8-7ac644df40ea", "comment": "Malware payload", "value": "4474dd4c14f76b6b40f855b9aae628fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320465, "uuid": "2e4c70fa-9948-4f62-a3fe-07711f179b81", "comment": "Malware payload", "value": "93e5fc51525d584a80db2505638f0f9237bff8d01adc330049a414b45c7a811c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320465, "uuid": "b3085058-8d86-45db-96b1-6e7ad03a36d7", "comment": "Malware payload", "value": "226f5e308048746b650ca7dc587fd92639f938e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320465, "uuid": "b96990f6-70f2-4ee6-b09f-2695b82486ed", "comment": "Malware payload", "value": "639c9555bb0b5e9236246e4bb6ea775352e6e617e6b8efca8315eca1c56bdc67d6509dbc2453fa727cd00acd00e1e04e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320465, "uuid": "29c0f873-6ee9-48de-b4b9-c92b6ef61350", "value": "69139D1AA9CA81FAFC04DDFCF428450E9E288711051DA0EBE4785FC3DDA6506799F1AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320465, "uuid": "cc4bdf60-bd94-4c56-8675-ad214fff8760", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320465, "uuid": "adddbf50-a8b3-4476-beaf-b3bdf96e2a53", "value": "768:GGS/PPJ69K2c5r8OsDBZpAYqRHAZorOs1gxuqkB1chYsNbp6SGu4nQvxVH2oOB4:yPRESOn+YC1ZB1chYsNl6SWn+Lc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320465, "uuid": "99aa3904-f9a5-4888-90c7-b8848ffbbfc3", "value": 42121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320465, "uuid": "2eb72381-28ea-48ee-9b95-c0273f0db102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320465, "uuid": "fef069a1-a457-4e81-a17e-a148960ab57a", "value": "4474dd4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1496f1ae-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331389, "uuid": "911b945b-e37f-4847-b786-99c75d10cfd7", "comment": "Malware payload", "value": "489c5007018724e47ae9fe13d4852a32", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331389, "uuid": "6fa1e89b-201d-46ab-ad7d-c9383b45c5cb", "comment": "Malware payload", "value": "93f7b82370415f73c496eb6662543f4408890afcd18dc61e9fbc3b8280b618f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331389, "uuid": "c52ff9ce-1a7b-45b3-bcc5-cc0dac9c4c44", "comment": "Malware payload", "value": "4c152d580024869f814b1849caa8665653bb3cba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331389, "uuid": "11a70c97-4f99-44ec-8fe5-93b1232986dc", "comment": "Malware payload", "value": "0d3b33df2578e669fa121c01002f448270598dfc7709701afbf1801e34eed157eac26c25883732c3e35697935aaa870b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331389, "uuid": "a8965306-b278-4dc4-a072-e47b3bbeace3", "value": "B8F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331389, "uuid": "593007ba-79ed-4149-80a6-e89fa15ceeb7", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331389, "uuid": "44ff5268-c615-4e2a-95c1-d94a108bf84a", "value": "3072:bgG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idxc:rERMVPG6+Y63HoG1QawL40Prx6Kzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331389, "uuid": "fe0c5e5b-d975-4bbb-bfba-756cb7c33f35", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331389, "uuid": "4be977c7-b956-4b84-bfa3-3c94a0eb3d62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331389, "uuid": "b3ce69f7-1aee-4805-a32e-c9b447b20fba", "value": "489c5007_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f5ecbe-ae5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620300928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300928, "uuid": "3af42278-ced3-4d8c-84b3-4090802f594f", "comment": "Malware payload (SnakeKeylogger)", "value": "bc157274f79b2678bc89da5c5fa5b4e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300928, "uuid": "1a5632ef-05db-40d8-82d2-1d5c2d657db5", "comment": "Malware payload (SnakeKeylogger)", "value": "93f7c4d75c87f8529f9a6a493aee8eb22952d4e7f3f0f9bad890180a828c381d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300928, "uuid": "29aa7f3c-26ad-45e0-8ff4-d4c4ade8ffb7", "comment": "Malware payload (SnakeKeylogger)", "value": "2d746fe600ea14001f7f57a2a1e4c43553b15f7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620300928, "uuid": "a09f5a2f-3291-49ad-8572-98b4c5155f9f", "comment": "Malware payload (SnakeKeylogger)", "value": "8c81df83304d95359ea0b8f1dfb98408d5f30e58c84c34c229d077bc3ce06e4dc73d159d411ed0688e3e1cf49f11c10e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300928, "uuid": "d6165121-7210-45a6-9884-266a7c2db692", "value": "701528EC761075EEC657CC22DBCE1C25E6202176572B9607932303BD9A0EE57AF384DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300928, "uuid": "4500a502-1bbd-4038-9eb3-abcbfec5f8e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300928, "uuid": "04ed495e-e699-4af3-9597-654655219e94", "value": "12288:2PCx5a7NoLLoS60/K7yh0sGPL7Mze829F7nfIwhm/JLrSRYY6/E8nMz2bX9/SLxe:2y52oLAFLae8enfbHG9qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620300928, "uuid": "1ee67aec-cdfa-406c-b92b-0ea59e4718df", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620300928, "uuid": "458ed2c3-9a70-4f6f-b2c0-922ba395a54c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620300928, "uuid": "f99a2886-f264-48b7-bc0e-bd8f513ca3f8", "value": "PO #KV18RE001-A5193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4e9f35-ae51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620295274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295274, "uuid": "5d25af72-bebe-4125-bbf0-c06530bcb787", "comment": "Malware payload (Dridex)", "value": "bec0ba8cf9a6b26555e2bfdf9ccf61c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295274, "uuid": "f2b3b490-b9e8-4601-ba9c-d0e9ae9af268", "comment": "Malware payload (Dridex)", "value": "942629a4e0c1586efcd0b2bcc9d2334740ae98c788b4aa34735ae6c30f8f3640", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295274, "uuid": "dc746e2a-d766-49f8-a68c-92774e109832", "comment": "Malware payload (Dridex)", "value": "d0126477032f42793622286c743a6766035382b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295274, "uuid": "4f7b0c9c-09da-4eae-ab11-a1a0ecb93e19", "comment": "Malware payload (Dridex)", "value": "94c1a98bdd34868a72c36d3d68ad676bfd4933f7a7566783a7059ccb2ca2477c396fbe50e26948afd7a4bd2ae26327ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295274, "uuid": "ab4e86de-f324-4387-bffa-3d796b5d5fca", "value": "3EF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295274, "uuid": "9fc58e82-95c9-4aaf-bb46-65e71741e6fc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295274, "uuid": "45c9463a-5e76-43c6-8763-7adfc253b7a3", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295274, "uuid": "5318399c-32a5-4486-ac63-11260daa0ba1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295274, "uuid": "7f8945f6-542d-425a-bb32-6b50f979c57c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295274, "uuid": "d94e5f61-6cb6-4c16-b204-30bbaca3aa07", "value": "bec0ba8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15072e44-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313351, "uuid": "87006a1e-a75c-4938-9365-c2546153ff0a", "comment": "Malware payload (Dridex)", "value": "06661ec05d1e9a6cf8c5dac2ceeaca07", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313351, "uuid": "bf415ed5-8bfe-4e26-9b1d-9ede07f0f2de", "comment": "Malware payload (Dridex)", "value": "9435a6a7f63ba964ed309110d729e520e3a27888cb0a8a6bcac252554558cd15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313351, "uuid": "63eb99ef-246c-4a76-aa49-49daf637d5f7", "comment": "Malware payload (Dridex)", "value": "cb1b4984fe279781f204ab73149ab8f0ac8fe099", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313351, "uuid": "74b89fb3-2eab-49ef-bd4f-0a8642f3a919", "comment": "Malware payload (Dridex)", "value": "029cadf4a1a80ae0818dcf6d1c56c0769df9751c0730120ae3383f70d16b0d4e3a940bfb37e24d788a4c0fb6cc315fc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313351, "uuid": "aee2b6ff-7bac-4077-a217-8ec9656e7ac4", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313351, "uuid": "4a0388c6-b39a-408a-9b8a-ec8e61eeb556", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313351, "uuid": "8dabb29d-c32d-4515-8044-887b839985f7", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313351, "uuid": "a3434fcb-8e26-4b5f-b8f9-d9dffe88dc34", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313351, "uuid": "afb2f881-5834-4dc6-9b3c-b01f2fb9e374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313351, "uuid": "3e31e672-2425-477b-a534-e4b377c7c9e1", "value": "06661ec0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a126191-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339344, "uuid": "82e7bda5-101d-48dd-82f6-bdedabad7301", "comment": "Malware payload", "value": "03c35536e330dd15e93e6e50af8cf232", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339344, "uuid": "ffc440d9-c65f-44a4-b046-2ac2acb99d67", "comment": "Malware payload", "value": "944655dd1f8ffe2c466f0399506321a8382f1b2060f6b57f030b58fa14436d64", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339344, "uuid": "b124b039-63b0-4599-9a18-f586f0e999e8", "comment": "Malware payload", "value": "de21f84d860831229fe988cee50c9513348c5b00", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339344, "uuid": "94bde3e5-e4d5-4888-b140-90757cc9fabd", "comment": "Malware payload", "value": "8f26cae300f44568a0b9ebe2db6e2dc2c1a5425237dc023ab223c3c27d192e6e1a2277396181efe1bcc6e0f7eea20f91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339344, "uuid": "dc553de5-4184-4004-b142-b9a49845d578", "value": "27F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339344, "uuid": "bea3f1d8-92e2-4087-aeea-999f962e0d36", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339344, "uuid": "82c8813f-fcad-40a7-874a-d83cd1da9ad8", "value": "3072:0B45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:y4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339344, "uuid": "5ecf3d76-5dad-422b-9970-2eae58fbd70f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339344, "uuid": "990e521b-a056-46fd-9bdd-e50fcd03e167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339344, "uuid": "1c78bbee-735a-4fe0-8e37-36526d188ab0", "value": "03c35536_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d76d33b-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338867, "uuid": "4564d9c7-2d1b-450f-8a35-58cb5a5befe7", "comment": "Malware payload", "value": "d3501333b2de3b1e2ce22a9a74d4e06a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338867, "uuid": "0dc0d689-eddc-47e0-a713-9c8ab0c11ddc", "comment": "Malware payload", "value": "945928484619f594e2812cec77f29d4163db6f6355dac00f4bd0de3501673b10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338867, "uuid": "fd9161f8-2c95-4026-8df3-0b89b3e7fecd", "comment": "Malware payload", "value": "f76f0adfc4d554eb9619936205a33894c92a0bac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338867, "uuid": "954ab6ca-fc05-420d-bd75-b4780415ada4", "comment": "Malware payload", "value": "9da51235d8498548101fd760425a53e23583e4860f0985259812d64d21618967cbbf629b9b6643c370c08856621a142a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338867, "uuid": "e84f5ae2-97ca-4660-bbc5-dde3e5f2b05f", "value": "87F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338867, "uuid": "9a9244ee-8b04-4a2e-b8de-27d670001000", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338867, "uuid": "8cd2ccc5-2edb-4d1b-bd55-37a93ac48c36", "value": "3072:COG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:SERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338867, "uuid": "1a4cda6c-3554-44c7-a351-655a5533c746", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338867, "uuid": "8320bf7f-669b-4758-ab93-241f1c6d4180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338867, "uuid": "f73937e8-2112-4eee-b97a-5897e2a5a63c", "value": "d3501333_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5df0a5-ae7b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313308, "uuid": "683fcfce-c721-4e87-add6-8900e28f8dc8", "comment": "Malware payload (Dridex)", "value": "344cb673e6dd50d17a281b55866d7eb9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313308, "uuid": "defa1e76-1bc7-4429-a6a6-3f5db0dc3aaf", "comment": "Malware payload (Dridex)", "value": "953dc352fdcc9a482f0eb451fcc97f8823a1ab004ef6bde0002fc0286a2517f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313308, "uuid": "8eaeccf1-8a66-41cf-a2ba-d08b6170db05", "comment": "Malware payload (Dridex)", "value": "d06888d6d65e938965090ccc818d52e5650585c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313308, "uuid": "ad0b4115-59bc-4c53-bac7-69dc3d7b5180", "comment": "Malware payload (Dridex)", "value": "91e9dca64d4d828bdc582614be2b4d22436a94e74a095d72fefac0d412874ea850bc8cb4477c809035eaaa3e2833b5cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313308, "uuid": "62f4f8f1-c2ee-4ff2-8ec9-c8589c14bee6", "value": "54F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313308, "uuid": "532b4417-eea2-4820-918e-45d5c55b82e0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313308, "uuid": "31ac0df1-9de5-4e55-80a0-d76e3d0da485", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313308, "uuid": "960be21b-35fc-410b-b7e0-0b8d76201dc3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313308, "uuid": "17776e88-d4fd-45b0-86af-530aa068eb7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313308, "uuid": "cd318102-d394-40d3-a605-fea23ed0f553", "value": "344cb673_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5209fea2-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270074, "uuid": "bf3ba4af-4367-49cd-bba0-37c6fb441039", "comment": "Malware payload (Dridex)", "value": "8260c8960fb0d006ed78075d104c6f57", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270074, "uuid": "1b5728ff-5893-44a8-93de-deaaf65423f8", "comment": "Malware payload (Dridex)", "value": "95415ae4fd82bd7a9d52b37ab837e6c2614da5cad8578ca9ab483b686076be71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270074, "uuid": "cf5c8312-4ae2-492c-ac08-f4fc1ed47805", "comment": "Malware payload (Dridex)", "value": "fc62d5383971631f765e86619ad236d65b49b33b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270074, "uuid": "05a475d2-4992-45b4-9b97-72434af387d3", "comment": "Malware payload (Dridex)", "value": "de68cba9150239929b7738ba1933a56c0218fc8533971b0b2cc6bfdcc38e0845b04b14058a5fa75cefdecce0b0729cd4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270074, "uuid": "7d81cbbd-73aa-414a-b5a0-2083e088a33a", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270074, "uuid": "83207e9b-3f1e-4526-aa5b-85289ee5eefd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270074, "uuid": "25e2ba02-ab3f-4c65-9f47-2cc6aff9c88c", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270074, "uuid": "2a981b3e-5d71-4348-8357-8acbbd2702fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270074, "uuid": "dc1a01ee-ff22-4546-a54d-7cffe95ba884", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270074, "uuid": "54541cc2-5fcc-4c01-8079-217f26f08d0f", "value": "8260c896_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0758a9-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288321, "uuid": "808eae9a-0dae-4bc7-9f12-1e6b4daff4f8", "comment": "Malware payload (Dridex)", "value": "c8752ee0c69bfda100200de97f87d63f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288321, "uuid": "12b62155-42d4-4a83-af57-784e50c1dc47", "comment": "Malware payload (Dridex)", "value": "95758e07cc1d3df3b7804534a958fca62ed9f8d3b07ac1d6b6d7414a409bd6d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288321, "uuid": "fb9be8af-56cd-49cd-8626-3781edaa95d0", "comment": "Malware payload (Dridex)", "value": "198231526c4f3cae95deb43634d047b333439fa5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288321, "uuid": "1b47db10-5744-42ba-a562-80e66ab2fb25", "comment": "Malware payload (Dridex)", "value": "c6214858d06a40f9ee5b6edf1b23791b98b92305ed2a4b4e7b2d041cb404c091a61b77a98574de07f24ac67d50253742", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288321, "uuid": "71fcf1b7-a4ab-47d3-acd8-9f193371306c", "value": "49F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288321, "uuid": "ec61dcbe-53fa-4bec-887c-e66bc82a1720", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288321, "uuid": "756fed3e-bc1f-4ee1-b52c-167e69e3add5", "value": "3072:qA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288321, "uuid": "08e9d7bb-c4de-4786-91d1-bf88856362ce", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620288321, "uuid": "f40474e0-0848-4e9f-82ba-7b83bf814fc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288321, "uuid": "4d77faac-a75e-4cdf-899c-75b9f4cebb2d", "value": "c8752ee0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd62c7f-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339322, "uuid": "2b6d0e02-e3a0-41eb-898d-0b94441657bb", "comment": "Malware payload", "value": "f6b9f7f5c00f562a9473f2de7c2db15b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339322, "uuid": "44b8bcbe-66cb-4463-ac63-5e9cd408be8d", "comment": "Malware payload", "value": "95d5e0b7b79e6b39b82777579326547363b8b043ee21c1d73357fb115bbe5c27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339322, "uuid": "a9ad4d61-6341-4882-b20b-80537941a45d", "comment": "Malware payload", "value": "6638943ceee39367a33aff7f327d343185ad09a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339322, "uuid": "8e8620de-654d-4e41-87af-2935d273b99d", "comment": "Malware payload", "value": "e9d18c776ee46d00fa59d244811c9581166d24af2bb1e644fa154944edb6f85a76ac9ba2eedfb1b0dbdcf723d8130648", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339322, "uuid": "f481726e-4f92-40b4-8343-76e6470c8f06", "value": "DCF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339322, "uuid": "fb904671-0cc2-4f6d-8c92-05aaa402d790", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339322, "uuid": "de54af41-895d-4949-96bf-3364a19aa014", "value": "3072:R0G/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idWR:dERMVPG6+Y63HoG1QawL40Prx6KYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339322, "uuid": "8076a416-baca-405e-beb4-cb48b00344db", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339322, "uuid": "1faaadda-f167-48b1-935f-a2600e6b2bf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339322, "uuid": "a48030ee-42af-4d18-a5a6-29c09ab50c86", "value": "f6b9f7f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4282c1cc-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259311, "uuid": "1de31645-200c-4106-8def-ba30cb0c20ed", "comment": "Malware payload (Dridex)", "value": "dda39304c8887316f17dbdc55570b92c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259311, "uuid": "7d3c916a-8a2d-4f8a-9ff3-affcc5bc26a2", "comment": "Malware payload (Dridex)", "value": "95fd99f1049ebd45f27d347057778736ae2ec5cebe461a03bf04d43e8ec83bbc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259311, "uuid": "67ae9ecf-bcc8-43c6-b4e0-f19c5aa6a612", "comment": "Malware payload (Dridex)", "value": "b9478ef597f7adacb221a7aa049d5f72a416785d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259311, "uuid": "398a8d9b-6910-4dd8-b77b-23aa42a2f17c", "comment": "Malware payload (Dridex)", "value": "9cab952b45f4392ae83ec64a98de33b4af7874137c49b1f1aeaf2ae24f2168788aeb56ba6aa27d3550297a928487fff4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259311, "uuid": "c403aff9-f0e0-464e-a70d-0b8520790a11", "value": "46F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259311, "uuid": "c3027e26-e185-4148-ada8-a99d4694c0a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259311, "uuid": "41748b3d-36f3-4fbf-8213-927a6cd42ba9", "value": "3072:PIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Qc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259311, "uuid": "e9f1c07a-02f5-4487-8b64-0182bfa3f405", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259311, "uuid": "39e20048-9177-48a5-bffb-d696743a1533", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259311, "uuid": "8db266ee-1ac2-4e5e-ab10-520f1914e058", "value": "dda39304_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bf2801-ae29-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620277917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277917, "uuid": "d40c1430-888a-4fb7-bc46-2842b486fcf0", "comment": "Malware payload (ArkeiStealer)", "value": "c7abb4646144318be1dfaf42c59e25e6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277917, "uuid": "ab3c4acd-e47c-4992-9629-85e8a8e8a747", "comment": "Malware payload (ArkeiStealer)", "value": "95ffa72b44189488760bdfcb0e31cf8044a01d801f50c3687fc961b57fa7dbf0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277917, "uuid": "2b050a56-4e3f-48f0-8160-e7a7d84b9a14", "comment": "Malware payload (ArkeiStealer)", "value": "5b419efa77a251af62953795f0c66eebd0b4a237", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277917, "uuid": "dfc9a7bc-0891-4bc1-90d8-7a1dffc64b0d", "comment": "Malware payload (ArkeiStealer)", "value": "c731627372a6beb8afbea4ec6c27a16a66c179485e29406b63614f8e2008db2ad6c5fa94331ad500bb0b4c2b184bdc5a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277917, "uuid": "6a022fd1-5dfd-4dfa-ac08-596b97ecd7c8", "value": "1FD4CF23B1D2C037C0732172CF5AAB664EBAF920493398976BC819595F641E1DF3E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277917, "uuid": "df264f51-0613-4b68-a706-b042e4215f4e", "value": "bb312fa6f53e023726e767b93e2e81a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277917, "uuid": "2452238c-c165-467f-b04c-b2a5705444ae", "value": "12288:HJLjXAH777cgQ17elB3N3vgxqK6qLh5hHMuedDGvTa3Hl/JoLRm3:HJvO77a7elTfCnNLPhHMF9z39J53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277917, "uuid": "fd3d40a2-bbb2-46ad-b6fb-2947d0e50bae", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277917, "uuid": "10ce4cca-dfa7-4b3a-a8b0-291a62f5e46b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277917, "uuid": "7c2820dc-f9fa-4750-a911-2c4507aaa4b2", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fd8b9f-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338772, "uuid": "1e7ffd2a-bfd1-47fb-b367-fec55a6c72b1", "comment": "Malware payload", "value": "9f7d30590fbbd35d6b63487b99cd4243", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338772, "uuid": "cc50a625-5815-4e09-8268-f03763e49f41", "comment": "Malware payload", "value": "96794bfff57cdb41d50b55862e8d5e5eadcc094d68528048d087213f4467d8b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338772, "uuid": "e7503e46-b625-478a-8dd7-dfe7507b0513", "comment": "Malware payload", "value": "7746ca6fcadbe758e3457cd02dd3b6161c52c5b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338772, "uuid": "f381abb7-55de-442f-8ee9-ef97d707c93a", "comment": "Malware payload", "value": "9a3230dbb939ea02aed934b0bf7ccc9649cdb26f80eac03e82a294a3b452713c586f610dbe2b8dc70ff95407bee54b73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338772, "uuid": "5e2377ea-697c-4dbc-9e5a-76c7c04d0717", "value": "84F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338772, "uuid": "6a638703-5d5e-42ad-a971-1a53654689bd", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338772, "uuid": "2604023c-5d1c-4fad-b9b4-f129f2d0d9db", "value": "3072:GiG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:uERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338772, "uuid": "f65a5520-16a6-4bd6-bd3a-6ea2964fdce0", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338772, "uuid": "f091021f-41c3-47a7-9394-646b6a67ceff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338772, "uuid": "455d570d-b14f-43aa-8460-1c2991e559ad", "value": "9f7d3059_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009897b5-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266502, "uuid": "8042a46c-7118-4f55-8609-799fa8fb4a6a", "comment": "Malware payload (Dridex)", "value": "0b50189ca6d98a0141bf2f9ca8494289", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266502, "uuid": "55c613a1-f748-443d-a616-37dbf319cd7c", "comment": "Malware payload (Dridex)", "value": "967a99a5e4692f157f6735e208773916b8d8a475e006cc044dce875b6aec9807", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266502, "uuid": "08603345-c3ad-4a11-a6aa-1d6e0e8b8d6f", "comment": "Malware payload (Dridex)", "value": "6f88ae1543f4b572a3fb55ed5204dfcd29443110", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266502, "uuid": "ac40d769-1be6-4ebf-8ce2-247ad2f2bd93", "comment": "Malware payload (Dridex)", "value": "49211d47272018ffe90113c701f0740007cff6ebe93b67b11ef2fc836fe08634c6dd19335f095e85db92587d0cb919c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266502, "uuid": "e2faa57a-bd7b-4ae5-b8e8-2cd620b5ae91", "value": "53F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266502, "uuid": "34f2d0b2-6ca1-43f6-a407-75dd02e7764d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266502, "uuid": "5403633a-ec78-4235-8199-2cdce659e9c3", "value": "3072:0IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Nc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266502, "uuid": "7a525ca0-0652-46e7-9c00-101dc24dd544", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266502, "uuid": "d320fc12-b5d7-4dee-9d7a-99474932e759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266502, "uuid": "20f0c760-df32-4b99-b55d-eb79a507ec15", "value": "0b50189c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472b0d47-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285518, "uuid": "267bb191-c6d4-497e-8feb-f94235b216eb", "comment": "Malware payload (AgentTesla)", "value": "52d2257ed68bd596ba0d634eac71b6fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285518, "uuid": "78f322cc-4234-45d3-b931-208384b589c9", "comment": "Malware payload (AgentTesla)", "value": "96cc5646d1f8bd9ccbcbca75c1edc925bb226ede142c3d26db23c4c66ff95b1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285518, "uuid": "76bccd78-c868-4c8e-9ab8-fb33044c4b7b", "comment": "Malware payload (AgentTesla)", "value": "7ff68849caf7a8fb2754ede7001dcb610ad5085e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285518, "uuid": "2fb3232e-881e-47fe-b92f-43c7f1df4d17", "comment": "Malware payload (AgentTesla)", "value": "256486be40b6ff69aeb27b0fa943b0fc171279aa793c417e324b90d618d07d2a46c6b179d7d1381f42a71774278afc8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285518, "uuid": "112980dd-4dba-48a2-81a5-abc0783fbbd0", "value": "D235AD2262989A24E17B53749062C13943F67E03E276D71DAEE87CDB3F33681D667213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285518, "uuid": "a67775f7-2fd5-435e-8538-7ee6d0c2320a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285518, "uuid": "53c19b46-4d96-4916-b53f-ccfcb531f983", "value": "12288:45ggYRRnoN2Hc+QxducpDtHlJG41HcvjKRe9M:4LYt8v0mt+41HcLGe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285518, "uuid": "ea8fee5c-f4c1-40ec-9bef-59234c72f9bc", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285518, "uuid": "9cab1540-fc14-404e-b9dc-336b4fd78745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285518, "uuid": "328f868e-9e8f-4599-9acb-8da1f756e994", "value": "PO#110090059-BH0124 REF#SCAN0217252 EXW HMM SO#GHE0080947.xlsx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e6b32f-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313333, "uuid": "42432f9b-e83c-4498-960a-fc430eeae75b", "comment": "Malware payload (Dridex)", "value": "47170fe0244978f39f65a7308cb21d21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313333, "uuid": "f68fde8e-bab3-4474-9afc-4ea00c4a6e1b", "comment": "Malware payload (Dridex)", "value": "9716399d1194171ff2ce1d938a9277549a88e087ab2bebf62f294d5f87665cc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313333, "uuid": "ed54bbc1-4222-4db9-af2a-248d6d7c681d", "comment": "Malware payload (Dridex)", "value": "81d505256dd5ddd37b395f129a2012740239ce36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313333, "uuid": "5aa45875-7fcb-48a5-b354-2cd25b295085", "comment": "Malware payload (Dridex)", "value": "af6728eead416445d544ab052bfa68e5962e83779433e043b011aa2c18ed075dea6049044814570713d1ff910732183f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313333, "uuid": "dace80c4-783c-4195-b904-067e85f2b47e", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313333, "uuid": "734e96eb-d8ed-461c-af18-188b4349ed7e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313333, "uuid": "445ae7b3-be07-490d-98dc-b4ebc60c1f02", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313333, "uuid": "7f46aedc-675a-428e-82ed-9b0927bd8a43", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313333, "uuid": "0bd781fd-a7e6-4c4b-ba50-a609b532cfd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313333, "uuid": "7166c6bf-8921-43b3-b59b-0fb5068d252a", "value": "47170fe0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81fdefd-ae0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266461, "uuid": "39cb04ba-fda3-4dc6-a4d4-fb6446bb2b9d", "comment": "Malware payload (Dridex)", "value": "0b57092ff2c888b963e679d5e21fc130", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266461, "uuid": "39f80efb-4830-4635-b5de-2f7857d89449", "comment": "Malware payload (Dridex)", "value": "973b95cec572f9d5ed98e4dc5657933010adaaed37da46c5561ba1a0aed019be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266461, "uuid": "66f4a517-558b-4f34-b5ea-1a31dbfbd89e", "comment": "Malware payload (Dridex)", "value": "3a1698503b64216290e3c6543c62afedb899fcae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266461, "uuid": "a31a0072-5a10-46d1-a074-4aaddd3c655b", "comment": "Malware payload (Dridex)", "value": "5656f53115acabfdf78fac7a346dfb4563e2e7222c55f6d501363443cfcf59b7aaeeb6fce83e0098f95780b7baf81758", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266461, "uuid": "b5bda605-18f9-4507-bda8-976286a9abb8", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266461, "uuid": "f294ee80-ea8d-4733-9633-eabbd40e30c2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266461, "uuid": "4dea6928-73f2-4529-b999-022cb069fe48", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266461, "uuid": "3c049de2-c93b-43da-8f6b-5f00f259b286", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266461, "uuid": "56c9adca-0b4b-4da7-a7b1-8b61cac65795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266461, "uuid": "9516e121-edfe-40c9-999b-b976f35d3922", "value": "0b57092f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d5d9d0-ae53-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620295911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295911, "uuid": "22c7f4cf-a3af-4060-82f7-628137951b1c", "comment": "Malware payload (Formbook)", "value": "61f942cbb67b5a5de8f72dfe65227175", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295911, "uuid": "a38caac0-1769-4b3f-b109-8f11792e26ec", "comment": "Malware payload (Formbook)", "value": "979a3e20b43d1aad57018b9c867e4bde7606d0515c9c71b2050b02c0b5e5fd10", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295911, "uuid": "12557708-b0b2-4bbd-9c8f-d6e13b8cfa16", "comment": "Malware payload (Formbook)", "value": "45271b8b2797e1232efe813d9d34e9ca9c7564a4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295911, "uuid": "7a15a400-e10f-4acd-9491-cbf651a4f6c4", "comment": "Malware payload (Formbook)", "value": "265094bdd7f7f0280e37916d69a26aa8ae65cd5dd5bb50453beab8b8c2a5b37c87fcd0a46f96bd675fba2b6787696d1e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295911, "uuid": "d0ad267b-a1ff-48db-b3e4-4a4da8142001", "value": "2E2508AC31C474EEC21B8C329FCA3C1596102875562B9D079F1323BD9A2ED57AE354EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295911, "uuid": "b266e0a3-3f1d-45cf-bce2-66079b0656dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295911, "uuid": "6289be84-37bd-4263-b8c3-c07c4c6f7d77", "value": "12288:j+8GYPToLLoS60/K7yh0gG2MYR9dzxMwi8FYoFx0T1y2QOq+dtqKmqYwgYs/eBAz:j+8GwoLAgi4XdNhx0Ry2QOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295911, "uuid": "e0cc61bf-14c1-450a-b2c7-0a688f720065", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295911, "uuid": "9b20f112-d0b3-47d8-a7f3-fc6b246c34a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295911, "uuid": "340bf356-6fc0-400f-bd32-279b5852fe1a", "value": "REVISED ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2ee4e8-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339165, "uuid": "378f06ca-9a9e-4a1c-8665-35801664010d", "comment": "Malware payload", "value": "1a7fee510ad5590c00ebbd7dedca3771", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339165, "uuid": "85ab5e45-da4f-4b5c-a52f-3870d74495d9", "comment": "Malware payload", "value": "97a353ecaf51e7c439b45de3f8f9bfbbd8e7a1b742120f7651d9b5dbb16f38d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339165, "uuid": "c9032948-5130-40df-a910-39ff6dc44f1b", "comment": "Malware payload", "value": "7cfef713bf5220625766dc6ef60ea14c7f2b9976", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339165, "uuid": "b93ee186-feea-4fa0-b9f5-d60e460840b6", "comment": "Malware payload", "value": "d8b92951514db66cd2235a7275c8525201db8df81eaa439afe9f61f44bbf09974d1c33fbcbb6284706b24fc2271ca3aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339165, "uuid": "cc6bbc25-8a7d-46c9-8641-2f00bd1e0587", "value": "15F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339165, "uuid": "62a3e8fb-002b-45c7-8f73-f06c54b8a2b8", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339165, "uuid": "eed01197-56cb-44c9-a7aa-68d3a18d9cb7", "value": "3072:dC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:84KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339165, "uuid": "2e614a3f-6933-4b5b-9967-f8fc404e7ae1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339165, "uuid": "034ae898-63da-4e33-ac22-e93984437134", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339165, "uuid": "f1f08847-9070-4099-b106-0ceaf60fcbb5", "value": "1a7fee51_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b67e48-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331359, "uuid": "ab287d19-37c3-40e3-a197-c30a9f589198", "comment": "Malware payload (Dridex)", "value": "72b18e5d541f6229952a28c093ed641e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331359, "uuid": "add33c6b-f3b3-4e00-992d-10db3ed6e511", "comment": "Malware payload (Dridex)", "value": "982fc39628c917ca3b6d895ba59206d912248991b891d05808557e9bcee727ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331359, "uuid": "f29efa47-0544-4772-8f28-eb3f6e309150", "comment": "Malware payload (Dridex)", "value": "ba4af6af5bd048c4aee79cf82ce1f9241a6b0de6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331359, "uuid": "9142a9fd-1f65-4f9e-a615-fca8ed16f1de", "comment": "Malware payload (Dridex)", "value": "ec2e50c71dadde16f9ae169099874900b77c3331100a6cd86330d5c08eb42f24922f4d7eda43a474329a07d1fa5fe7a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331359, "uuid": "023d1f85-ab91-4052-bb35-82167c3b82f5", "value": "AAF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331359, "uuid": "51105915-2769-4764-9441-201e44e3b17b", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331359, "uuid": "e5a286fe-6851-4712-ace7-18170386a45f", "value": "3072:zbG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:2ERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331359, "uuid": "cfeeaf53-d433-4f8f-a8f4-f5121337741c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331359, "uuid": "f5d084b1-43a2-4ca6-8ec9-32df915678af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331359, "uuid": "cb015f59-78fe-4019-a2cf-c54f077c7dae", "value": "72b18e5d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3573742c-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306104, "uuid": "5710df00-db98-4c9f-aaa5-ee5b8909b93d", "comment": "Malware payload (Dridex)", "value": "522aef69f88ba4db65f5071222c5e33e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306104, "uuid": "36659138-c414-4791-80b7-015ffbdeacb9", "comment": "Malware payload (Dridex)", "value": "98c0db2a74d3d28bfc80fe0db363c1db72add6cf7246384d9b905fd8f9cefbd6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306104, "uuid": "f9a48c92-d691-4768-b788-6161c7593d3b", "comment": "Malware payload (Dridex)", "value": "374e529799c7d1abac9f71ea64fbd2b455339ce9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306104, "uuid": "c8253b6b-be98-435b-846a-db7b9c626d1b", "comment": "Malware payload (Dridex)", "value": "efb6b29240e4b58cba54060413dad8c9928f6943210c23ccad0253c165dfe7809d0e70e3bdd4adb9ea46c5c2310e6b8c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306104, "uuid": "dc080e08-159a-48f9-ae03-fe17d83f18d5", "value": "7DF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306104, "uuid": "6ae8ae5b-650f-4742-8b6c-bd8759a9fc24", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306104, "uuid": "8d14ba35-e26d-47d4-85b6-01197133b90d", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306104, "uuid": "c09d7665-588b-4edf-a4ec-961ee2423f2c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306104, "uuid": "243c4eeb-8e37-4122-881a-c2ec6707ff29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306104, "uuid": "0525547e-45b1-4805-bf8b-37c437990aa2", "value": "522aef69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ba3719-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331423, "uuid": "6471c481-b5f7-4dcd-b9a4-9f4a732bcf08", "comment": "Malware payload (Dridex)", "value": "5be3f5196be442b9bdd521502ad589d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331423, "uuid": "c0d07932-6360-4187-a666-2fbc5fb29e0f", "comment": "Malware payload (Dridex)", "value": "98dcf1626a72842771e86e917c695ba42a0d4339c5d82410d230bc2b1b39cede", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331423, "uuid": "53a10937-77a6-4b46-a4d2-6855c33a7a71", "comment": "Malware payload (Dridex)", "value": "b6f6e4661bdd8d7e24207c518fddb2c4adb19862", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331423, "uuid": "f12c0835-48ce-4aa1-96f9-fd0244edea42", "comment": "Malware payload (Dridex)", "value": "127117a9fb2e85b9d419c7eefe8f58fc34ec8c0646f0008fa3b34b11bc7004e2189c27bf32846d4c5f30ac80a9abb903", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331423, "uuid": "a1d29652-6f65-4179-af90-f8d320c9c03f", "value": "66F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331423, "uuid": "d2fccb94-fe95-40c9-877e-51790ef8d102", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331423, "uuid": "0a762c0d-04c6-41e7-ba22-adeca9edb3ab", "value": "3072:2gG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idxc:AERMVPG6+Y63HoG1QawL40Prx6Kzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331423, "uuid": "8e65584d-478e-44ee-b1f2-6d7fd5042f30", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331423, "uuid": "52bb8846-0ba0-4cec-abc6-5cfb092855b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331423, "uuid": "026a2613-77eb-4d13-9c6d-0c92bfd1424b", "value": "5be3f519_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc88dd29-ae3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620286144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286144, "uuid": "73a664ee-8c63-428e-b1e0-45153dcfb1e1", "comment": "Malware payload (RemcosRAT)", "value": "187e55965acaf3a1b7d4af227b8a97f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286144, "uuid": "34e664ce-adbc-415f-af03-8b67a13f0d80", "comment": "Malware payload (RemcosRAT)", "value": "992ff2cda226636077c32a5481799a950354f4a647bc6a5266cd8b1820902621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286144, "uuid": "4a6450ab-117e-458b-b880-1fd901af72d5", "comment": "Malware payload (RemcosRAT)", "value": "c1a0f081459ba0595aa85a5c14998a853aede3f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620286144, "uuid": "73ed8615-0e2d-4970-8360-ac81fc66be06", "comment": "Malware payload (RemcosRAT)", "value": "c3a175ea756768fbeb55074fd14a445f158fe871468b76114a00fb9582cd728910b7473c2dcdfbe992561b8e9c447421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286144, "uuid": "6a124ff9-49c4-46c0-b296-994ef2bc49ec", "value": "CC45E76053CF529937B89E2193C9948E4D636C942E3E7242A9449737C2B2CD5CFF1F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286144, "uuid": "550fcf8c-1ef7-41cb-b6b5-1e2dd0102a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286144, "uuid": "f22486a1-86d0-4ca3-a6e2-c8596822b9fe", "value": "768:lTj+ruyYhoGGGzGtGaGlGxGTGZGZGpGYGvGMG5GcGMGVG5GEGLGLGDGxGjGSGNGJ:lGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620286144, "uuid": "0e8da78e-63e1-4cf8-a69d-a1acfa79bb39", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620286144, "uuid": "019af27c-8730-4cb3-826e-7c15db8f0869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620286144, "uuid": "eae741ec-90ea-4418-a758-e44f31f74d77", "value": "187e55965acaf3a1b7d4af227b8a97f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1ad373-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331320, "uuid": "229dd7c9-b3c6-4422-b3eb-8482557275d4", "comment": "Malware payload", "value": "831aac06490cbf1390e621bfe977fd9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331320, "uuid": "0590ea44-9e75-4306-bf1e-76b74e78b315", "comment": "Malware payload", "value": "9966ea9fe28fa0fa0195765723dc35c2f5cae39e3aa74bac953b7ffc04f4d484", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331320, "uuid": "43527dfc-3de3-489a-a15f-4a30eccdf538", "comment": "Malware payload", "value": "142e5c640420a563692409ace3f4eca70e5bb677", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331320, "uuid": "c4be1d84-072b-4574-a235-e8416cad489f", "comment": "Malware payload", "value": "d7f4bd4d438b12e93f43b9e08599261b0b2dbe7386ba9b12ba4806e3fa8ad2254e7b4dc9b3de7615a21ea68c778fcc7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331320, "uuid": "6a45ea7c-a4c1-40af-9d6f-00a57c8afef6", "value": "AD931253EFE680152F6F792D114D261A3CCAC2E8D5D49EE88F335AB24DCC9446CAB853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331320, "uuid": "23739abe-5b30-4af7-9a08-00b6e4e4c557", "value": "1536:5e9DvxtsI8Ka8ymzXXdd/naP538Prfo+1th5LcUbYS8tK8sIu933J27qiLVOiAK/:52v4IQHmbNAh3UAMth5LcUbv8368j9b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331320, "uuid": "ff47094a-abf8-46c4-b03f-608ca6dbccbd", "value": 93717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331320, "uuid": "535e58a5-5aee-405b-b906-f5e58980031b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331320, "uuid": "0ad422da-968d-4062-9e06-823be8b11f01", "value": "831aac06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1c3b6c-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298920, "uuid": "cd9c2945-2ef4-4451-9ae5-9b91bae8bf89", "comment": "Malware payload (Dridex)", "value": "140e8a09b6020f86884ceee6b96a60c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298920, "uuid": "d2ace947-4111-40ba-b1fc-ef90beeb06a2", "comment": "Malware payload (Dridex)", "value": "999e410d11c1a2396f2f85c828781a01ac0cf7e03b327a067b8d0bc97cdb27dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298920, "uuid": "13f4f961-35aa-4bec-b5f5-d0d2c8be78ea", "comment": "Malware payload (Dridex)", "value": "a946821c36c07d34c534cbc4bda212ff97b9af47", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298920, "uuid": "6b3ab435-6d5c-4023-a872-747293de697d", "comment": "Malware payload (Dridex)", "value": "98056197188cde5d015e74b57eee87530732a72fbb1388c453c805fe68d33fe5c30ccaaea2475d46f2547e917a291c6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298920, "uuid": "68842cf8-9d89-4c0f-b5fa-d015e82248fd", "value": "4DF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298920, "uuid": "2485996e-6a18-4248-8815-d3c8310fdf0c", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298920, "uuid": "61b24006-7e7d-449e-b4c1-8f1e28aa1f77", "value": "3072:re45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298920, "uuid": "3e96d6f8-0c3a-49ac-b500-89427a61f182", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298920, "uuid": "6e48b2ed-39b5-455b-a937-b5f019abc539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298920, "uuid": "c10fc270-55a4-48be-852f-c52319353b00", "value": "140e8a09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5555ec7e-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298856, "uuid": "15a9b19c-1492-40a7-a00c-4dd980bce1e1", "comment": "Malware payload (Dridex)", "value": "993e844cda952cf94de1460af21135c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298856, "uuid": "acd11be2-6511-4515-b51d-76b63ddb1871", "comment": "Malware payload (Dridex)", "value": "99e86aa8a3f10aa842c3fb04589e43c194e7f0b4f3dd51f6ec6b1ae1e6cd5e6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298856, "uuid": "df78178c-11e1-4795-b96d-3c11559b3c5a", "comment": "Malware payload (Dridex)", "value": "5545f0168c1e505ac659eda1bb0f5e5c14e23be3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298856, "uuid": "560e6376-e4c2-45fa-8d06-6c9883f76358", "comment": "Malware payload (Dridex)", "value": "aba4a7ddaad5e77e00da4ee8bbec1907d2c904f627bb6919e17f04bfe188f72b86b9c3e9c6ddd072cb6104ca2dc6d883", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298856, "uuid": "b3d02a75-8768-4db1-b118-1f6e49f3c900", "value": "01F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298856, "uuid": "17ef93bb-3ece-439b-bba0-451e0ab77096", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298856, "uuid": "294610f0-c551-4e3a-a6b1-9b3b324ede98", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298856, "uuid": "37ac2a97-f996-4d7d-a774-2f320e85a9a4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298856, "uuid": "bd3cd724-a12a-40f7-a0cf-088dab295925", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298856, "uuid": "2581eb5b-ff91-4a6c-bfcf-0dcfa7b318df", "value": "993e844c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7326afd5-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280867, "uuid": "5ee55cb8-702b-4712-8038-26e53e4832b1", "comment": "Malware payload (Dridex)", "value": "eb9c016d29a0d65098f52686d003573e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280867, "uuid": "054b3116-1c91-4515-99a6-84109b8df7c1", "comment": "Malware payload (Dridex)", "value": "99eaed2583e9b0a51e46ce9bb532b62a34d27def397313de6515acc3b1c70548", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280867, "uuid": "c709b6b1-00ae-4089-8fd1-e4f8ff540ef6", "comment": "Malware payload (Dridex)", "value": "bc275d790c40bce63b5acec2310ec388734a4111", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280867, "uuid": "8b625219-3382-437f-aee7-a00ac308cd8e", "comment": "Malware payload (Dridex)", "value": "4535ba3d36858f6d43cece7f7938b303a97f4b656cf4a5533f8102ad4bd0020550eeeac823966c65f7fde113ce308e60", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280867, "uuid": "1f6bd6f1-4d2b-424f-9217-1124be419392", "value": "21F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280867, "uuid": "a99eee2a-5f40-48b0-88ec-95642aaefb4a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280867, "uuid": "efca0f6b-1094-4a58-9809-f4b29bae9261", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280867, "uuid": "8e00edf5-24c5-40b3-ba73-5c6c23f79ea6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280867, "uuid": "32b2ef00-0479-4ecc-a31c-ff60cb91cad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280867, "uuid": "50d6fe29-5828-4f07-ba35-841d4fc32696", "value": "eb9c016d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f944cf40-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331343, "uuid": "ea588ff2-3391-4c9a-9b42-7975506a4093", "comment": "Malware payload", "value": "7f68ba52b831cbc2e6d0c837161e867f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331343, "uuid": "0c850b80-4393-4946-87cd-c3512e777cd9", "comment": "Malware payload", "value": "99f365d5f879674cea6264649e73a3ec4d12b883524b53801d5b60e46c952c0f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331343, "uuid": "ce9b2fce-b8a7-4e66-9bdd-ee7e7b24dd99", "comment": "Malware payload", "value": "889d7955eda9fed3a06a7e7d6543910d021c48ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331343, "uuid": "dbb63dd1-67fc-4a1a-bc67-9bd73c1b3640", "comment": "Malware payload", "value": "09b148d09ae5c5b9e42b4936de0c7615203da069bcd715b2b17e95807d1aff5dafb3b1741df33c369f130fe89f06d1f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331343, "uuid": "e30da82e-f038-41ed-b5ed-7826fe856d72", "value": "CBF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331343, "uuid": "3db18585-7584-4552-960f-944c1f5e3322", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331343, "uuid": "4cd0cec7-ed14-4cfa-b737-21ff06e42120", "value": "3072:xbG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:oERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331343, "uuid": "026aeb7c-3ae6-44b8-b55e-669472622943", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331343, "uuid": "4df7849c-68aa-41cf-be63-20a2f79948b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331343, "uuid": "bbbdf429-40b5-4d61-9b32-d8220d97c27f", "value": "7f68ba52_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa0ab8e-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620320402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320402, "uuid": "47f674ac-2fd8-4d21-aa20-f916c6d23d4e", "comment": "Malware payload", "value": "86f17802671d9958aabb22bd368150a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320402, "uuid": "047389d5-c7e1-4358-9190-c558ad481f2b", "comment": "Malware payload", "value": "9a2c9b14c79da0583066a335ffbac5afbc152f8a1cbf53a38e5f4f118d38d8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320402, "uuid": "41bf12c7-900a-4459-b95f-28f0bd747d30", "comment": "Malware payload", "value": "8c233075e5a8a037bc8a8bd70e4e303817c8ed6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320402, "uuid": "5b717106-9427-48b6-9cec-d6e794bffaed", "comment": "Malware payload", "value": "9fe7b6238599175fe3b8765b54f60d970ac4a0ee936c1953e63a3c73b8e44135df5322164cf59df88a0e1b5ce9995861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320402, "uuid": "10db98ee-aec5-4147-a68e-af3e23af566f", "value": "70621728EEEC8226D0FACEB58EF2D252E739D1132A0EEB7B15D003565A13B41598757C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320402, "uuid": "60493c16-f619-4f35-8d81-baed7d4de563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320402, "uuid": "6305bcc2-cd84-414a-939d-0cc950f379ab", "value": "192:zwTjf7QAp5OXqUeHUW3o4wBFf6hQ+H198YUaQJhpx6vbyTUMTA7NoLuhj2HotIEL:cEcoTBFCeG198JaQPlHy8ufth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320402, "uuid": "ee357d41-9c6f-4941-959b-a4c79e01b798", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320402, "uuid": "fa921e2e-94b6-41a7-9412-7fdbbf7344b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320402, "uuid": "d56af539-af29-4105-9c82-ada9e45c1668", "value": "Bits10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fed59a6-ae96-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620324697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324697, "uuid": "31373c77-3e73-4ccd-a2d5-29d84184400e", "comment": "Malware payload (RedLineStealer)", "value": "57179b3e7c3f753a918ab68ec2ba5af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324697, "uuid": "43afb4cb-60bd-48f4-975c-ecc1ef872415", "comment": "Malware payload (RedLineStealer)", "value": "9a683ec03220d633a7cce5da8a6d7c9febe608eb45e572691e12600a2d6d58f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324697, "uuid": "03c4b4a7-c09f-4f4b-a7d7-5f9551288aed", "comment": "Malware payload (RedLineStealer)", "value": "aa542ee29b078b3ae446b2021dce6b5fc690accd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324697, "uuid": "99f155d4-623d-41b4-a0a2-06b214d185f1", "comment": "Malware payload (RedLineStealer)", "value": "650359eb7b389765b834a42cb23b7c986f6ce270cbe1237ecdc45138b9e12929f84b3f600338b6310ceaeea72c609af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324697, "uuid": "97fa372f-60b2-4556-bd49-9717d4b991b6", "value": "1315724474F39E8623E5957B5EECC5AACD3B3AB4607DB1833148A7178320466A214BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324697, "uuid": "0c083094-3353-4570-8090-38ad93af0c5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324697, "uuid": "1da5ac5c-6056-451c-af05-4f37d0046c6c", "value": "1536:vpa26w9JYSDVsYtJLYPRM4mkNAkXAkiAkmAklAkuAk2Ak9AkOAkQAkjAkRAk+Akj:aJaZcKfk02NEQ5sSpOCt2nz6Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324697, "uuid": "e56d4239-61d7-469a-9ef7-017dd46075a7", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324697, "uuid": "3b258446-4b6f-452c-acea-a4321ebc30fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324697, "uuid": "dab28185-0f6a-45ad-ad24-80160bdb69ec", "value": "9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239bee02-aebf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620342152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342152, "uuid": "4ee6639a-5199-46d2-b4f6-8d2e98b79238", "comment": "Malware payload", "value": "7f37b6c65fdb0318d1d329573f121794", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342152, "uuid": "1bb460c4-71e3-4b7b-a093-3d85fe2b9798", "comment": "Malware payload", "value": "9a72cb31a9db0cc0e1741fb56bc84b8c2c94c22f22d4e359cd1ab9af21eed017", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342152, "uuid": "c70d746e-a0d6-4886-ab9a-de42ca71db06", "comment": "Malware payload", "value": "384f697a50077fa375d8560631fb5051895d89ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620342152, "uuid": "2ba23648-0e85-4b4c-8105-d73e692b4012", "comment": "Malware payload", "value": "0f2dc340d7398852def954fbcd5d1a8c5340cdaad2706e7bbbdebedfc1b089bddd7f73ffb3ad001e84e3bf0f36ad8798", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342152, "uuid": "80ab174f-5a3e-44f3-9621-8920722c6836", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342152, "uuid": "9eba65c8-65b9-458a-bf42-706bc2ef7de7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342152, "uuid": "afe66732-95eb-4ce4-908c-39d8beebb379", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620342152, "uuid": "a6fe2995-3ebc-4b69-8ed2-7b38f852bd9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620342152, "uuid": "12a7c807-2547-4ff8-9cd2-14728a30e3d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620342152, "uuid": "1672d9cf-4f94-42bb-a48e-4ed51315f311", "value": "7f37b6c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60ddf25-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620310293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "094217bb-648f-4750-b4d6-39c9bb5e9757", "comment": "Malware payload", "value": "a24308eb76c58d64f5bba6520777d4c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "e71c1da5-581d-4093-8598-d425cefa8b03", "comment": "Malware payload", "value": "9bc11a08f96c9b97238ffe8671c801817fe7844e280f479a7b7ce880ec197ed8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "f632bbb3-24fb-479d-9fe6-65547655abe8", "comment": "Malware payload", "value": "de6e2711a12a1c86e6755f6756f6d7ba980c4005", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310293, "uuid": "e596e0cb-7c0f-406a-89a1-ea785c8ed557", "comment": "Malware payload", "value": "e94a08ae27b12aa719523e497f6ddd34e9379387142abf0248741bbe3dbb36804cb310a9f839eea489b04a883d4eb2bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310293, "uuid": "85691536-23f6-418d-bd3e-42bb7ffbcb26", "value": "78A130CE4B49AC6E40055F2AFC31C35D69A6D0960DBA928AFE07E8447B9F400C3D9F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310293, "uuid": "6f1511b9-73aa-443d-894b-379cf12bbebe", "value": "96:P707U727LxZK71r7uY7Q7g7t7s717+7i7+7/72767272727X727L7272727g727U:P707U727Fo71r7x7Q7g7t7s717+7i7+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310293, "uuid": "933d0c4d-c474-4ad1-a4fd-d09116745345", "value": 4924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310293, "uuid": "fd971b2e-b03f-4efd-8cb3-1fe7e0f63454", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310293, "uuid": "3dfce312-cbf4-4882-a829-8f9a0ae9e3e6", "value": "JZ74.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa0a3d7-ae84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620316877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316877, "uuid": "f4c779bf-a909-4248-864b-3ac4af3fd254", "comment": "Malware payload (Dridex)", "value": "037b1481e44fc5423e1dda6566554124", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316877, "uuid": "361254b9-2d52-4734-b35e-95303818025b", "comment": "Malware payload (Dridex)", "value": "9bd1c39edb3c987cee4a8eaa7f819bed166ad489bb398a866c7e96321dd773b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316877, "uuid": "d072b14d-a5ef-45b3-bb7b-1d74f44d56aa", "comment": "Malware payload (Dridex)", "value": "8fda3831f2f0d9004bbd1b0f7419a51202b912ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620316877, "uuid": "e67cf416-5f3b-4e12-9fdf-a9cc458b14eb", "comment": "Malware payload (Dridex)", "value": "fd84c6ae4387e3b25e307ae77f0d1f959e38081489c84d9411cba4d15af4e9e20bb315e24f80d4de839be939b4bdae9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316877, "uuid": "81b4b311-4fe5-4d62-9645-35a479325bbf", "value": "1EF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316877, "uuid": "318d7058-1ac8-44f2-8868-c6d345b62c3a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316877, "uuid": "936d305d-ba05-4d80-953b-ddaee3f9f42f", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620316877, "uuid": "6a4a0a98-7190-4923-921d-3554f8c59583", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620316877, "uuid": "bbbc993a-25d7-45c9-b54c-27acb32fb61d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620316877, "uuid": "0387c485-af0f-4d79-a7a3-921ee36b6743", "value": "037b1481_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d72547-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338802, "uuid": "33db2c53-345d-40ee-8b2d-d9e507e6cc8c", "comment": "Malware payload", "value": "45c9ccb0c357f3e678960b78c49986a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338802, "uuid": "bc094c75-e96a-48bc-bf1b-2486644696a9", "comment": "Malware payload", "value": "9cb8bb650149473b157c6f301dc45ea5bb499d975d98dbb13310149669a32d37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338802, "uuid": "a2b4efba-ec3b-4cd0-adaf-c13138f40e12", "comment": "Malware payload", "value": "ace09d86a7649eb4e3ae26b89f57af2ad40f1177", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338802, "uuid": "a15a3774-76c5-4df1-875b-9070f624755b", "comment": "Malware payload", "value": "9a34b91002aa0fabdfbd987ff5b915e431d89d738d855ed2da2d5d55600cce395f2c958e27d935a39d5b321bdc88a836", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338802, "uuid": "473f4ab7-f231-4d14-b97d-f5400905a961", "value": "57F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338802, "uuid": "103cd039-f26b-4036-b4cd-3556f384a285", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338802, "uuid": "79f29a79-cdc8-4d42-8444-d6660d359ad2", "value": "3072:wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338802, "uuid": "f2e63002-c287-4c71-9d00-419df17cb8ec", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338802, "uuid": "623f3ea0-b1c8-4e3e-ba44-ce4153f0d0f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338802, "uuid": "c863098a-3f1b-47c2-8ceb-4dfdae46ac9d", "value": "45c9ccb0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00212c51-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331355, "uuid": "f968a097-9de6-4a61-873e-8c152b63dc44", "comment": "Malware payload (Dridex)", "value": "663c1cdcef6b6222e5335f9c9c03e8f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331355, "uuid": "28a01e5b-1e17-4097-9396-d38b29586256", "comment": "Malware payload (Dridex)", "value": "9ce346a29ef8339880d11352647df5d5a7be26c51b99849ad0010861a6697a0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331355, "uuid": "35cd79f6-f30a-4854-87e3-743ebab06dcf", "comment": "Malware payload (Dridex)", "value": "9b2168fbd78d213e968473ef52a51d86ecd243da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331355, "uuid": "4c8b49b2-9763-4840-b785-7a546a164bc0", "comment": "Malware payload (Dridex)", "value": "dd6f4dd3588f483cc92e738c9d3ba5a37089334f2716822283b24e7fd01aca01fc51605af79ed57bb8fb5eb50b1c37f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331355, "uuid": "d8ad2d6f-a830-49dd-a42e-8a0c82822ae9", "value": "9DF3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331355, "uuid": "5519d19e-cd9b-4edc-8964-b27ddf7b7cee", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331355, "uuid": "33c2fcee-b03f-43ca-b7ec-cfcceb26b614", "value": "3072:dlG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idEl:WERMVPG6+Y63HoG1QawL40Prx6Kql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331355, "uuid": "c4e4ccfb-eec5-47b5-9318-082d3e6e92b5", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331355, "uuid": "bd6a2afe-8e97-4142-949b-97d97945b8d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331355, "uuid": "dd09313a-12d8-45e7-abd6-2f1907aa44ee", "value": "663c1cdc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8695c485-ae0a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620264579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264579, "uuid": "a975af15-af7c-4ec0-bae3-0fc17791e06e", "comment": "Malware payload", "value": "ba5921707560d9ae819b2f9de9443a7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264579, "uuid": "bc31ba94-4fb8-403f-a00a-0d557516c79c", "comment": "Malware payload", "value": "9cfd14ceebe074375e7c04a86b80fc15b35d73294cf54d3f0aae11351702adf4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264579, "uuid": "8d9213a0-52f4-44c4-a878-f4d61fd9e59c", "comment": "Malware payload", "value": "9ae2e981ef53e2f0cec54a30a6a75ac40ed8c592", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620264579, "uuid": "b53c7e80-d978-4318-ba67-b03678dd0655", "comment": "Malware payload", "value": "e3b95465aa4b50c0698934b6f0970ff1f1a8cb908e5557ea1bd7490bf27c7c1d676f740aa8a47917eed110052344d3dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264579, "uuid": "97598b89-cdf5-47c8-96c8-e02d11a6ca90", "value": "50952922FAE704E6C4BDF130C55293617A71B8A803207BE35F9496791E6AFD42E7D342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264579, "uuid": "0a0b81f7-a092-4362-b509-15224bfc3f6f", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264579, "uuid": "836894df-5d9b-439e-9105-51e7e7e5daf5", "value": "24576:cS3kS3PO0C6lctkbrU2Fl88cOWHpX3UnDfWcL5E:cwh320C6utIrU8WJnoD+cL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620264579, "uuid": "833c56b8-0c0e-4e5b-8d6b-48271bd42942", "value": 1951744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620264579, "uuid": "f4fd7751-af4c-470a-92df-fc487c5c2fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620264579, "uuid": "c8e3dd5e-b8d8-41d1-88a5-04c8391c8154", "value": "ransomware.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ac8014-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298885, "uuid": "b7db9051-ee54-43a7-a2c4-2c32d4a79477", "comment": "Malware payload (Dridex)", "value": "903930a7eb0b62782663b8c672ecc7a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298885, "uuid": "784b0634-d02d-44aa-9e54-da8e072a400e", "comment": "Malware payload (Dridex)", "value": "9d273b34bc6d0552fc8dd075dcf00fc184c9726fd245c98606d8a247c8b0f613", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298885, "uuid": "7575a705-aab0-452a-bc33-4365f597cf48", "comment": "Malware payload (Dridex)", "value": "9743d6941421d4ba5edf573aa8a21f0af5bd3894", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298885, "uuid": "741fece0-5ea4-4bd9-929c-b2ebc1dc24c9", "comment": "Malware payload (Dridex)", "value": "261c0dacfc5bb06c171b2acb4b5ca0a3124d923fde650c516e647e8ab062e53876eef663472e80b71d62112d72e691c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298885, "uuid": "272e9721-705f-4946-b666-9814c0f58e64", "value": "E7F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298885, "uuid": "247b269f-d7dc-463d-bbae-3f7ee402139b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298885, "uuid": "5f95a16b-96ad-4b54-b4b3-6a4e47f43a51", "value": "3072:6A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:63J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298885, "uuid": "ecd8edf0-1164-47c6-a6ed-ee4a2ab4db49", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298885, "uuid": "2f85b28b-3add-4ff9-a4f9-eb837c8408ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298885, "uuid": "efb5a770-872f-45f3-8e5a-032248c738d2", "value": "903930a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0e8ec6-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339457, "uuid": "be66bf48-7381-4799-b4b2-075735c86c86", "comment": "Malware payload", "value": "e10c080105d996834e980162dc8e1e32", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339457, "uuid": "b1e331a8-020a-463f-a510-3bce48895380", "comment": "Malware payload", "value": "9d503a0263f9e5cd4ecdd2fc8da1e6b667a299ab7291aa63027343a4246c1c66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339457, "uuid": "88684f8c-0d58-4bac-8e5c-c7dcacf4a2f6", "comment": "Malware payload", "value": "089d25a91dca26ca8b0cce1748754e7de70c79c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339457, "uuid": "a199478a-8337-4e28-a376-1550d1c77c6a", "comment": "Malware payload", "value": "be113de9a1595928ea66e71214dc9c330183c09c66ec916d3408908e1dc41a2abfc3db5081a5d29249760127be9ad1ee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339457, "uuid": "88b004bc-9d40-48b6-9593-53af6e8a2693", "value": "8EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339457, "uuid": "4fb327c8-48b0-4c98-ab05-c66cc8a31aea", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339457, "uuid": "6ae6d32a-04c4-44f3-9eed-135ab47799c7", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339457, "uuid": "22662945-49fa-4eb2-b3a5-164e16784973", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339457, "uuid": "842445f3-fdc8-44c5-94f6-bddc7c63a633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339457, "uuid": "056ac0b9-187b-44f7-9754-fac0c371fed6", "value": "e10c0801_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef117261-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284511, "uuid": "4f993aea-8174-4b26-8af5-e0f8c0541809", "comment": "Malware payload (Dridex)", "value": "43cd6df6b6c38bb8a2c37d0a8730c9fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284511, "uuid": "65a91235-9d85-4e4d-926a-a1ae276b817c", "comment": "Malware payload (Dridex)", "value": "9d5abb62d33a2dc30b58f2a7b7097a889a1678ccd74a4b087d789420a1fcf323", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284511, "uuid": "870d744e-ccc5-48b5-a4fb-29e9f9415d3e", "comment": "Malware payload (Dridex)", "value": "d34a52be44a0f55d7bb57aa73a16c91109629c07", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284511, "uuid": "47e9846f-c22e-4895-8282-600443d3a758", "comment": "Malware payload (Dridex)", "value": "daccb1f16304acd8030c3d9647b0d0c9f0f9f2abd5600107a1b08e03bf5f373af5ccef895822d6139c98b8c905864428", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284511, "uuid": "a88d0a6f-fdf7-4c3c-9f4c-8405b86f4d57", "value": "BCF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284511, "uuid": "1d83908d-63f3-48b2-8b33-a1d6d597daa9", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284511, "uuid": "7cdcbec6-98cd-4e3b-8edf-3269da22ea12", "value": "3072:bWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:b42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284511, "uuid": "1b9c2a90-6ffb-4d2a-b127-660c20090647", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284511, "uuid": "b6a4e642-e36f-48a1-9ec7-9ed0a6763cba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284511, "uuid": "97f6a8b0-866e-4e0b-976f-6ab970e5dc3e", "value": "43cd6df6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331bd2f8-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620306100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306100, "uuid": "d9a5817b-c178-4611-9097-cfdc1760bb93", "comment": "Malware payload (IcedID)", "value": "f143869b5567d92152addee5f40b2544", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306100, "uuid": "c6a34639-fba1-43a9-86d1-a238d79aa540", "comment": "Malware payload (IcedID)", "value": "9e7906cf5f653a70e1a30828d805dcf165b50a7e664cb94de562771203219e21", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306100, "uuid": "1de0cf93-cee9-4663-9666-a62957633cc9", "comment": "Malware payload (IcedID)", "value": "641ba7fc05997aca01b83dfbaa078c86d4b6b7df", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306100, "uuid": "ade4235b-e39f-4902-be31-ac749a59132f", "comment": "Malware payload (IcedID)", "value": "7c6b6ed04a1b9898a05797ffdd37d1e506b516070bb7786d8528a8aa0d9ffb66f72a1a5a6c25e3b7206b1b5cad645212", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306100, "uuid": "8afedd47-061a-4cd8-9e58-3aee273ee1c2", "value": "C57337219B6A9BD0ECC679770345CAB1E3324F80575337E7BE6D7B0D2B68981482612F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306100, "uuid": "5af27768-bc10-4e8c-a506-977477e4472b", "value": "768:2UeLyhCG4Iha3Fek751bTD2LdNnh2OiImFqGYjloqiE2DpKrflUPYPbskMH5m0:2k74uC1bTDkNnhipFnY5IE2vYjsRZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306100, "uuid": "a3f4c1f7-3850-4c19-8806-e9e561a62eeb", "value": 77750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306100, "uuid": "fe5f5300-f7bf-42e1-a609-e84d03b05501", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306100, "uuid": "2d319faa-8e3e-4fc3-aada-5321b396c1d1", "value": "f143869b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10313459-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331382, "uuid": "0c3739ff-a852-461e-a7e2-ac119f622f1d", "comment": "Malware payload", "value": "d50c7d90a0051f8a237bb68a5304f47f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331382, "uuid": "0de7fede-9ff9-401a-a16c-57045905e40a", "comment": "Malware payload", "value": "9e8a607c14f32acee3cd1dd1548fb6e9ce7a309a388af3c4c96b7e4c357aa3a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331382, "uuid": "5ae0ec48-1d09-4c09-b35d-682088ca193b", "comment": "Malware payload", "value": "c9275a99d8402437783eb2c6a078d5959d09eaa6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331382, "uuid": "404b08ec-158e-4a48-bffb-6c6ec4f763a6", "comment": "Malware payload", "value": "19e03b788fd173957770f9ce5323525efdcfb0786c13e260b18d79da89719f8661f0f02f941ae360eb190a5ffc4c65be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331382, "uuid": "3b70afc3-7454-46c3-ac34-03c780f550fe", "value": "56F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331382, "uuid": "eb7bb145-bd36-43e7-a409-fcf396329c99", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331382, "uuid": "858efe88-59b0-4c0c-b163-85cf8db00ad1", "value": "3072:4bG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:jERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331382, "uuid": "6fbef2dc-0433-49f3-ae81-6a7deb193a65", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331382, "uuid": "fe8947e8-a86d-4416-a251-b8d53405e07a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331382, "uuid": "e0414191-dcb0-4531-83ac-31d388b985ed", "value": "d50c7d90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ca15a9-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620302526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302526, "uuid": "239c76e4-7fc6-49da-90d6-450dfec19e91", "comment": "Malware payload (Dridex)", "value": "83bf689e91051e83704337c0aecce8b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302526, "uuid": "0f264cbb-58a7-4a51-ab95-958ec7ed2d3b", "comment": "Malware payload (Dridex)", "value": "9e8f059fa35b6654a6afcffcb8065ebfde54fd9b7477d365e37f3d924bd3b8c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302526, "uuid": "a20951a7-f6bf-45ba-a107-75362daff0bf", "comment": "Malware payload (Dridex)", "value": "39d8fca490d6de1e8a402df43ce08925775c3b02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302526, "uuid": "0735bc71-0632-4c07-b146-c941f75c3e62", "comment": "Malware payload (Dridex)", "value": "dee1beab364cc93c8dec9221ed7d433ce98db09bf6cd5ec7d6551e3a2cbf575882d4ce43f87b34a31fea9d64dd4562b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302526, "uuid": "149e2275-4444-4942-ad37-e21afb2fdbc3", "value": "1AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302526, "uuid": "4f03b252-89a8-4cf0-a898-c67738dffbd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302526, "uuid": "cde94d91-b2c1-4be1-9cbf-2fb3b250f070", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302526, "uuid": "08a05518-9630-47dd-8eb5-0ae9c04551c4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302526, "uuid": "196727fa-07ee-406c-b486-f324cc0efa9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302526, "uuid": "e064e23b-b147-4aed-b881-a62b86ff09ff", "value": "83bf689e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b691b61-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620334917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334917, "uuid": "ed749bb4-0206-462a-80b8-9db0ba5ab917", "comment": "Malware payload (Dridex)", "value": "c45079c5f3d2691584f3925543666ebd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334917, "uuid": "6dc5a1b5-6f43-4acb-934a-a0afe95f5a00", "comment": "Malware payload (Dridex)", "value": "9eb4fc3fb297a87f0e92d8f7df0d5a948c121547808c42c29b9c093207663e18", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334917, "uuid": "39a4f493-4da3-4734-b157-ff80ed439d95", "comment": "Malware payload (Dridex)", "value": "8646eeb6241893b268925f62b5642f74591c5b06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334917, "uuid": "de82e2e1-a47c-4934-a198-e94070945e8c", "comment": "Malware payload (Dridex)", "value": "9fe4abd2500bf7a452f42dc52c8e8194dd7fc6087e7e2c03808bee226ac6df044fb61518e3137f726f987398bc71a4ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334917, "uuid": "dbcf9eae-7c57-4791-8a5f-4097a047bd46", "value": "58F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334917, "uuid": "7fe50dd1-baa1-46fd-935e-9ec0cdebb6d8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334917, "uuid": "4c3a7733-7ec6-4f1c-ae0b-812c7e3bfd5d", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334917, "uuid": "1012c4b1-d435-409c-aff3-f73f63d89861", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334917, "uuid": "070a90e1-76e5-4f5d-aafb-7347f3328df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334917, "uuid": "c32492e8-b7dc-4383-9c8e-812c928b860a", "value": "c45079c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e018869-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313420, "uuid": "1e846af1-db8a-43e0-9486-ca6e9d94d932", "comment": "Malware payload (Dridex)", "value": "0ad4bc049f44a77a64fe575bf7235506", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313420, "uuid": "b4c95a46-b5b9-4a02-ac65-c7ae180fab09", "comment": "Malware payload (Dridex)", "value": "9f00493416de6afc537e089aa426917ba9e8ccab19ade62930be2af28bb1ec11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313420, "uuid": "cc7ace5e-10c2-4915-a38d-8610050eb44c", "comment": "Malware payload (Dridex)", "value": "c0dd492542cdcecfda1195244ce5fc0a7c31a937", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313420, "uuid": "e67f30af-7ad7-424c-a3bc-59e9d4afef4b", "comment": "Malware payload (Dridex)", "value": "4da717710ca0ef643ee72ace429062dce1ac6ab296ca009aa6f77cf2442e9d0d746531ccb65e9e4ae1df9a868306541c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313420, "uuid": "1f7b6aeb-9033-42e9-abba-888949b65541", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313420, "uuid": "a03f231e-d44b-41a0-82b9-23d2e2f507ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313420, "uuid": "5e629eb7-f8ea-485e-ad8e-714ec8657606", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313420, "uuid": "e20e1de4-f4e5-4b78-a384-17982ded71ef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313420, "uuid": "a59d997f-b97e-4eca-8ee1-e976bf3a0e89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313420, "uuid": "c8ddf803-03c6-4556-b4bb-d69f3d1f427f", "value": "0ad4bc04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb70f5b6-aea4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620330810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330810, "uuid": "8aa9419f-da4c-4912-b11b-2b811eabf990", "comment": "Malware payload (AgentTesla)", "value": "6c77a3dc9459bf6356d08dc9d29498a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330810, "uuid": "9f2ce110-2513-4ed7-8173-6622d41343ba", "comment": "Malware payload (AgentTesla)", "value": "9f25f493f6084e0b8f8c46b0d946962936771b9a590f91111bc1ce3519a08b82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330810, "uuid": "66968989-4e04-4f5d-89c4-9ff4379cacc7", "comment": "Malware payload (AgentTesla)", "value": "6cc167a9384de5afc9c709c4f2a31928a7336393", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620330810, "uuid": "85620394-bc45-4c2d-8608-70836aa141c6", "comment": "Malware payload (AgentTesla)", "value": "d50fa82f84d952aa04770ff1335ea40c44499cacb13959f8fa2581c5342ac37883d922e8f17d7b871cc7087c18a89b37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330810, "uuid": "08576bd6-df49-4c74-8659-8d74314e22db", "value": "2D161D615383856DB3F42E1112F1A0AF5C5BBF624E79B12E649084231BB9CE4CFB5B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330810, "uuid": "b27c7583-0f75-4c60-afcf-21fe533a1f7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330810, "uuid": "15b747ee-be80-428b-a9d2-490858c127c0", "value": "6144:4V8gK8XS5S5S7SySuSeSDSySbS3S3SGSqS4S6SnSeSnS+SPSsSQSrSDSwSTSYSb0:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620330810, "uuid": "7fd5c1e0-ee3d-476c-9955-dbac366f0173", "value": 4163072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620330810, "uuid": "887c5a54-cad1-4065-a01a-e7ffa989ad6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620330810, "uuid": "f60fcdc8-969d-439a-b987-f1ad7eb62daa", "value": "SecuriteInfo.com.Trojan.PackedNET.703.25032.14539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c519c0fa-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339416, "uuid": "aa5e5f8e-332e-439a-aaee-bf57e337d9fa", "comment": "Malware payload", "value": "f3803bbdb54b1c5b6e72f8c8b1d69015", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339416, "uuid": "b4ed7c66-4a34-4ad7-83bc-008eefbda415", "comment": "Malware payload", "value": "9f7a0001ecc93577676dacdb7f96818f6d65df7c2a44131ff5e510bfdb595c42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339416, "uuid": "3326ad37-6100-447e-b9eb-dba082f95ae1", "comment": "Malware payload", "value": "338714be91f60936e5bb9ab5841beea2f895b362", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339416, "uuid": "fff78355-6a93-4b33-85d8-9a547840618a", "comment": "Malware payload", "value": "8fc944fe3f66dd525e51f657f365344f6d6f94113e2f611c2c44fc6515700829a01a793738a006d633f681f1c30a40ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339416, "uuid": "f3cf07d6-9a01-4a98-a970-ba38d0b4efd3", "value": "54F3C004D167E6D6C51A583222EA3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339416, "uuid": "63d5f04d-c019-42bc-96b8-5ea312934272", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339416, "uuid": "9ba0ab7d-fcc5-4197-b07f-ec6289052c5a", "value": "3072:imG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idn8:+ERMVPG6+Y63HoG1QawL40Prx6KZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339416, "uuid": "b52ce5d7-13a2-4329-96c3-27586e3afc36", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339416, "uuid": "ace2aa94-5ffd-4cbc-84bf-9e2a9f7dc30a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339416, "uuid": "f39ee1c8-4f1c-443f-a1cb-40b5b21500d3", "value": "f3803bbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba72184-ae17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620270171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270171, "uuid": "89b00662-abef-4fc6-a597-ee6ab56d8efc", "comment": "Malware payload (Dridex)", "value": "868cb312299a69c8ff496ebdcfed1270", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270171, "uuid": "b66fb166-1c81-42be-babf-050ebfbc9ac1", "comment": "Malware payload (Dridex)", "value": "9f89d2e7d1f678580cc34b320d825de0c15087c1b030db958fe3ecbcf739e528", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270171, "uuid": "8998accd-2d20-48a1-b68a-0bef07b30530", "comment": "Malware payload (Dridex)", "value": "7a59599a38af237342882f5538dcb4ed9ce181f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620270171, "uuid": "31485af1-6b25-4e3f-ae28-212bb39a1cfe", "comment": "Malware payload (Dridex)", "value": "359481f871ebca9e5d3fb4ccac69e92c9f560ea760d1bd099fe551650ac902aa3400d8857e70e10da35cc57e83b26395", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270171, "uuid": "c1f3151a-0560-4de3-9812-74d35f9c5f53", "value": "16F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270171, "uuid": "a4a9897f-cad9-48a6-9b9d-bd180c13ac28", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270171, "uuid": "38f8da8d-2759-4df2-b716-d1f72251f15d", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620270171, "uuid": "f4252454-f0f4-4b95-b9f8-6208a24bf298", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620270171, "uuid": "83449240-0185-4945-b1ee-3ec0a306c238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620270171, "uuid": "c3ed17b8-c0ba-49ba-8ef9-3315370efce9", "value": "868cb312_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b74350a-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313335, "uuid": "14c58a5a-14a4-41b4-bd97-a7d362ce188d", "comment": "Malware payload (Dridex)", "value": "4348dc74c93e271eb4830c3bb2ae2fb3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313335, "uuid": "5d0a0a46-0aac-4f1f-bd56-f83c97f46e46", "comment": "Malware payload (Dridex)", "value": "a0228274f0a10209af613745314fcad0259e7dc6a3a1395e3c409f458a36934f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313335, "uuid": "c691e6cb-7fe9-4af3-9f92-0e89297eb637", "comment": "Malware payload (Dridex)", "value": "c2a95451cda253edabac1be489b2624974fad866", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313335, "uuid": "694f4c18-2d72-4d34-a736-a503d4954223", "comment": "Malware payload (Dridex)", "value": "fbb72dd513c1a319b8e911fb9b0cfe4330ed6f694cce67ab8a0b911266c0b176e39f4b3b96403ad883ef0edf7049eba2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313335, "uuid": "c1a5811e-651e-4532-a2f7-49905958fc35", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313335, "uuid": "b89d5c14-ea82-4a67-b2c7-ba473750008d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313335, "uuid": "d881b8c5-47bf-4357-a862-173bdf5353cd", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313335, "uuid": "3d78c7d2-e658-4a7a-ab93-1549670881c9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313335, "uuid": "cff02137-db1a-46ad-9b23-18c75d37dee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313335, "uuid": "d37532d6-9b40-4ef1-87a8-7fc3b14d0e35", "value": "4348dc74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9160dc6-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620320552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320552, "uuid": "8c29b6c3-9cd6-4dbd-b79b-a9b4289f6089", "comment": "Malware payload (Dridex)", "value": "c3c03ef2fbaba69c58e7e5e8422caa8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320552, "uuid": "df4bd780-b05f-4a85-836c-7763f2c253db", "comment": "Malware payload (Dridex)", "value": "a08a077bc8652c2b970c4703e6e078a61410dc3f415acceccbfa9b80f5037816", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320552, "uuid": "308bd504-b687-4784-813d-222d6ff83b4f", "comment": "Malware payload (Dridex)", "value": "38de1c5a2a6c47f6da87e091367650ec6b5b84ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320552, "uuid": "f92cedf0-7e28-4b28-9cda-edc1923dfefb", "comment": "Malware payload (Dridex)", "value": "2e8631621dedc84125dc709f754442578ba4f549e0f94db5c4e13a5f6f06addda132dce9090b1ce1f8c26e49e3054e49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320552, "uuid": "2ce0ac35-97ef-400f-b086-d59684a33185", "value": "65F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320552, "uuid": "da26a4c5-0794-4455-93ab-88b7523cfb90", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320552, "uuid": "bcac2ec8-5e8b-431b-838b-35855099a46c", "value": "3072:RWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:R42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320552, "uuid": "cd8dd601-2f8d-4ace-812e-bfac89ffbe03", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320552, "uuid": "6ab47b08-9da7-4ab5-8fb5-cf1527653d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320552, "uuid": "3ff1d7ce-0dcc-4342-910e-ca713cafbe50", "value": "c3c03ef2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083bd620-ae64-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620303022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303022, "uuid": "41471661-e0b5-458b-a360-b1f3a37a10d5", "comment": "Malware payload", "value": "34ae7b91548f411b48a935020673ba39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303022, "uuid": "96748b73-bfad-4c12-a1f8-3b4fe7208a5d", "comment": "Malware payload", "value": "a08bd957ea26156cf0aec73ca0922c4bd3f757b14fa188ae5a71d7208d07c207", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303022, "uuid": "e896dd61-3ff3-490c-ae26-dae01db943cb", "comment": "Malware payload", "value": "833b40a0493aa48157aac38c1672c2978544d45d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620303022, "uuid": "cd7a9add-c7e7-4223-b2ef-3907c777e4f6", "comment": "Malware payload", "value": "00bce502c2e74b1967ecf136dde7bd53a1db0a1379729c5b7dc098a461cd32a2cd08018a0b6178d34b3bbeaad1430697", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303022, "uuid": "f085db6c-1016-4e73-87ca-486e1bdc939b", "value": "3EA4F12121C09032C5D678BB8119D7B54EBFB876212A5ACF9FED19B45F2CED2932530E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303022, "uuid": "1d43cae1-cf00-42cb-b54b-d049a840b0be", "value": "12288:IKFVZWVERxY9aOCKwbLYLps0p2DbOhVpTGB:IeVoERxY9A1Os0paOJGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620303022, "uuid": "08906693-58fa-47f8-bfc9-7a7aa4be18cb", "value": 451641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620303022, "uuid": "a08a94ce-6d99-4c23-8af9-e2f1d8da532c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620303022, "uuid": "00eb7919-ef9c-429d-b74d-d0d3750fdd87", "value": "msoffice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6985f7f7-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620298890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298890, "uuid": "5ce6f825-032c-436c-a9bc-b6c2b83fca1a", "comment": "Malware payload (Formbook)", "value": "8c2d96abda99516a36f04f6a504bf79e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298890, "uuid": "56447b90-b3a1-4b04-87cf-2ba0da81a148", "comment": "Malware payload (Formbook)", "value": "a0b018fb2193eec4f61de14d4d60b1cae8ba46b2cabfc704d59ac6d134dbf4e5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298890, "uuid": "ae1cf290-399f-433b-83f3-216fe0d05efe", "comment": "Malware payload (Formbook)", "value": "b2e6c392636248c2705ac3a23a6fafbc8e5c1897", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298890, "uuid": "15b6aa3c-d859-4fa6-89bc-37f69ba56252", "comment": "Malware payload (Formbook)", "value": "a75441c156c1493f4856f7088d445e6ac3f1c47989ead6a6c44cc118c1355d4d8489cb9172003192915d95ce3f95b8e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298890, "uuid": "a1d4c3b4-ade8-4f44-91db-250d3490775f", "value": "C124124E72618CB7C45A01712CBECBA7FBEED29A14772B47AB844D9632334C3571E192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298890, "uuid": "c83058c9-b1ec-4823-aa30-d46718573eb9", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298890, "uuid": "7801691a-bf85-47dc-9999-ff5623144faa", "value": "6144:L9X0GgX5wDgpDNf4kYy+yR9dU8YDv07JDXaLtw+gFB9vyS:l0ViDgpDNz8y9d3YQJeL1gFB9vyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298890, "uuid": "d9c401f5-ccd8-4922-b799-ccac10c8ccb9", "value": 210619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298890, "uuid": "5d3b29d3-4b88-4360-bd1e-0470b0e99f81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298890, "uuid": "27e375e5-6484-4919-bb17-82e7b730fbdc", "value": "8c2d96ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4386ea86-ae2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278210, "uuid": "665f2f42-5dfb-4453-82b0-923565162898", "comment": "Malware payload (AgentTesla)", "value": "4cb9ec10e007ea4d18873c5265be0af5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278210, "uuid": "24f0e5ff-4b63-4fd3-a805-ac330369bfbf", "comment": "Malware payload (AgentTesla)", "value": "a0c82e56e24195d6483cb479c94d3f87a4811102ee44c2b9777968700d7d84a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278210, "uuid": "7f151ff0-ee85-45c4-a1c6-d53a6c847a47", "comment": "Malware payload (AgentTesla)", "value": "6fa3ea0803849370a555b6f15041e5268170a1f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278210, "uuid": "58049236-8169-4831-933b-a3e2068ff8b6", "comment": "Malware payload (AgentTesla)", "value": "ad217f43d94b48aee39365744ad6fc935e3321d5b6a29858ae01b008f9d04949c7eda15b9f92771a12ab5032292b27ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278210, "uuid": "a35ca3be-d09e-46e9-9f84-0ba50bc4f1f6", "value": "A2B522466B7F26ACA91AB4D0DAC1C00CDBDBEAF05776D59F066A1003C7578642B7CB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278210, "uuid": "01268e42-34f5-4687-a286-f180f15ffcfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278210, "uuid": "5ceb8ff4-e644-4cb8-a5be-fc8f933e3126", "value": "1536:f6fpzR46+aJFU/588i4Uo8mCG2WUALaXRZy5Sw0AQ8X1xKQHyYBrk+ycIpbfZ4Z5:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278210, "uuid": "297c9459-c518-4597-8cc4-9434d116637e", "value": 2423296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278210, "uuid": "14251a4b-d273-4da1-9c0e-a2e82dce125d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278210, "uuid": "5a6e76a0-acab-41a8-8655-4806361d5581", "value": "DHL_document11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9c9b90-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620285531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285531, "uuid": "0747e547-de15-4235-931d-987087d1b2a5", "comment": "Malware payload (RemcosRAT)", "value": "2167310bfc6911706be2abfadbb25a07", "object_relation": "md5", "Tag": [ { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285531, "uuid": "388d7887-5100-4ae9-9844-c8223e669492", "comment": "Malware payload (RemcosRAT)", "value": "a11a2be54b4e16b1ad08516b46da1ded79de8b7a31e4cf7537e21abce1639816", "object_relation": "sha256", "Tag": [ { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285531, "uuid": "9f51401b-d6b0-421d-aec5-ca9640c70f51", "comment": "Malware payload (RemcosRAT)", "value": "973e9cdaae27067d21bd2ed290ee2fb3139e3f6a", "object_relation": "sha1", "Tag": [ { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285531, "uuid": "d557442a-10d1-419c-8ee6-7964320126d7", "comment": "Malware payload (RemcosRAT)", "value": "b5820143d1ef173056821d5ff31e5f704e91459804eac1f81a4dbcf6cafc0a96ed3a4ecb757a664b178b61c28e56ce82", "object_relation": "sha3-384", "Tag": [ { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285531, "uuid": "40dd50bf-1c13-41df-a4a4-81916a574344", "value": "73F5E821CEAFC42CD2FB5EA0978877130A037BF9683624F49A850A59D307D955EF1FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285531, "uuid": "586e1c7b-32ac-4228-b677-6a61b0fd4e41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285531, "uuid": "dfbdf5b3-c731-4bac-a350-7dab1f78bb96", "value": "1536:f5hlaq0Z9dKSBvcMGT5kpK10Qm68UjGYK1z9SVeUI2tE+aSk4+CJUUXDZZ:f5uq0ZTfkTTSK69IXUIFtLLk4+6UUdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285531, "uuid": "bcd9bea4-437b-439d-ae47-78d0b54f81ef", "value": 3456512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285531, "uuid": "cc6ac37d-3e05-4c34-899c-b8e9fde7468a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285531, "uuid": "0e0cef52-fc86-41e9-8c49-52e271e93a4e", "value": "SERFINANZA_EXTRACTO_9429299304353174728403_23412551137329424487110_9573524169573054383615259_639869929291807056373_pdf.e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b1b072-ae6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620306177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306177, "uuid": "c120bbcb-c27b-44fd-b696-e5a93b415c33", "comment": "Malware payload (Dridex)", "value": "7fd8d0746c7f460422c832f5d5570c88", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306177, "uuid": "ea831a2f-f238-4d09-9b53-e5bed6013393", "comment": "Malware payload (Dridex)", "value": "a130377e44c12cad27eb4b0ee857f70b4b868fe43e23844998408943b3de949c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306177, "uuid": "6391491e-1a66-4f0a-ac38-71caa00c035f", "comment": "Malware payload (Dridex)", "value": "a01510be9a9e2c5a9606d539566bb7bc0f52e272", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620306177, "uuid": "3e606717-4f06-45cc-a616-4c388ec5df64", "comment": "Malware payload (Dridex)", "value": "cb37192664274f74cf1cb055e2097330e5cf4495dc258df85ab8a7c0498b6d8ae5b6ab9befb82c80befc4730695c53a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306177, "uuid": "630778a2-88ae-45eb-b7a6-992d06833bff", "value": "DAF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306177, "uuid": "bb6a1815-9aee-4df4-8c54-5a11373c37b2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306177, "uuid": "2bd927ae-8bf7-4757-bc3b-4405e0a71d36", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620306177, "uuid": "845f435f-4c29-4983-bd7e-6803c68f7d4c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620306177, "uuid": "df5994a7-7ce7-4c9a-b393-99bf5df4478f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620306177, "uuid": "35ec377f-12ab-4312-a0c9-237230408bc3", "value": "7fd8d074_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54be70e-ae8c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620320546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320546, "uuid": "727fac0c-6852-49f6-86bc-70cd9805a847", "comment": "Malware payload", "value": "5e10e92f1519d0865b2217d2ea1bfeb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320546, "uuid": "bbc4305d-5881-48c4-8f0d-823ba9f6c4d9", "comment": "Malware payload", "value": "a1436d2f5e3799f201e7d5d0ff523fdc96f0abda8e7aba4314068d58b2963025", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320546, "uuid": "2f2e0ebf-ffd4-4bde-a65a-58542d3b4120", "comment": "Malware payload", "value": "2eb59fcd3ad24a1ae763344c0698913acb8b43c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620320546, "uuid": "8703ca2e-f2d4-41b5-8ec1-85ceec8f8d34", "comment": "Malware payload", "value": "9da29b009926a699757a4aa1ad4544cbda91bce2024296ae590c826640245658bd63232338c156d7a4ca06ccb6e20aa3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320546, "uuid": "299ef92e-2224-4026-9f9e-ba5b6375e78c", "value": "B8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320546, "uuid": "1b26e280-17ee-4dda-9edb-60967496f28a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320546, "uuid": "a0a49898-b644-4696-933e-9c4b8a844dc2", "value": "3072:qiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:peAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620320546, "uuid": "ba965312-50e6-4b08-9460-ad3fe1173a31", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620320546, "uuid": "2c14cf72-b753-46a9-bd11-3555811b65fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620320546, "uuid": "4d88f5bb-48c6-4cc8-9486-86f4d0188207", "value": "5e10e92f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f4dd6f-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331341, "uuid": "ad70258b-794f-44a1-a94a-c809387dc49e", "comment": "Malware payload", "value": "4c91bb8bb5a3fe1a2d5e0c1c4940c1bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331341, "uuid": "4f61525c-9f4d-4f58-b84b-1d983b9e247e", "comment": "Malware payload", "value": "a19e175b2afb5705eb4afb837cc76d2ec66a338b4905dc4d3af691e4a02ca334", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331341, "uuid": "21207fde-dc3c-4821-b109-06460980169f", "comment": "Malware payload", "value": "e88d3a8d710555b7f6d1d400607fc01b631793a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331341, "uuid": "87e064df-5050-40ce-889b-809e10433a8f", "comment": "Malware payload", "value": "a3e1be62ac21a61d4aa56ee4203f09cc58248480d55f0b0a5330708d3e404aecd0ceafa15afa1e3266d1338c3d526297", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331341, "uuid": "8405581f-68ef-4029-aaef-8d88cbbcbfbb", "value": "51F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331341, "uuid": "82b37e88-5ab6-4009-b102-f5201a0f4ba2", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331341, "uuid": "a6fef80a-628b-488b-8541-163196185ac2", "value": "3072:vlG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idEl:cERMVPG6+Y63HoG1QawL40Prx6Kql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331341, "uuid": "695f5da9-9781-4dbd-880f-4d266e981f17", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331341, "uuid": "d32886bc-f0ba-438d-8e1f-253eb47bc897", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331341, "uuid": "84f39c47-cb3f-4ba9-9d4e-9c3e11a9b5a4", "value": "4c91bb8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5988115f-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620285549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285549, "uuid": "b0cd4e85-ef17-42f7-b7e9-6f77b7f426d4", "comment": "Malware payload (AgentTesla)", "value": "d3ab21b2a408e122f4120325dc776785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285549, "uuid": "090c4ff2-ccaa-487a-a981-e924bcc414e0", "comment": "Malware payload (AgentTesla)", "value": "a1cef5e9d8073d2a5f519c4f40e79404e2fba88efafd008b745766a8f1129468", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285549, "uuid": "ad3326c6-514f-448d-a248-d08c711e0049", "comment": "Malware payload (AgentTesla)", "value": "a66ee00bee8d6261f2fdaa0d2940f6c930708f3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285549, "uuid": "2a4d014d-ec64-4954-aa03-167237fdba1f", "comment": "Malware payload (AgentTesla)", "value": "44080b2876e2c921c801a2046bd92d5530035e2a1dbef8dc8fef178a254a2a083921f2d70ed355a6ce32435108ec40dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285549, "uuid": "709446ab-7d33-46b6-bcf7-96bd6855309f", "value": "711517EC761075EEC617CC22DBCE1C15D6202176972B9607972303BD9A0EE57AF384EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285549, "uuid": "50c793f7-dc3e-4e81-bf44-a1b6bd0cabe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285549, "uuid": "46aca372-63a4-4baf-acb0-3b7467a83852", "value": "12288:6StGUoLLoS60/K7yh08scVBYqsThqeioEglXgmJKu7OVO2HYByVXf9Wg2J3Ft1Vb:66/oLA8B/YqsoePEgmmJROVuBS52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285549, "uuid": "e61f6d64-3c0b-4c44-bfea-05a3903572a0", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285549, "uuid": "34f4717a-ee4d-46f9-acc3-6bb88431dceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285549, "uuid": "e181dade-b1cc-4a31-b4e6-c1469156947d", "value": "PO#10-M..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab1dc26-ae52-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620295537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295537, "uuid": "b17b5074-0f7e-44ae-bee3-90fc64c4d003", "comment": "Malware payload (RaccoonStealer)", "value": "719009a094c6f3155e7abc537078b943", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295537, "uuid": "10e978f0-af3f-44b7-8346-012151039b12", "comment": "Malware payload (RaccoonStealer)", "value": "a2420c7f0c7bf5d3c0893aff6b7440a09c0531632434d2bbb6f8ed98b04317b9", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295537, "uuid": "932cdbc7-b3ab-40be-9a7c-155a0f5b781d", "comment": "Malware payload (RaccoonStealer)", "value": "c4b3109cf39b301b30e732db7493f3241236ed1f", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620295537, "uuid": "08a74512-056f-4438-b682-fb474189dae1", "comment": "Malware payload (RaccoonStealer)", "value": "1b758ebdabe2b977dfc778eba76925b357fa6299c4ceafe0e6254038a322ea09dd3ab1c709ee9cf103a2002e218cbb2f", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295537, "uuid": "a9d6f1c7-e743-473c-9d54-0a7b77260771", "value": "2303BF0DB2157D99C2766D38C22D2CE99D0E22A6D583F00E3421B7945DF96CB13CF28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295537, "uuid": "12aa9f22-9e2a-402b-8c47-d1a2d29a38ca", "value": "384:Ch5xAt9pPZx+Z3HZFUB2tUo8klE8awtLRm+WwGlEdjTPfpE5d+JZXj0Kmy0rwwlu:gew9cBgYk0NlERTHpEz+8Kkrwwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620295537, "uuid": "6b1acf8f-1665-4809-b55b-e32ea50d34e9", "value": 38775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620295537, "uuid": "29fb8404-524b-4635-9d90-a9809b623a0a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620295537, "uuid": "d03cce33-2e73-4f4a-96a2-da0fcc0c1ed1", "value": "viruss.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40558e7f-ae95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620324161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324161, "uuid": "680f7fdc-d9f3-4c23-8a99-c878eb7e56e8", "comment": "Malware payload (Dridex)", "value": "1dcae434bb62884e8d900190e7d75940", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324161, "uuid": "6bfba8f7-00c6-4b58-862f-0d18f94ba341", "comment": "Malware payload (Dridex)", "value": "a2589a268c7a5b82d56b2829ea559d49d955f50aafe66fc0458a31b33948d49f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324161, "uuid": "d6078f0b-d5b4-4c74-8336-5266ee00b983", "comment": "Malware payload (Dridex)", "value": "90625be7bcc98bceef89c236b516540d88b873e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620324161, "uuid": "54549b38-03d0-4a8e-9797-e687c2a02f6a", "comment": "Malware payload (Dridex)", "value": "2be29fdf7cf4af63f5058571bb891d2ba33a6340e6f12be2c17f17440479f5b66e7c46e2757fcb28af86669421fa3f8c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324161, "uuid": "7fffed47-945a-4128-99cc-fcf6401b8b37", "value": "EBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324161, "uuid": "3d8c4262-6d23-467c-a100-9dfc64eb5f67", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324161, "uuid": "bc1ec98d-c8b5-47f3-9b78-da9eefda8a88", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620324161, "uuid": "7757e97e-7957-4e57-8208-6ed2a690579c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620324161, "uuid": "b3b5dfb1-8b48-473a-af80-6314815b1e23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620324161, "uuid": "e6c51064-f162-4afa-8fa2-e37acaabc77d", "value": "1dcae434_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882acc7b-ae74-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620310108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310108, "uuid": "8c5b0eb6-5814-42d0-b280-3cfc22ec4dfa", "comment": "Malware payload (SnakeKeylogger)", "value": "00bc3f04139ef508d1b9908f5664ded3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310108, "uuid": "97dac62a-f54d-4e3a-8a0b-791c46571f76", "comment": "Malware payload (SnakeKeylogger)", "value": "a27215f712b2bb0fa0b67a8f11c1a5bcc9cb3a77743eb87e873afea16a3153db", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310108, "uuid": "dd3dc933-fcbd-44d8-a38a-d65b7b556244", "comment": "Malware payload (SnakeKeylogger)", "value": "63ea1d509436c8aac2f92d5d85faca47cbf3961d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310108, "uuid": "4ec4dd52-3b25-4fab-8714-59f3f9dad8f8", "comment": "Malware payload (SnakeKeylogger)", "value": "057099c924ae97f3423c1e1415d4cccb255b7b847ea76fa3e8f41b350b7d3e3e0f70666b674d3949ef7cb547b675cc72", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310108, "uuid": "c4b647dd-3c90-4a98-8d11-91ff69b27ddd", "value": "9014F1029294D912EEE73E353DF2B7250B35BD01FD22CA1F98C8B31BC675B649861B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310108, "uuid": "196f991e-5de1-4439-ae10-0d8ecf34d524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310108, "uuid": "375290e3-c524-4997-ad06-8f48f3de0493", "value": "3072:SkX2zepFxu88bZjsM3L1CLa5WxV6hAPD5soyttSkJVmGr6+Nwb8yCHCpEHoHbk34:SOLXPtXOY/+Cpy6Us+22gIhAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310108, "uuid": "e0b58a26-4011-484b-b6cf-a5fe2e32632b", "value": 198968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310108, "uuid": "5ed22c22-70ef-4692-a400-83cde391d104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310108, "uuid": "cf2cfacf-ae41-49ef-90d3-e357bcee11ff", "value": "FPI_0485010214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0a2240-ae71-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620308670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308670, "uuid": "0646d7e6-326d-4335-931e-b045e7cc72fc", "comment": "Malware payload", "value": "6f5becf384bc3c361103e0f2685fcf3f", "object_relation": "md5", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308670, "uuid": "9c3490b4-e909-4da8-b465-15461778cea9", "comment": "Malware payload", "value": "a288764c9f223354f3e0665d41632b84f52db509f9b533a4ba955d6cfb5cc11b", "object_relation": "sha256", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308670, "uuid": "96964ae9-1c7d-453b-b5dc-5a917606b688", "comment": "Malware payload", "value": "7ffc4f683d6d2076b7322433a8de4562028116fd", "object_relation": "sha1", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620308670, "uuid": "dcf1f44d-3545-49d7-8c24-7f2fab0d81dc", "comment": "Malware payload", "value": "f8003580f220f7f50cc90da0181a11eb62ac26f32e4c77032365c990360d97be1ba128c03e02db391b49cd5ae6a1e2e8", "object_relation": "sha3-384", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308670, "uuid": "01dc6062-1c13-4378-a538-bb763eb3b2f1", "value": "B4454370165D216C50B862C2B9D4FBDECD8BEBB09038559752690B63F724E00AFE97E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308670, "uuid": "3a172cde-1299-45b3-8a06-42b570023122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308670, "uuid": "4bec76b8-5d1f-4f12-b862-e6db367fcf83", "value": "1536:asdmrgzrz/y321PrfDm0r0olO9O6Uw+wSUU9BGgJIuaxGMzm/t3E6GGOVBE+KLDW:Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620308670, "uuid": "e4d8d97b-a995-4da8-8438-1f8099718257", "value": 1270840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620308670, "uuid": "bb03a72d-6460-4383-bc71-dbea9f4d0a38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620308670, "uuid": "2226092c-6951-466e-93cc-721a2eb7adeb", "value": "Our New Order May 06 2021 at 6.00_PVV550_TXT.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87689315-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339313, "uuid": "00c1bf3e-2157-4f1e-9786-b340c504787f", "comment": "Malware payload", "value": "c3982cc7cf6a4e27e9ebf82d3949fcb6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339313, "uuid": "6b167a3e-3720-46ab-9905-ab5898810ecd", "comment": "Malware payload", "value": "a33bdac7b02a3c5cffdd8124094d44d794dac58fbd4680210c780634f257b79b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339313, "uuid": "00a3a56c-f151-4c6b-a756-95ba2e701c42", "comment": "Malware payload", "value": "505813298c07e2e36cd81345bb3405d1d8d61cb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339313, "uuid": "86236dc6-1c4f-4034-9f8c-4bd3c1667534", "comment": "Malware payload", "value": "0ed0027a66967f624e7e953fe800e7dbfc1badf54983f21aa039b1a635b03ded3417e00409f715f7bcb0236ae460a5db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339313, "uuid": "22148891-0a43-45c9-a2ff-8c377900c8a3", "value": "23F3C004D167E6D6C51A583222EB2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339313, "uuid": "06401b76-df9c-4819-85d1-159f9297d44d", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339313, "uuid": "cd6d5776-30ef-4063-ac82-e7bc4ff9d516", "value": "3072:+LG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idvJ:lERMVPG6+Y63HoG1QawL40Prx6KJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339313, "uuid": "f97f4022-5209-48da-8ae6-388a685040b5", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339313, "uuid": "8a1eead7-71a6-4884-9dd5-f36e71be2702", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339313, "uuid": "20270569-dd1a-4611-ae6d-7d94b98c5620", "value": "c3982cc7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529e2bd2-ae6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620307442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307442, "uuid": "4a28eecb-85f3-40e2-a65a-b71d40471e90", "comment": "Malware payload (NanoCore)", "value": "bf85ccbe67f3c5b40b631f0cb15b0267", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307442, "uuid": "70c148aa-afb9-49ee-8947-02fdfb82995e", "comment": "Malware payload (NanoCore)", "value": "a3ff1db78421ee274cc7c162352e3bc9815b772a0f608b53bea1c7d5f35cdbeb", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307442, "uuid": "5ea45ae4-7292-4817-b229-01e4766f5866", "comment": "Malware payload (NanoCore)", "value": "6dcc4a3d9de50329c25ad15fd356a806e0236425", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620307442, "uuid": "c8473c0d-129d-4f8a-b4c9-bea0b63196bd", "comment": "Malware payload (NanoCore)", "value": "c3db187a35005b05b40f4c666308cd09d8795507bd0175dfe283b0a7acc71b1412160dce744f7d52690494a1ecd8cb57", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307442, "uuid": "91f45886-3b4e-4fe0-be30-d9e4ce01c611", "value": "A6652352ADEF1765CD2B1C30611AD57D883FAC416A18EC033264BB2728B5AFD076F1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307442, "uuid": "65619a67-2333-4ad3-b47c-beb7c4c64e57", "value": "24576:aJmcGtt9eREMQ1UOH1dBmTYSzrdJD7wneXGAEiUa4swIs/CO5/v21ARYq9:uHHRe5H1qY+PMneX044Nx/X5mWYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620307442, "uuid": "637d6baa-38b7-4e32-92b3-dce0cbd77f3e", "value": 1460736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620307442, "uuid": "8aea7bf2-3d48-4b10-a22c-4cc3b08f8b3d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620307442, "uuid": "397989f9-ffa7-4451-9414-e3f33d901866", "value": "Purchase Order revised by Helen.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a01afe-ae28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620277306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277306, "uuid": "4a48cc99-baf5-48e1-b61b-7de54e640700", "comment": "Malware payload (Dridex)", "value": "79076c5b6312574a942bb29c8a744954", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277306, "uuid": "554dff13-1034-4135-a3d6-7b130c302a16", "comment": "Malware payload (Dridex)", "value": "a44dba05473d86027dc4024e06dba6aa8bc7b471976529e7d90a51948a204de0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277306, "uuid": "60c910de-c3ae-4da1-8212-bdd09905a8d7", "comment": "Malware payload (Dridex)", "value": "30cbc3458abe98877dc129c2cfc5d2784059c889", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620277306, "uuid": "295e2ba5-2fba-4f23-bcf9-d8a044de1bc2", "comment": "Malware payload (Dridex)", "value": "cde71918b1203d292ab8f505497b2a4da162cf324509cb6f3f0b96bcfad7259beb556bda9c0dbaaee2e3d5c4bc117150", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277306, "uuid": "6159e325-f1de-48fe-bf0a-ce432bb7e3e9", "value": "E2F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277306, "uuid": "7a0a56bc-8abc-4cab-918c-997073787ef7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277306, "uuid": "3c97c416-b1e6-4625-9134-8c8ef96554bb", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620277306, "uuid": "d3c6e2dc-17c9-4641-b240-207d7090a6de", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620277306, "uuid": "8cdd77f4-d8cc-45b4-8392-4e6daefa0c50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620277306, "uuid": "86ec562d-9971-4dc7-b264-a6c0f25e9b48", "value": "79076c5b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ab3b64-ae5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620301024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301024, "uuid": "18d8bc1c-817c-4c8e-9279-af0f5e351e35", "comment": "Malware payload (AgentTesla)", "value": "0f86f7419d65a30776bf05202f815249", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301024, "uuid": "d9aed254-d6f8-420f-bf79-9a5b64dc86cf", "comment": "Malware payload (AgentTesla)", "value": "a49901cf034ced81b286e6873c9500bc10589dd4dadbecff02173d5142e232d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301024, "uuid": "bfaa4505-8e71-48c7-8da1-715a2e50b623", "comment": "Malware payload (AgentTesla)", "value": "e2607d03b08ff3c29c2f22cd1efdd9825268d56d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620301024, "uuid": "1c292376-f2bd-4bf9-99d0-5d433b962a7d", "comment": "Malware payload (AgentTesla)", "value": "6bb6e507b0745380d391a35553e66c494ae66fc043f660f02209a56b58f9e8c7e984292960463e3602be761e42504e24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301024, "uuid": "3c81335a-d8f9-4f64-88c4-41194972befb", "value": "ACE5A0B693BEE565F4E93F28915573831E227FF0613290A407C1672AD6B04909CFCBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301024, "uuid": "931f7562-fbe9-4c97-946a-cd78a2ab5a4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301024, "uuid": "65e07837-392f-4d96-9cfd-f961911719cc", "value": "768:wCkqujqPN9Kgi7+bILhJ5OBzw4GUiKiaRmKw0EGCAt9nYeErbr3pWP9LeAznOykr:Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620301024, "uuid": "6cf69ed3-99f0-467b-b1d7-e1850dbb2bbb", "value": 3302400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620301024, "uuid": "b0bcae0f-2933-447a-8489-7a7f6dce22fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620301024, "uuid": "2fe6eda9-4603-4c32-8344-7f71ac2e3d89", "value": "BL-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64154e0b-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338824, "uuid": "98ad3f92-c0db-48dc-8e13-59feb928ff9e", "comment": "Malware payload", "value": "4568c48da0141a2d85fbc8f28f92237c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338824, "uuid": "37b1a9d0-f4fe-4b50-b83f-47bf43225fee", "comment": "Malware payload", "value": "a49e4d0018f695ad241f4dbb6a4ba108313faf96af36f75f9d29b02dbedfdacf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338824, "uuid": "22893fb2-09b8-448f-83af-d7dd5915ddff", "comment": "Malware payload", "value": "fffc5bb491f9f9497cce04f714a498f48e5afb02", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338824, "uuid": "9da3fc96-24d0-4914-8c59-246355fa516b", "comment": "Malware payload", "value": "16b2cf114ef32247fae855e3b1ddbd873aac59df08a18e19195aaf147765a7e1f9d681d0fc6ea7a67bdc73caa8c7ceaa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338824, "uuid": "b207ba0a-0d62-49e9-9d7f-4a939f383e7e", "value": "89F3C004D167E6D6C51A583222EA2B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338824, "uuid": "bb01b2e5-0603-4785-9db1-58727cf4a32d", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338824, "uuid": "bab1711a-72f2-43bd-a5d5-ac0b9244ba30", "value": "3072:5OG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:3ERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338824, "uuid": "9fc07caf-7f98-4f54-8443-7a5cd9d84f56", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338824, "uuid": "67fa9839-8205-41b1-b273-fec68ede170a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338824, "uuid": "3f377a1c-490b-4bae-b826-0299a6e7f394", "value": "4568c48d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e5ac0f-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339307, "uuid": "61b85e15-584c-4af4-a7b9-644ccbef20e9", "comment": "Malware payload", "value": "36fccbc8bca10839c75021e25762c809", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339307, "uuid": "2c73447b-9d78-4a69-825a-3439d96dcf8a", "comment": "Malware payload", "value": "a522cd658cf8253bf403e63ca2aa3dda0386a03d8a7374b608f212d6a377c0ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339307, "uuid": "0957e46b-474f-4db9-87de-25bdad91e540", "comment": "Malware payload", "value": "e7e77e0fb244d35d111b3cb9a529a875f73a6fc2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339307, "uuid": "e4f27ff1-8635-46c0-a2ac-ae452d167b66", "comment": "Malware payload", "value": "876e33f5f0747ef9de69341ed9b0cdabc1968b778aaa69ef47e79459e398aed8406e54b2684378c300b7c0f49dcbcca5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339307, "uuid": "fd4970d8-2501-470d-a9a1-5407be9d1c61", "value": "95F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339307, "uuid": "10979e05-8341-4dcf-889b-6fabf1b8fce3", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339307, "uuid": "c9e22580-4c69-4828-8014-ee3b25d61bd0", "value": "3072:0OG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idsl:UERMVPG6+Y63HoG1QawL40Prx6KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339307, "uuid": "49b1fea4-1ab0-47cc-8b61-11a750bec138", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339307, "uuid": "6680ab14-79a2-41e3-aeeb-1a73f5aed167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339307, "uuid": "520f5976-8b16-4145-b64c-bc528564848f", "value": "36fccbc8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1e459e-ae75-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620310357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310357, "uuid": "cc331db8-d44d-43bc-bbf4-9a2d305fcef6", "comment": "Malware payload (OskiStealer)", "value": "d32bc982566fbb8d81d3012779d3c320", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310357, "uuid": "bea955e7-c6b1-499b-89c9-af8357486671", "comment": "Malware payload (OskiStealer)", "value": "a59fbc4f9903ed18c989e87bc83073b463310ffe6c90a43c53400739719d0aae", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310357, "uuid": "a7c60a4c-62f6-4d6f-91c5-4bc56899bde6", "comment": "Malware payload (OskiStealer)", "value": "74e5c60af59a50757abc29942c888fa43e854204", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620310357, "uuid": "1a1c6469-58b3-4521-915d-ae532e3e812a", "comment": "Malware payload (OskiStealer)", "value": "7b5733012acdfa31343bb38a357ec2a6ef07739973f64a3bf5fef3a0421593194c8871ac156b306f4c50f56594f35cfe", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310357, "uuid": "b24e2230-6c75-4ffe-90ca-cd7dfb3ecf1b", "value": "0084A178FDFF6985C610DE3A666DB05A06E19C18CE8B837BE0D472A47E30DC81A4651F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310357, "uuid": "092c2918-104f-44b4-812c-ce795cbdc86c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310357, "uuid": "c2834ffd-0923-4f6b-98ef-6bc1331a9130", "value": "6144:PwOdf/UYtfUeAIQHuA36cdbYMPsCIZlqV5hkvLRG:PwI/JeeAItC66bnPUZlckTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620310357, "uuid": "889115da-c637-42f5-adf2-2d0c8ae73cbd", "value": 388920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620310357, "uuid": "8c5e6f0e-2914-4f08-ac3d-1f47bfecf63e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620310357, "uuid": "1667b05c-7916-4f3f-bedf-d4bdee2e3bf4", "value": "FLP_1037850047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68acc7bc-aeb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620339261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339261, "uuid": "ba561861-68a0-4160-ac51-140dd1b9bf25", "comment": "Malware payload", "value": "b8a93a58989d8fba942edd58b23af911", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339261, "uuid": "204f3c28-c0e0-4195-b97d-17ff8b8ca6a4", "comment": "Malware payload", "value": "a5e6d93382a820166aca81494a76ed6fcdb7494fa9b93106c91c61f5e1fdf778", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339261, "uuid": "b6ce314e-860e-4dd7-98bb-4e1090ac86a9", "comment": "Malware payload", "value": "900f6b71d1e5a87bdd375103d0c7e8f0039e71ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620339261, "uuid": "b0115f6a-8d9e-4a6c-b0da-f5c8c11de59e", "comment": "Malware payload", "value": "9350866914dd1727ff6d71fb48d58c5b6f41b0a6a8908add6cab5d061daf2af1ef30d227a9d3c2b69ed9f55c5a5a9911", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339261, "uuid": "815cb130-aa5b-4ce5-a39d-b0709f503fa2", "value": "64F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339261, "uuid": "569f7bd1-750e-4bf1-bc27-ea79580d768a", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339261, "uuid": "e5ff38e0-1794-4a81-ac71-dd2b47f55d65", "value": "3072:4EG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idOJ:yERMVPG6+Y63HoG1QawL40Prx6K4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620339261, "uuid": "d90cee01-f738-4a50-8c6c-692e7336729b", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620339261, "uuid": "e840aa7f-5217-4f3d-bb37-bf8d59fef7c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620339261, "uuid": "a7aa1f0a-df96-4b6b-b0bd-55cc5e872646", "value": "b8a93a58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c6af3f-ae2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278701, "uuid": "4dd44742-bf86-4a1c-9058-b97e835b9e72", "comment": "Malware payload (AgentTesla)", "value": "c5998c37bb12bff5907a843e108890eb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278701, "uuid": "c28f688f-904b-417c-8e7f-871e96db9d76", "comment": "Malware payload (AgentTesla)", "value": "a6556b7eed95166b68b090b32ae7a802a924f22b0fc3e5bc9ed7ee77183ef392", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278701, "uuid": "b7f1a5b7-2648-423d-8d94-2cf41602b4d7", "comment": "Malware payload (AgentTesla)", "value": "3367e6e64f2a70bab494b303b6dba0709afdab17", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278701, "uuid": "353aa995-eac1-4210-b3dc-63b2f9a87267", "comment": "Malware payload (AgentTesla)", "value": "f0022c01e1be07659b576b0f4787670c6dd49e9e23490d051cd5ce4a318798ce4693f1e8520c3918024f95235d63ede9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278701, "uuid": "1dda883a-02a8-4cfd-852a-33e9462ba389", "value": "6EB423825727AA758B783B16AA0FA3D11BB82763B29F7C1E70513CE110AC347D704D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278701, "uuid": "fe98b494-b80b-4770-8e8f-3481429fdefc", "value": "12288:74oOiY8fmm+m6Z6yaN3LvxiVp1o8uH1BH:74/U66lL541o8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278701, "uuid": "25257672-8eac-4635-a3c9-b1e49a76aedb", "value": 503398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278701, "uuid": "f2405172-f0d7-4c9d-88e7-313282315594", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278701, "uuid": "e162b677-5d44-42e9-89f0-9a8c4f332c83", "value": "MV GENCO RESOLUTE VOY 1 DESCRIPTION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85dffcc-ae59-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620298566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298566, "uuid": "05883d0e-c9b8-4e96-a3dc-77730df170b1", "comment": "Malware payload (OskiStealer)", "value": "769971b221bd083f1f14c70b6a04a1fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298566, "uuid": "11a78370-9e60-40e0-88cc-448aa5b7cb13", "comment": "Malware payload (OskiStealer)", "value": "a68ec0c26f99b4f59d0abbd7cc98de6d9136ffe0d822d8056476d356121e5011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298566, "uuid": "5b25bb17-4b5e-4dcb-a0cb-1fbbb1e93f71", "comment": "Malware payload (OskiStealer)", "value": "2302767a678cd7f7c68081028fdc69dc9eea9fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298566, "uuid": "7151e849-e8ea-4685-936f-7cd7744ed8ac", "comment": "Malware payload (OskiStealer)", "value": "52af98fa4c4361c5f2d75bc459b8769beefd9e551f91b939451e696b67ccdb3b103339f664981dcd30a75a725c9b1b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298566, "uuid": "f69813df-385a-406d-97dd-8367b4bae323", "value": "3A64F1C7F1E0C8E3D0109A300C6AB13C92BA8E4951941E529F99FE7D78466A6153BDFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298566, "uuid": "63f4a2d2-9777-40ee-8792-0bc0b53335f1", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298566, "uuid": "cd867311-1129-4a17-a535-b1779176843c", "value": "6144:r9X0G1ssJS6DktH8u4zCeT2yIjoGo4b0vXUehHgZfSSZVd:F0mfSWktH8vvi3joGoAuEeds9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298566, "uuid": "535416b7-ae87-438c-a92b-cbbe7e55f3fd", "value": 314604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298566, "uuid": "44627ba3-fc82-4439-a3d2-e8b732a4e44e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298566, "uuid": "b00a9d1f-6ee3-400a-b61c-8d42bdc60820", "value": "PO5621.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4354bc9d-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338769, "uuid": "2813acca-e411-4d13-9ce0-75bb4cccb1fc", "comment": "Malware payload", "value": "4e244144bd648b650a35d350460d4e88", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338769, "uuid": "457f08f0-8c20-41ea-8c5d-d74f11217aba", "comment": "Malware payload", "value": "a6917db4ed74769f9023f1cbe7288a6bcd07ffd97ae0c9eac808e1b2fc28eb3c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338769, "uuid": "ebeee473-b073-4460-8a15-6dc1d839532c", "comment": "Malware payload", "value": "9793b8ef55a377f0c7d78ea7cb6f7f7f646c4e27", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338769, "uuid": "ba1ccaa7-2621-48cc-bad6-31fdf1b74046", "comment": "Malware payload", "value": "7cab0947da247a4031ddfcb09a1e04cac8932878b0235902c982e919453471482a023f0905d323abe60e77913fc6b089", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338769, "uuid": "f610e06a-7cc7-45e7-a0db-86ab5a1ee09f", "value": "9CF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338769, "uuid": "ed37d661-f36d-46a9-8b16-e0663058e101", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338769, "uuid": "220c9e38-79a1-48fa-af51-1011f82de271", "value": "3072:ziG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idqw:dERMVPG6+Y63HoG1QawL40Prx6KQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338769, "uuid": "3e9c0f82-e4e7-4eeb-ba13-87fb6f462fa2", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338769, "uuid": "50460808-da29-4c9d-a73a-015c97c638ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338769, "uuid": "78f1d167-c080-498b-8871-330f2cf15f6f", "value": "4e244144_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7b04fa-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280853, "uuid": "38f28a92-abc3-4126-931f-5a100b8ac398", "comment": "Malware payload (Dridex)", "value": "c84d3b5e7471570799edcbaf1bef3bb1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280853, "uuid": "318a90cc-b14c-4bca-a395-4e19348ff714", "comment": "Malware payload (Dridex)", "value": "a74684afff3f3f2de598a7a7aee538cb0bb627219f6cc67cd7bdb9775a4c53b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280853, "uuid": "c506cbd3-50fe-4167-ac4c-ae8439c7bbdf", "comment": "Malware payload (Dridex)", "value": "8fcf888e2b2c5cf3907e86bacad88250b7d093cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280853, "uuid": "2a3a650f-7037-4e95-897e-300d711904f0", "comment": "Malware payload (Dridex)", "value": "7137e7b746a8432d44aca968c182cdda4ac7fcc37a8ecfc609de9fc56271a06f04f439b4c33c7e04ff0e9c3a2507738d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280853, "uuid": "cc8c132f-f5a1-4995-a72d-2cc51f3ed4d2", "value": "73F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280853, "uuid": "c957a92a-76d7-4f3e-ab7f-9db3b7ce1971", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280853, "uuid": "aedf4597-f4ef-4fe2-bac8-25c69eebc2c9", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280853, "uuid": "1e0398b7-9537-4c81-9d18-2f8b33b4ff62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280853, "uuid": "388a298f-6fc0-444d-948b-fdd43eb16779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280853, "uuid": "674b20f9-e3c4-42e0-9ce3-6aa7d24f0852", "value": "c84d3b5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d89de8-aea6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331371, "uuid": "84f75719-790b-471d-9dd2-b405a9b14ced", "comment": "Malware payload", "value": "f9b5645195b5401f6a760048f7cad234", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331371, "uuid": "2286579e-e4fc-4ef3-9354-a90a5f0ad0db", "comment": "Malware payload", "value": "a7bafdbec2c234e685b96745393e3bc1d8fad0aef767a4f2ae960739d452f368", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331371, "uuid": "cd7cfa1f-5e9f-4a00-8cfe-7c19f2b19c62", "comment": "Malware payload", "value": "268f6f6e522e558da97a9d0eac925f0c7ced247c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331371, "uuid": "dbd3036e-0b88-44db-9385-59ffa591eeb0", "comment": "Malware payload", "value": "5e8b1a88504d4bef645464d779aa2343fe69ca4625dfa55372b5da05170c5eb598d9a5117a7ea06aade4e2db6fe7e027", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331371, "uuid": "213dc75d-18d5-43e8-9c0d-3db7b73072bb", "value": "37F3C004D167E6D6C51A583222EB3B3B96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331371, "uuid": "c9c13f1b-afa2-494d-bafe-db838ed869c5", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331371, "uuid": "ee272bdc-2b71-4dd7-a372-4ee763776b3a", "value": "3072:6UG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idzT:0ERMVPG6+Y63HoG1QawL40Prx6KNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331371, "uuid": "1c024cfa-86f7-4ef2-81b8-a7795c3eef83", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331371, "uuid": "02eefd09-c40a-40c9-859c-3e141cf32254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331371, "uuid": "56954bc8-24e2-41c3-bff3-3ef15adfdd76", "value": "f9b56451_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801f305e-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338871, "uuid": "703b64a0-dddd-44c1-bef7-d978cc3c05a8", "comment": "Malware payload", "value": "3f06f139414e2c45b21e8f0dc2c481f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338871, "uuid": "3818d066-94e2-4eb0-8196-172627c8b01f", "comment": "Malware payload", "value": "a81448e09328d63d575f1bf96eb0b1000097550f257110204a0dad703e5cde58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338871, "uuid": "5e4084c5-d605-4e7f-92ff-d7a005ed6303", "comment": "Malware payload", "value": "a96917c732f42d653121f7282386789fba31149d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338871, "uuid": "9b7fe060-17e6-4054-bd96-99a45147b8a1", "comment": "Malware payload", "value": "853c530303036a6eed979c02a39fa1fa7620e144ec6bbbe2cf6de2c9df7768f36cac4538c88abdd547bb302b210b8794", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338871, "uuid": "6b0099a4-e9fe-4f25-af34-2ee3bd1c653b", "value": "47F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338871, "uuid": "e84aa341-4406-467d-a6ed-f9745d857ac5", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338871, "uuid": "8c086a43-4ad0-40d6-9ef1-5d0f6fcdb507", "value": "3072:NC45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:M4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338871, "uuid": "6d935c64-bac4-4f26-b211-c1323b82a323", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338871, "uuid": "bf0c78ad-0771-4132-a228-2acbc7611008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338871, "uuid": "f34ac24e-e520-4342-b717-84a19bf2b4ef", "value": "3f06f139_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9543de81-ae30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620280925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280925, "uuid": "2c0faaff-d580-40ab-b967-66979f8bf524", "comment": "Malware payload (Dridex)", "value": "4cf5ccd439c5919b606c08b7e0e5969b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280925, "uuid": "2ce95592-4990-4913-9434-af3944fb582c", "comment": "Malware payload (Dridex)", "value": "a881380e462361506a4b91708f8a5a0383744c828b5bf8bd0d3de2bbcb283ed8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280925, "uuid": "a5298ac8-4aca-4dfe-beba-06a37d8e0c19", "comment": "Malware payload (Dridex)", "value": "ecbce412868eeac25737b652030bdcd90dfd7426", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620280925, "uuid": "f878dc99-874a-4692-a46b-9046ef5c7b4b", "comment": "Malware payload (Dridex)", "value": "22d63f181a74d63c9de94cf6e9c68672c94d5784857133150e349265e5b11fe9a5db6b02ca22c42a2a3b94e32f2534cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280925, "uuid": "acf59ed4-f634-4a70-9576-d800adfd7ce0", "value": "F9F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280925, "uuid": "b30a1158-78d9-4dde-be47-bc9c8953835b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280925, "uuid": "c0f879d8-d64c-47ed-992f-4f3b02e8af40", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620280925, "uuid": "8053addb-568f-4b31-919c-1af0b4519185", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620280925, "uuid": "94d270c0-9c0f-4c5e-adf2-a508071b3c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620280925, "uuid": "cc42f398-4c8b-47a8-8a07-fe08ec804f80", "value": "4cf5ccd4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db244a7a-ae38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620284478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284478, "uuid": "81bc3c97-beb1-40ff-b8c9-d77a2f3524b3", "comment": "Malware payload (Dridex)", "value": "e9f16f3bbcc7ac3deebcbccfc6cd5f1c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284478, "uuid": "041a1f50-fe2d-4f5c-8f88-bce0abae458f", "comment": "Malware payload (Dridex)", "value": "a89f466bc890746eaf9d76cd256972bdd8ba830873a2a628839da2a5aa65363e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284478, "uuid": "1ef36bfa-7661-4184-8857-5ba8d4df401a", "comment": "Malware payload (Dridex)", "value": "c8581b8174565c9af3bffc2009a6b07adc8d7680", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620284478, "uuid": "8d8f863a-d76c-485a-a9a6-293c9b3ac75b", "comment": "Malware payload (Dridex)", "value": "f646d341004b041e5f749a36d17765e93c1e2a969cbdf9a1b6daf16def1bbc049a426604e9fc3bca5b090e5d5464e21a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284478, "uuid": "6232868d-8b0e-4457-a281-88531b1d01bb", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284478, "uuid": "958bcb2b-2151-4bfc-968d-bc4b5a8a2570", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284478, "uuid": "d52eb41a-aeed-4211-a5a6-1e231efaee5e", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620284478, "uuid": "039a603d-a203-48d4-9b10-c0190af2f63e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620284478, "uuid": "ae0a3607-9d27-4779-9b83-79075e9e90e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620284478, "uuid": "8add322d-dbaa-444c-9985-7db16c17d5cb", "value": "e9f16f3b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be001058-ae62-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620302468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302468, "uuid": "e44afe5c-a0f1-4bbe-bcbc-11df0330dc93", "comment": "Malware payload", "value": "54e50aee6df5255cce56434f3df1fd3f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302468, "uuid": "41798b27-7a99-49b8-9cec-8054af098ed5", "comment": "Malware payload", "value": "a8fa2bc68cf2b47965315c68bcde06cd09c139e4c8bd61efec7c0a533202308e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302468, "uuid": "d1829e67-6c87-4d2c-85b4-67463566c07d", "comment": "Malware payload", "value": "fbae62455abd1f5290c16e0c084f5f9080a3dc73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620302468, "uuid": "ef7c78fb-6d61-43fc-8837-e87fc1623fbb", "comment": "Malware payload", "value": "d38d74650164e86f8c5eb51d4380a60424e5e1edf0434a0234b607a95846a282fc36e83e593bd794e5106e45d875c4b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302468, "uuid": "1f93844e-71fe-413e-b363-2600741b7c37", "value": "A65302B0E64FB7C1C6B5D13981F5453908A34E01B7D0AC77CB84A45392BAB07AE4AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302468, "uuid": "a2dabf37-caa9-4087-b73b-72ae1dfef713", "value": "1536:pftVNhuqIEMza16XZAdmMFMhVL1OimlQhLvnvqdIy7Rs:DDVM4oCMhVLxm6PSOy7Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620302468, "uuid": "399f3df5-2da0-4d4b-8e7e-af3ce06f8fa7", "value": 63917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620302468, "uuid": "8f60023e-b0a3-423e-b31d-f474aafbbb63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620302468, "uuid": "df3a3512-3634-404f-ab37-d8f25dbad5d6", "value": "54e50aee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4163c1-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620331273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331273, "uuid": "665f6b4d-3a11-41e9-892a-229c439784b5", "comment": "Malware payload", "value": "63403b0216802ebe146267d0bb7cf132", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331273, "uuid": "d5ad2fb2-958a-4635-b77c-255e27944431", "comment": "Malware payload", "value": "a91cd9f20f619509657059fe7d7bbf7009042729682ed10839f1d3fd93f7748b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331273, "uuid": "1d857a46-3877-4037-ae6e-24dd99f44c54", "comment": "Malware payload", "value": "28c4b66963ec4064b8f5d98563a4c2aac90433f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331273, "uuid": "5d94c526-8e88-4dfa-a3a2-4f993333c86c", "comment": "Malware payload", "value": "53e1937a8181e6a92997b4810b94130f953397c8d0d055d7f45bb604d9256c0cb4b1ed8cfb0948b6579b31153ddb440d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331273, "uuid": "403087a9-eea7-423c-863b-f7b793b20aee", "value": "20F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331273, "uuid": "b79de491-64c1-481f-885d-385ed2b9d3b6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331273, "uuid": "73c63624-6df5-4aed-bd98-84ba2dec5835", "value": "3072:Clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331273, "uuid": "e85f9c7a-2cb3-4296-bbee-41bdc9e3b4c0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331273, "uuid": "99721586-a51d-4bb1-a586-bf52dc6321b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331273, "uuid": "15961691-3ea1-481d-823a-93fc9804325f", "value": "63403b02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5177a261-adfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620259336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259336, "uuid": "c7ee1352-df04-449f-9f5c-5f60c736ca12", "comment": "Malware payload (Dridex)", "value": "876b585b8313c042fc2448bf38b3a849", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259336, "uuid": "5811a164-85bb-4e6c-985f-dc02effb5e32", "comment": "Malware payload (Dridex)", "value": "a95abd58e924fa84d2756a5d291595ffe3a64cf395510f8368073094e17ce235", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259336, "uuid": "16febd77-cfb2-4292-9c13-90268eac55a4", "comment": "Malware payload (Dridex)", "value": "6ec82c78070d6dd2ce2663bbf43f12f47b25a108", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620259336, "uuid": "cda48ee7-4322-4371-8f18-f696d69f2306", "comment": "Malware payload (Dridex)", "value": "362c891c9b18770f8aeca13caf5e5eed5b130604a0e7512c6dc3c5bd5184ee90875c2447a41f692422edc293662b7306", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259336, "uuid": "477219cf-49c0-4be1-a995-6e11b672f594", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259336, "uuid": "5650c070-7e46-4b57-8fc3-b5b1313d5fab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259336, "uuid": "9c787ee9-0b2d-4252-88dc-c74e6ca422d8", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620259336, "uuid": "1d15a79e-2f4e-4c49-900c-38c013d29c6c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620259336, "uuid": "976e1de5-2bc5-4382-af91-d0e0b930f149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620259336, "uuid": "55d119c1-7a3a-4fdb-bc9f-287d90fcc9d7", "value": "876b585b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f9d856-ae2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620278904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278904, "uuid": "e7bea1cb-fe88-40a0-a499-e628b77d2f5c", "comment": "Malware payload (SnakeKeylogger)", "value": "b8b48f2c320b197144c9df81e5f6f84a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278904, "uuid": "e8d29ac0-e99e-4a7c-8fbf-954c552c069f", "comment": "Malware payload (SnakeKeylogger)", "value": "a981422143bfa19a5c5f715cae64c88919092a17cd2c3982ece0bbe7350621bc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278904, "uuid": "6e1ad7f2-81a6-4d78-889c-e7fe1de684aa", "comment": "Malware payload (SnakeKeylogger)", "value": "7441edc8fddd1131e8e48280fc1bed235a3cf515", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278904, "uuid": "9524dd7e-72fc-4c44-b5e2-4c77c2cb9b34", "comment": "Malware payload (SnakeKeylogger)", "value": "927338b128889afb9651d310b75de1503bdf88ec27b3507b65fe1d975f951559b0d3752859e0e276425af9499aab0157", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278904, "uuid": "6a4b4578-072c-433f-9108-ffeaf7035c9c", "value": "85A4230F14A0A15B310519F5DAA4BE059129BFBBFCD6B41B2D0FC48AEADC57F12E81B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278904, "uuid": "964e5c43-ba99-4d95-9a2c-7d7a9aed15f4", "value": "12288:oMhKVQUh8D0Sxy3/d+P8N4YCdDkj5ZK9gwIOGh:7hKV/+0ltyXlMugHOGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278904, "uuid": "b8963ffe-6ce8-46c0-b1ca-53cfbba881de", "value": 487636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278904, "uuid": "55252e9f-432a-4f16-8065-4f42a6ac4cf8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278904, "uuid": "9ce8fc1c-9dd0-4e65-be08-2295dfb4a7f9", "value": "Pre Shipment Doc..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60364b30-ae3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (StormKitty)", "timestamp": 1620285560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285560, "uuid": "aa08831d-1bf4-4a1b-b86d-a2f02ec43c06", "comment": "Malware payload (StormKitty)", "value": "15b5bb40a1bfaa661e6f0222df49d7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285560, "uuid": "fbe13579-b359-4359-b810-db1de2aa27d5", "comment": "Malware payload (StormKitty)", "value": "a98672cd9e7ea3c969d9cd5d2dd1f941e8a421fc3b8a8e8cebfa2f418550a2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285560, "uuid": "f46c2def-4454-4e62-b543-1ad35448bd51", "comment": "Malware payload (StormKitty)", "value": "b12ec5870ed4874724270c9b540b9e1dbfb3e1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620285560, "uuid": "35c76919-0fe5-4362-8f01-c2525a5b18de", "comment": "Malware payload (StormKitty)", "value": "19b3c0c07170b7ad2119b8c7d152586d5482789c5d4b5ef656dd51c4acfc33b9b05cf7b223c8e71ea9b6efd2a1905a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285560, "uuid": "651d8b11-9699-4b8e-8317-dbef28714f67", "value": "4B352321E3C284C4C250127055FBDE49267B7E556CA36C57B2A8BB183CF368F652AE37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285560, "uuid": "e3b3314d-965a-4dd7-b915-b5a46d0be846", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285560, "uuid": "16545d21-9c88-4bd6-a48e-4ff8e7bbffb8", "value": "24576:xFO+6bkSGAULH5A8yc7/cvVT8ZEXwvqEj+xhFBo:xFOUcUD5VH7/1Z6wdjaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620285560, "uuid": "cb4d187c-4c01-4d73-83df-46d057581d0f", "value": 1122939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620285560, "uuid": "bb8419d2-3e9f-4ca5-847c-9a699e2271cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620285560, "uuid": "d6ab8780-d7ea-4085-858b-e53f9bf058eb", "value": "IMG_INVOICE_6628862572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115885df-ae79-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620312057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312057, "uuid": "45e5ddbf-a42b-4350-8df1-a1c7d2254d23", "comment": "Malware payload (BitRAT)", "value": "279b01ec826eec272cdf1bc78cc78141", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312057, "uuid": "1bc95660-5e03-4ad5-8995-0cedbd64d13a", "comment": "Malware payload (BitRAT)", "value": "a99a40d67018df27d1c4a0aad6b77a5985ab161480459060d5485976e70aae85", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312057, "uuid": "75247bb5-a0e3-4dd6-8896-64820a0c617a", "comment": "Malware payload (BitRAT)", "value": "c56086a017b7156ecbe2d7d1edc0defe74378bb5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620312057, "uuid": "7812c34f-a426-4955-b891-391b93f833f5", "comment": "Malware payload (BitRAT)", "value": "62f69fca6871698b110b941f833f5c745e1fa005ec1e59edd53c688e3b57872cf589df5a0a1b6d3807bffa4605cc7d34", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312057, "uuid": "9badeec6-fbff-4e64-b9ab-7b91c195499c", "value": "41159D21F2D10476D1AF1E38AC3BB7754D32BE121AE4518667F87D188F39BA03D3A295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312057, "uuid": "36290e7e-eb02-4451-9745-2040cd2ceede", "value": "a4e462a199bd933bfcc2e6a6ed1e5792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312057, "uuid": "9ad50b9c-ca68-4017-8781-91c16b58c0c6", "value": "12288:X85p/Fufy1iu51lf2ChJrScwHWZe7EimMU8/r3V2JKOdKU/Oy/2U:X8rdbV1J2qV4pEaLqKOdKUD/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620312057, "uuid": "250c6aff-fce6-458d-883d-fc87f99b8a4e", "value": 930968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620312057, "uuid": "bacd7394-be2d-4afa-aef9-db600fe41908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620312057, "uuid": "91335c02-374e-4676-8b75-b56727f2aa45", "value": "Pedido de pedido Novo projeto maio 2021PDF.sc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af05b463-ae06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620262929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262929, "uuid": "3967d42b-77cf-4812-91a0-b8644b4355ff", "comment": "Malware payload (Gozi)", "value": "8bcf1872e424302dbae75f9f74989693", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262929, "uuid": "bcb6ec7d-4130-4529-8750-0a7f01123984", "comment": "Malware payload (Gozi)", "value": "a9ab1236de497bebadcb0010c376bcd62faf274aadccf9db4a91388602320e54", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262929, "uuid": "8ffc8f5a-02cc-49af-966f-c639cf276b31", "comment": "Malware payload (Gozi)", "value": "c179acda305fb4c6b9c57afc409bed805c86f189", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620262929, "uuid": "d410ffa8-0462-408d-b950-99695cbfdb23", "comment": "Malware payload (Gozi)", "value": "cc0c4a1bf751877d79dcd52e8ed02e4604491f4a1add729ce5422b7cafe2ea32141c2b48feba78be1261d979a7746796", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262929, "uuid": "a81fe850-e8e8-485e-9d02-b18b8cceffce", "value": "84F3C085DBABE87FC44A35399072DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262929, "uuid": "67387cf3-b0e6-4a58-a4e8-320cbfcaaef0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262929, "uuid": "32c932f6-9fc7-46d0-bbb9-1bf9d56d921d", "value": "3072:dt45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:P4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620262929, "uuid": "2c3cd7c8-1f34-4a46-88d0-12acbd589729", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620262929, "uuid": "49507a52-f646-4ee6-9767-67d1ca26c71e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620262929, "uuid": "ab95c3ad-c666-4a75-b44f-89c754e3ede4", "value": "8bcf1872_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036f96e0-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620313322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313322, "uuid": "303e1854-1fce-49cb-9671-e43a00dcd053", "comment": "Malware payload (Dridex)", "value": "fa63ba37dee1ecf08abb9a675d853235", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313322, "uuid": "a6a453ab-2fdc-4127-bf89-03bd75c2eb13", "comment": "Malware payload (Dridex)", "value": "a9be936e3a5cc89b7d23b6b6b8f05af0e7543cc34cc6137865bb55c4fa9ffdd5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313322, "uuid": "d65fd201-52fa-4e77-8eae-3c533f42a2fd", "comment": "Malware payload (Dridex)", "value": "cca683bb97dbdcdf26a2c47c8f61a6d156f28789", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313322, "uuid": "256ed29e-857e-45e5-b22f-1b3201c7120a", "comment": "Malware payload (Dridex)", "value": "136d407a7900dd251e882e02804b27da579a1c499ca2866a276fd39d4ef83b54f21e009991e88b7d32891824edf6f68b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313322, "uuid": "41906ae1-4cc6-4376-b9c8-d5bef4555b36", "value": "64F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313322, "uuid": "fcf263cb-53e4-4058-ba6b-91fd58435f38", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313322, "uuid": "4a354a0c-bbf6-4624-9ed9-d9af92da2d10", "value": "3072:hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313322, "uuid": "25c88cc0-69e9-4547-afe2-daecd6900588", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313322, "uuid": "091013e9-bd89-4f09-a208-f5329497543a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313322, "uuid": "c47a4cff-f0ac-4cdf-91db-a27f962526d7", "value": "fa63ba37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720e1c26-ae5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620298904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298904, "uuid": "3a2bb5da-e086-41c3-ac92-7a009cf9e110", "comment": "Malware payload (Dridex)", "value": "4233c09581676b162d427306f66e8b04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298904, "uuid": "22a550cd-48c8-4a3a-83df-1e16df65ff61", "comment": "Malware payload (Dridex)", "value": "a9c1a9912ccb50b1252ad06f923c5ea570c82a8c5936afe2592d6e0ff27175ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298904, "uuid": "a45aed3f-4e2a-499b-bdd2-43dce3391867", "comment": "Malware payload (Dridex)", "value": "c8132010739822954fb46f51f25522fba06e1cfc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620298904, "uuid": "b63e3b8a-94b3-4d8f-bf8b-1f72d552049f", "comment": "Malware payload (Dridex)", "value": "bae31d7ab87565d71acbcb6e36aea858d5cb5fd965340164b2763c9fb1ae1ed1d965ee9322ff8a39adf2afb10940d835", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298904, "uuid": "00d99ca4-b13f-453a-956a-6a37b7d2e35c", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298904, "uuid": "e8a5a81b-0a34-487d-8419-b4a0a16285eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298904, "uuid": "d40649db-7712-4a53-a88c-2eb6c1543975", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620298904, "uuid": "922f77e7-3195-447e-b691-e8e3881f5142", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620298904, "uuid": "e940a54f-38ee-4e74-8aed-2f1aa47691c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620298904, "uuid": "dabb928d-a149-48de-9898-d3a30ee3ddcb", "value": "4233c095_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bc384e-aeae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620334903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334903, "uuid": "2ef4a8a0-e7bf-4bc6-9b98-1b8ba74ed979", "comment": "Malware payload", "value": "a10f8f80327fb667300437c91d419427", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334903, "uuid": "b42baf42-7b5e-4fd3-904d-8d9fb33c7e1f", "comment": "Malware payload", "value": "a9e77951aa0a4c10fc92048c95324b90ad80d39edfbfb5a3a0864065eef169ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334903, "uuid": "e703a027-9236-4b91-a04d-ca1561717a4d", "comment": "Malware payload", "value": "7002427bebfd80b642f04a2bdaea468f72cd1402", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620334903, "uuid": "8795ad6a-7fc2-409d-848e-2f25eb381572", "comment": "Malware payload", "value": "35e67e1bbd8b6a92670b4ce7193d1951155fa8c5876fa19321ba4ed9df37fba187718d0b51070d301f0fafa2a13d1573", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334903, "uuid": "df4776da-54bc-4b74-8c38-2fcfb6d27c43", "value": "61E4239E3A826DBDC8C8B84738F1698A304988B59035D7F4E0DE57165CBDEB8127ED90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334903, "uuid": "23de13aa-1fff-4ae2-92d0-8db471abd5ee", "value": "12288:H5EHOwSEYG1sF6r8bS470PS3i2kWT/cBXyhmOLutQDLXFQjK1qzE7HDGSM:H5ETNPsFy895bTv5LlDbFQjK1YE7jlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620334903, "uuid": "ae4cbec0-3642-49b1-80d5-7015e7c6981d", "value": 657320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620334903, "uuid": "37b5bf03-7863-4872-9335-d041d85684f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620334903, "uuid": "3b924d74-1734-479b-b224-4621ceb8f804", "value": "a10f8f80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd176df-ae7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620313337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313337, "uuid": "569bd22a-0487-4306-b554-49f29deb68ca", "comment": "Malware payload", "value": "609b70f638075c02df3387390f4471ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313337, "uuid": "04410286-3c7e-4036-80d5-a395a0c75c6c", "comment": "Malware payload", "value": "aa41780f78033fd305eb90aa419bb11c2a931c0dd32ba4562dc25996cc67a959", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313337, "uuid": "6f3dc11e-3303-4859-90da-7e7a7a7f05fb", "comment": "Malware payload", "value": "9b989c383bf7ffeb445c532fe7dfe248d7670ace", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620313337, "uuid": "16c29af0-0462-4dda-8474-ec049336866e", "comment": "Malware payload", "value": "e2237bd081ba29dbcf95bd8524520ecc8cb534cc54103b9b9020f051ae22e3ce3b536ed5b862631e81737fdfdcf857aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313337, "uuid": "04321c54-eb15-4d19-b6e9-e0ce8209df62", "value": "9B931298133B13E5695E6B036BA8EA1633803F1EC0562D811059BFFC5E9EF75604FD8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313337, "uuid": "353ded00-8664-48ed-bd21-0d30981ff650", "value": "1536:1zh9IiqTaO41nlEqIb6BaglRhSZByHycBJL6DdAQVWz4L0TqT/JD4TkXU7KjIqoA:5h9DqTaOClrI+BNR+8HycW33gqbJc7W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620313337, "uuid": "08cf7888-852e-43de-bfb3-69d0928431dd", "value": 93682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620313337, "uuid": "5fd97f4c-bde1-453b-88ed-2a1615ea3a9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620313337, "uuid": "c0119b6c-2909-4ba9-895b-0445f2b06d70", "value": "609b70f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1bee41-ae73-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620309655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309655, "uuid": "85b86029-7500-4c12-a403-4c971c186eda", "comment": "Malware payload", "value": "ac86d5c7eb977be75e2c2747f6761fbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309655, "uuid": "d29f6b8e-2255-4a02-880b-9e2292e977a4", "comment": "Malware payload", "value": "aae1300f065f66d36cb287b0a56987577cea0f33b71671cb9752014dcbbda2da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309655, "uuid": "ffd0ac65-8034-4334-a4c9-d590c8bc366c", "comment": "Malware payload", "value": "203a58c045f5bc0ab19dbd34dcecff92c9a8d707", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620309655, "uuid": "cc72280a-2ac2-4780-a480-df2c864506ba", "comment": "Malware payload", "value": "01d6acf624e33a869ea96290913d580f1b9726675e56015455d1206b2157a4f199adcf2a0e88d118c4a1ed620b778e97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309655, "uuid": "887d39d6-f37e-4612-a367-71d743068855", "value": "0F9312B143F06AC2673501B07E36BE26ADF31B41D532B92F569068C795EB2E0C84EBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309655, "uuid": "d6d36d0f-a645-4d12-be4f-e0cc18f89aa9", "value": "1536:R3eZ2SzLiU8tPF7tR0tA2oVzTovZzD1VaCqAJ9+QN1AArcZH8yVCQrBSK9gat:MdzLiU8/7b0azToNXb7JX1b4d8yVtl2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620309655, "uuid": "fcc61cf7-5fab-411d-b01f-cd6fde68506a", "value": 92755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620309655, "uuid": "6c774518-9c51-4627-9e6d-7e565fdb17cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620309655, "uuid": "761676bc-4c97-4373-a0c6-2d62576e64bf", "value": "ac86d5c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053beee5-ae0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620266510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266510, "uuid": "c5d69448-0c37-41a5-91b7-6479f1691567", "comment": "Malware payload (Dridex)", "value": "e26626dca5f15c4fccfd0047623436ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266510, "uuid": "979ff92a-936c-49a7-b817-63d57b54a8fb", "comment": "Malware payload (Dridex)", "value": "ab1467ff23b06a43d9f2f1b4488f34f1f443b570ba7f6a87812511c346184b35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266510, "uuid": "384feee2-dd93-4653-8d79-1f3789a84000", "comment": "Malware payload (Dridex)", "value": "dc488e7656456b59e6bd7e8679803e5b8f4a9f28", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620266510, "uuid": "d2ec1571-e38a-450e-90c1-df1ddbfa90cc", "comment": "Malware payload (Dridex)", "value": "996544406ebd46bad9b43d9887281e215c882dfb88473315c04ee19decccf728db15b492d6f197d3837d2fb233e3ce7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266510, "uuid": "a86ae795-5fa6-4a0a-a959-efda3c38070d", "value": "57F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266510, "uuid": "ba51a47c-cf62-419f-b858-2dedda14a791", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266510, "uuid": "78bfeca0-d4ef-4b2a-9382-50530f161bb3", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620266510, "uuid": "110589c8-4dd4-42fe-acfa-634021c3dca0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620266510, "uuid": "57a06511-cddb-46f5-88de-e591be049875", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620266510, "uuid": "835dccfd-6a96-4b01-97ca-0bf43a0b4910", "value": "e26626dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6833508-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338587, "uuid": "41af9832-7dbd-4f10-92dd-9dd036007689", "comment": "Malware payload", "value": "924253d872c7f9a3daa43c0f49f52f6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338587, "uuid": "ad2452d6-ff20-40f7-9d42-ff26b1b3dbd1", "comment": "Malware payload", "value": "ab26c4ca78945a20ee5068eac0dbf669f5d7d52c0a75ba21a4816024e4695331", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338587, "uuid": "352660b3-9acc-4e6e-bdd3-a3ff9cc151cd", "comment": "Malware payload", "value": "cd7dee1d78c65f4b153eda74c2f7960ccb4da4c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338587, "uuid": "9f11d7fe-10be-41d8-8d19-7facc791fa6d", "comment": "Malware payload", "value": "eaf64c52fe0ff13d4963dceff5ce2a8eb969777ff2ea453426897f464a131cf0d54df208c354e08eaaad5331230ca037", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338587, "uuid": "479a45ff-7791-4a60-949d-9b805b5bbba0", "value": "06F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338587, "uuid": "9b31b7e7-12ef-4061-a309-4f7a58e15c8b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338587, "uuid": "bdf756b8-3a9b-4754-9a87-dd40c83b6ec3", "value": "3072:fB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:J4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338587, "uuid": "772fc00f-9ad7-44dc-b0dc-ba194ec4ff8b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338587, "uuid": "83e2cbc6-9899-4a3f-bd63-053daf7ee425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338587, "uuid": "db97d9d0-714f-4e30-88b2-360a321efcba", "value": "924253d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31da7c47-ae90-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620321989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321989, "uuid": "8e899a4b-32ae-4794-b59b-8df0ce7b0c3b", "comment": "Malware payload (IcedID)", "value": "075495872154e5e0d8ff59be0747f403", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321989, "uuid": "bc9e3e49-3cff-4d58-9d0b-0a7c008071e4", "comment": "Malware payload (IcedID)", "value": "ab6fd36ff46af27794e0de452273c270d6696bbd85fd5b4b2259650540af2af5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321989, "uuid": "a832c0f4-996a-4b80-9365-7cd924b90d11", "comment": "Malware payload (IcedID)", "value": "2b1f2880d69d9141ed42ea99ef9c147f83897221", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620321989, "uuid": "8aaf423c-969c-4f27-a233-c3ba4d8fac16", "comment": "Malware payload (IcedID)", "value": "002047757b5fc8c4e6f77c6bf7712b148104ac5781a1b65056eedaf7a7923dbf290f2fda9a3a4255ac5dc91a285b86db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321989, "uuid": "879e45fa-2046-4313-8ffb-44541204ed29", "value": "69347127C5ACE17DF64754F1343CEB89C544AE80AE118DD7A6C6D812AF139F123227EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321989, "uuid": "005ca23b-9363-419a-9766-789f7d2cb842", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321989, "uuid": "b8d5bd77-2db7-40cd-b7a8-bbdd9194a5a1", "value": "6144:6Ax88XNHffIYjh6QRdk7fodX67o8ck+EdB7vMqRt0:d88XNHffIY4TBoJqRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620321989, "uuid": "4fa8acd4-53ff-4007-8e51-dabc8c94e9a3", "value": 237144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620321989, "uuid": "bb8ab661-0d28-43db-a62e-c13f05dd4fda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620321989, "uuid": "cabb085a-2d58-464a-89ed-cf843772486c", "value": "ab6fd36ff46af27794e0de452273c270d6696bbd85fd5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad3a55f-aeb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338648, "uuid": "b89be031-14e6-4b47-aecd-67e97f38c378", "comment": "Malware payload", "value": "58181fed37ccc28157e83e03e0fdfc61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338648, "uuid": "9680d7d5-c983-4380-adb9-9aacd37a11ca", "comment": "Malware payload", "value": "aba118221bdeb5c6382e88e625a25c568e8d707b654cebb9214138a2badcd547", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338648, "uuid": "4525cfa4-0140-4265-b617-1dc426498512", "comment": "Malware payload", "value": "4b7dac9aa5d733f42b417bbdd3ff7491f0ae1a0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338648, "uuid": "828eb1d4-e94b-4665-8363-8237f8cc4fe1", "comment": "Malware payload", "value": "bb568b9bacbda9241a2cab7385ae29394d8db5232e037a65aff964e32c104c4702b998fdec4f7e3b3ea4f3c649550a11", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338648, "uuid": "257b1632-5e76-470f-9c0b-5072940a5435", "value": "C0F3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338648, "uuid": "ea9995d7-cc25-49e7-ba09-7ba0b720f6d9", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338648, "uuid": "ffadb315-f618-4c05-aec7-d97ed5988a15", "value": "3072:BjG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idiTj:oERMVPG6+Y63HoG1QawL40Prx6KkTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338648, "uuid": "ab91e6cb-700f-47f7-a57e-9772e53d010c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338648, "uuid": "a11403fb-c6f3-48e9-8108-21c2cf9341c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338648, "uuid": "fa3fc80a-23f5-4fb6-a484-0dcb8f1b70b0", "value": "58181fed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac68551-aeb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620338862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338862, "uuid": "391c2bd3-8b58-4e78-9c90-d442065c2458", "comment": "Malware payload", "value": "598367912d7a05f8b593ee22a01627ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338862, "uuid": "2163d465-fae2-475e-b318-022cc87fa6c3", "comment": "Malware payload", "value": "ababf3992ce3cec55643c7688b140ef2a40d821e0f898ccba5c1838ba8e20456", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338862, "uuid": "b6718c35-a24f-4deb-91a9-65fd860e2a7e", "comment": "Malware payload", "value": "fafb18d1e62ac05be85bf4a8c5907717b41b2115", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620338862, "uuid": "535a576a-ad3d-4495-88d1-56deee79af7d", "comment": "Malware payload", "value": "396a8162f4117f7d82d393dd70cf2ddd15f2ab28ea88dc2460585f21023112074106d2f61c2fe068094073acae15bd94", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338862, "uuid": "041fb984-d70f-4a5d-b6c7-0878f8a02f9c", "value": "E8F3C004D167E6D6C51A583222EA3B3F96314150D748F889DC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338862, "uuid": "d16a47e7-98f6-4ab0-8bdd-bec6f14778cb", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338862, "uuid": "510f2480-0c07-48d4-a977-b387ef466675", "value": "3072:CkG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idFa:sERMVPG6+Y63HoG1QawL40Prx6K/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620338862, "uuid": "d991c5c4-4f08-449d-820c-06c13801433a", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620338862, "uuid": "ce2260b0-15cf-4ddc-8030-0e5c29189054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620338862, "uuid": "cf9aaa86-96f2-4e7b-8cd6-45d9c4a6d26d", "value": "59836791_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f539bbe4-aea5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620331337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331337, "uuid": "1909abcb-6059-4b7c-b623-3fd1fbeb8229", "comment": "Malware payload (Dridex)", "value": "7c180d9a379df0046f1ab60c321d020a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331337, "uuid": "b7e21139-d939-494f-988c-4bf7826abe40", "comment": "Malware payload (Dridex)", "value": "abcf157b396c667583128663da9cdae17ba841bfc24301563c4bdd49a80570f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331337, "uuid": "55c15b58-5149-4c98-8498-bab4a2bfd991", "comment": "Malware payload (Dridex)", "value": "66597ac3d8c54ba9f435b6f3f3fe0a678b2927d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620331337, "uuid": "72c672b9-1432-4ce4-ad9a-092e4f52e5fe", "comment": "Malware payload (Dridex)", "value": "7121b59f703a586a5be7a90e4ae1c2f7a3734b3ec7fbed4b47809769fe394a09b34c33f07ac02746d5bba5dfd85beecb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331337, "uuid": "0a03739e-cad8-43e7-bde9-adc64b627156", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331337, "uuid": "34f648f0-7c58-42a3-91b2-c777a0526d46", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331337, "uuid": "5746e160-8f80-4cd3-920f-a28146e62b5e", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620331337, "uuid": "6775d10d-c532-4e3c-a78e-d71ecfbc2cd4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620331337, "uuid": "2e7b4102-c644-4043-9e53-4410c676eff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620331337, "uuid": "5f733e62-154b-49de-a647-3cbafa54f42d", "value": "7c180d9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b72900-ae25-11eb-abe1-42010a9c0039", "comment": "Malware payload (Phorpiex)", "timestamp": 1620276122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276122, "uuid": "1ede1cad-b7a1-4baf-8970-738234b68108", "comment": "Malware payload (Phorpiex)", "value": "ee0a1ec859b753abc30847157d81f37c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276122, "uuid": "296a2632-f202-4b69-81d7-b0fc3946abe4", "comment": "Malware payload (Phorpiex)", "value": "abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276122, "uuid": "3b513eba-8072-49b9-931b-4c0bdffbc74b", "comment": "Malware payload (Phorpiex)", "value": "2fd868d94c6dc063ca49c767c873505fbc87dcd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620276122, "uuid": "a847b643-80f6-436a-8cca-00e25d046796", "comment": "Malware payload (Phorpiex)", "value": "6dacb2216f753f93342ad995dd25bd877cda5cee3f768c5a8578686eee7387b614ea68993adc1c8446f7efffcb292738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276122, "uuid": "e1bdd530-73fa-4017-ba7d-7ae97af7dbd4", "value": "4EA32922E551C53AF46600B7DBFA69FB5A28AD31130430C3F3D46DDA6A658E1BD3026F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276122, "uuid": "751749e7-d06a-40b9-b01e-fecb070a24dd", "value": "23ab644c44593e426ea915e5618d637d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276122, "uuid": "e4668392-d72f-4c93-a4a7-79d09836eff1", "value": "3072:UlmICQuNwVOv/8I6WruEPJZDUXA2M1CUci6sUJW51TrFS83Fo:WmICRmgMtWruEhZDCA2M1CUci6sUJW5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620276122, "uuid": "aa54c0bf-6bed-481a-9b69-c700e4120255", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620276122, "uuid": "c2bc8152-9867-4e7c-a4e8-644d8b478e4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620276122, "uuid": "928ac1ae-2508-4c39-8d78-bf0f703f87fe", "value": "t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0a89d0-ae2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620278201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278201, "uuid": "e453278d-32c7-4a3d-9d6c-d6d60bce21d0", "comment": "Malware payload (AgentTesla)", "value": "88c83af974071b0ceddd87f41a5a3c2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278201, "uuid": "040351dd-e317-4077-9789-eef4377654ce", "comment": "Malware payload (AgentTesla)", "value": "ac565d2abad42c40e8f622677fd68246d28aeb39a3c1c2c24caa2853b7f7b5af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278201, "uuid": "98b5ee51-cc4f-49ea-8513-17dc351c86e7", "comment": "Malware payload (AgentTesla)", "value": "856716fa15067d6e570dc33c31c7657295f4dd42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620278201, "uuid": "ba9c381f-b44f-4e24-b37c-7d736759df25", "comment": "Malware payload (AgentTesla)", "value": "166e721ac293ff2e9675b10edb1a9dbaeac4daf48f7acca9c71fcd84f7db6cbdd611925389ad3612ac24f923248531eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278201, "uuid": "454a9265-70b2-45b9-96ea-22e0df5c15de", "value": "7BA4235181BEAD235A64E6B164D9C8525EDF3EC951C0C6036C11B38CCD3EA02BD9FDBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278201, "uuid": "b68764d2-3f09-45ad-ae02-a302aea10968", "value": "6144:LCMPJ7bg9xlzvO6FOwkr8yDJVQgGgq3xS6L25ms+M6EBpLsQVlU0Hdx3WVbWcs3M:LCAVC3CB/QgcSz6kVm0DUU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620278201, "uuid": "1c6518da-64ca-4d3a-adb7-1ddd3de3be5c", "value": 450216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620278201, "uuid": "c3495060-a848-4193-9124-01efea3033ed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620278201, "uuid": "128246dc-317d-4f8a-8cec-5a3ee961670a", "value": "DHL_document11022020680908911.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb98355-ae41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620288348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288348, "uuid": "3ac7354d-80b5-4fb2-bc15-fe396bf4cd11", "comment": "Malware payload (Dridex)", "value": "3d95a36dea8f9e5c89bd330360f05313", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288348, "uuid": "4bd1e24f-1885-4638-b866-2017a49487ee", "comment": "Malware payload (Dridex)", "value": "ac59ee1714cad86225b975d6cde84826c4295e5d268f80f9ea7d38f1564392b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288348, "uuid": "23b5b1de-5548-4682-aa00-09c28c265e89", "comment": "Malware payload (Dridex)", "value": "9143a00863962286a1f7dc4ff8fb2d17d4b99ab9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620288348, "uuid": "bc397eaa-54c8-4668-94a9-4cac81abda0e", "comment": "Malware payload (Dridex)", "value": "012b7b10b9720167e8581dab1985389cbaaba6bc72bf2ca3f54df3116be4292e08191e0a29b44488265da5ee8ca4c8b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288348, "uuid": "b1968a18-afd8-4d63-9d3a-f3477618b405", "value": "B5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288348, "uuid": "9565898a-3309-4ab2-9a8f-36d3524406a2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620288348, "uuid": "e062f241-a49a-4135-a920-bc3df4063eaa", "value": "3072:CiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:BeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620288348, "uuid": "65cb8cd2-61da-40ff-80cb-a8943890c8fb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type",