{ "Event": { "published": true, "date": "2021-04-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-28", "timestamp": 1619654581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9294ca08-0f71-4247-ba84-9eee26f565ea", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f9d044-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624922, "uuid": "8f0917e9-2b8e-462c-b692-43def8f17b9c", "comment": "Malware payload", "value": "50d73c2cb5ca2d7d0b53d9a5a0d67206", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624922, "uuid": "7d061e44-4398-4047-9463-5c8a951325d8", "comment": "Malware payload", "value": "0014a4689458ed7b7562320bd7cdb14416a6cf27d777d1ec76774d89bb1852ee", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624922, "uuid": "5ef39a47-2985-4bb3-b138-6abb083e9a3f", "comment": "Malware payload", "value": "ea32fd0266b254b56575bb531fc15e9f27db6fa0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624922, "uuid": "b0e11bb5-a797-4534-bc7c-d204b8391ef4", "comment": "Malware payload", "value": "c0b5f20061460b561fb089d7b35e73f17d6679ebfd156ad212effb61f9f1b19eae5dc8ed09b40d5f8feef3113f4cfa9d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624922, "uuid": "ea242e9f-28fc-4520-b7c7-827accee4204", "value": "C1830250537ACB19B5CECE2D8CD319CB7E9BF9B42A0E5CF1A12900B5B7658051B14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624922, "uuid": "185c43bf-4163-4284-b6aa-ecab6101430e", "value": "1536:qDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdt/8oZePFOLVEr0xkvUH8+:qDAysJADlV378P3RPVJLdt/8oZeUM0ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624922, "uuid": "3bc15073-201c-49c9-a502-373ec34a2e36", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624922, "uuid": "46681106-05b2-4189-8e37-b4b8310915b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624922, "uuid": "d5ba3f5b-a905-4a39-a96c-955c89974436", "value": "statistic-1096089468.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bc28c1-a854-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619636732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636732, "uuid": "34de8bb7-eb2e-41ed-a516-576fb355fc7b", "comment": "Malware payload (Dridex)", "value": "5c8b5ef91d9afaf9843bb75e91cf6c03", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636732, "uuid": "c1de8715-36b3-4514-9006-988a23444a5d", "comment": "Malware payload (Dridex)", "value": "0019047a4e2ebd2136648100541dd02e081a9740a480a0b202f0b42d2136136c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636732, "uuid": "5f7d9605-5d86-4fdd-b0b1-016d8c6fd8ce", "comment": "Malware payload (Dridex)", "value": "255226797adbc786db82c897f77eb568cf1db355", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636732, "uuid": "dab9842d-0514-44a4-99ef-33f8b68a01a4", "comment": "Malware payload (Dridex)", "value": "4bceafa7c4c76f6d641fa87efb561916eb74024c92c63ad71900a627ee21fa9c87ef95eb0f6bcf0236b785184f392ced", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636732, "uuid": "f1fc8541-eb2d-4219-9439-c468c3bd1e3a", "value": "FFF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636732, "uuid": "11c9ac2c-cd13-47fe-839a-f35c4eb9befe", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636732, "uuid": "8a90786f-d218-4976-a081-a9f4bbac2cf8", "value": "3072:6WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:642IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619636732, "uuid": "dbc9b4c8-efd7-4f65-8e3e-65811ef757a2", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619636732, "uuid": "5ffd4577-8c55-433b-9446-e4d2a770f8b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636732, "uuid": "7bab57cd-c40f-465a-ac80-b42f1f4960f0", "value": "5c8b5ef9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42df958d-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619639118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639118, "uuid": "a481cc4a-f121-4ad4-a312-5249b0824ba2", "comment": "Malware payload (Quakbot)", "value": "c465bb90de4afed7178c630d5420cada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639118, "uuid": "6b203154-abd0-47eb-9051-0443c1b7971e", "comment": "Malware payload (Quakbot)", "value": "003598c511feba9463357565313dae15dd9dd38bc266f445bce1f735d7f8d904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639118, "uuid": "de273809-73d2-451b-96c2-e37ee6b9c3d6", "comment": "Malware payload (Quakbot)", "value": "fa0128f85bd80bfd4b601d39824b3a5d800b9b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639118, "uuid": "43285ad7-4272-43d7-b8cd-40c717109958", "comment": "Malware payload (Quakbot)", "value": "dddbb42b281bb4ae183a5e598228ea5747d8c793745033abed75dc20318db631cd8696b09072afba1f8aa860fa49e3c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639118, "uuid": "7c1a6e11-37a3-44d1-98ef-d749ca95d8c2", "value": "C4948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639118, "uuid": "2b3850d6-1e44-4315-a2ff-5f41fbd0ae4c", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639118, "uuid": "159b73ca-06ca-444e-b825-327ef89bdb82", "value": "6144:OWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAm9:OWrsTwr03pdf8vhhOKJETlBy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639118, "uuid": "599e8ab1-fb1f-4a9e-9353-2bfe33d0c83a", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639118, "uuid": "b301b655-d2a0-4e37-b9ab-6c2c9c3162fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639118, "uuid": "e4f73d01-4d8b-4f75-8afc-e1083ac07b31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448fc295-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619639121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639121, "uuid": "cfd86bca-7516-42d3-a518-ab5896518e04", "comment": "Malware payload (Quakbot)", "value": "e6d44f98b71b280c349771c44fc10bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639121, "uuid": "64434691-11a2-4f51-baf4-4fb9822ab537", "comment": "Malware payload (Quakbot)", "value": "0037d2b06cdd5091f86d7f3fbfb8aaaad38422c9dbb9a11ab21d38e731546c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639121, "uuid": "aef8b8cb-f66c-4e15-9647-c24db6e80666", "comment": "Malware payload (Quakbot)", "value": "8493dd294e6d8afdf72f0dac23f5c04f13bf2d4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639121, "uuid": "930a99d1-9a32-4f40-8e8d-226ca95f7c3c", "comment": "Malware payload (Quakbot)", "value": "4deec77c9ce6826d5803e15f49b3c68c3835e7b881b4954ef8499a12e79e4f007899f19dc43c5d4130b8dad5a089134b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639121, "uuid": "886b62e3-cd26-45a2-96f0-076daadb7459", "value": "64948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639121, "uuid": "281f62dd-b247-4108-b5f2-a750593994d9", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639121, "uuid": "25fb3bc3-6093-4688-b736-1a6c00236cc9", "value": "6144:GWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAm6:GWrsTwr03pdf8vhhOKJETlBy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639121, "uuid": "4832b2ca-37bf-49f8-b6eb-39f9aa5ab898", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639121, "uuid": "56e7f6f3-0a15-4d6f-a4c8-a878b83f8761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639121, "uuid": "39260827-7923-4a63-b668-5f26864e77b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5566851-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625969, "uuid": "bbfe4241-9d72-4179-8952-51d52782e563", "comment": "Malware payload", "value": "bf1fcff29644e7a621a3fcaafd8ee70e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625969, "uuid": "8725aa40-3d9b-487a-9ad9-2b9287dc8274", "comment": "Malware payload", "value": "005ec79badf57e8b4ad8fccde77730ede3fa447c40ff4020b2e877015f7c3500", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625969, "uuid": "1e3a1346-96b8-4a79-bda5-559404d5314e", "comment": "Malware payload", "value": "81071a1cda904eaf68340d30e51765156ff84c78", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625969, "uuid": "31733af5-8038-41c5-98f2-c13d6eced463", "comment": "Malware payload", "value": "a0e855d60406eb78afd478624618129897e713d86fb3adf6d7a0ab6878c7d65a81fef28c7eda9b2139c120d2ba956288", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625969, "uuid": "88ed3824-ae82-4be1-ad67-9e89c8450c4c", "value": "5083021563BAC998F4CD9E2D4CE30D8F3F42A9782C1ED5B5622D0199E326CA64F2453B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625969, "uuid": "b61d6fd9-7227-4c5b-9eb0-d22280a80c23", "value": "1536:WDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdaPqXT/WkO0B19M2Cl:WDAysJADlV378P3RPVJLdaqXjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625969, "uuid": "138c17cc-d9df-46f6-90d6-da8169086974", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625969, "uuid": "5a668b22-d4d2-48d4-bd31-323f6114473e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625969, "uuid": "7d26c200-08fd-418f-a398-5c1b487a7400", "value": "statistic-1879283747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f350c58-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622925, "uuid": "fc21bfbc-4d75-46ab-939a-93f983916bbd", "comment": "Malware payload", "value": "d08434bc38a22f90f110fa69987820d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622925, "uuid": "f8c077a9-bb1f-4ec2-b511-623c15077cf1", "comment": "Malware payload", "value": "006355662a89cd8b886d42945a45732a2d6ca2c40e3a92db71cbbe99e1d6848c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622925, "uuid": "9cb7748b-1c39-4988-8d89-dfe17974a80a", "comment": "Malware payload", "value": "c016384944aae341922fb07aec0b6964a0cda032", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622925, "uuid": "7dcceb3d-ef35-4364-ad80-d9d8a599e8d4", "comment": "Malware payload", "value": "c3ee1dda4bc71330b00986b2a533fda26dfe9b1c8071bf57ed4731c0e07e998503a3879d071faef8e393b9dcf47aa5e4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622925, "uuid": "fe7fe07e-5be8-4c14-a248-7684a6a19410", "value": "3583028DA53DCADFB1AD2F09A3DDC53FB61EED622004248DD8C466A65D49AD30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622925, "uuid": "adaa710c-6543-4d93-979e-dca826188d4a", "value": "1536:MG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5de6n6475e0NEnP60:MGEhrHJoEsBMG7qzkZ4q/NEnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622925, "uuid": "356bf36f-8c2c-4493-b433-23fb7c137e65", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622925, "uuid": "a5ba5606-80cd-4ad5-866f-47e94d6eb643", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622925, "uuid": "13962d6b-fb75-4a70-82a0-9cd523f1b86d", "value": "diagram-1744296860.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f1e6fc-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622152, "uuid": "2d4d5b4f-4028-45c4-8f16-67fac8a941b7", "comment": "Malware payload", "value": "e6368d8a009134d8d938d38addafb708", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622152, "uuid": "8b05cfd7-9cae-4d2d-8da6-5c68ea08df6b", "comment": "Malware payload", "value": "006524cd6ef828fe34c2fb6a591222d4b4be7f953576c3abc696c543a328fc72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622152, "uuid": "0f2e3895-90fc-46e4-8c37-18f97d5d7da2", "comment": "Malware payload", "value": "bc11f27fd4caf39120386d523f60dae4f11afe57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622152, "uuid": "4c84732f-5998-42b5-a3ed-5f6fe3205f0a", "comment": "Malware payload", "value": "3a55b9afd8fe23e458b91b88015e18ac1056d1f8ee694486c926bdcda1f003057d8e23038c82ff8199fd0e5d9d81e5d5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622152, "uuid": "400b31b0-ff8e-418e-96d3-6e066704e62d", "value": "8F830298263DD3CFB97E2D0A66E9C83F790DE8781044349DD4C07BAA9C4ABE74D47560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622152, "uuid": "001aec1d-4d94-4023-a22d-9ce202df8700", "value": "1536:wG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttT6RuoKryI8NlRu+dm:wGEhrHJoEsBMG7qzkYNI8Nl4+dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622152, "uuid": "e37c7a64-5eb6-49be-8833-45f3a23316d9", "value": 86094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622152, "uuid": "9944a351-e858-4818-a59e-1493a3d76f94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622152, "uuid": "6b2a2538-8c3b-4d9d-a19a-d955926f8e30", "value": "diagram-117226838.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d5d904-a83f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627418, "uuid": "943bd79e-e4f6-4b87-9316-d5eb7e0a2857", "comment": "Malware payload", "value": "afd5dc4ce3d90f8ce85afe6c4db3c792", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627418, "uuid": "83f25470-5bca-4ef7-9e4c-0b276e88052f", "comment": "Malware payload", "value": "006c9aaa01403895f5f08a7fada46cc735bce0145a9d334fe7e78274647b2e6f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627418, "uuid": "df9613f3-306f-4dd7-a7ee-1bdc5a70736c", "comment": "Malware payload", "value": "240676617405710166861d56142842baaef171ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627418, "uuid": "d52457cf-b8a4-4ee6-888c-b182735e0065", "comment": "Malware payload", "value": "4aecd015a0b6eb49e3d693fc4bcc4bc357f93aea6b100f78a96e5b00c9fff12c67c63fcf96449735e309f4db7fa53d3c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627418, "uuid": "aa49bb77-39ac-4034-a913-d5e0057fd151", "value": "BF83021163B9C998F48D9E295CE30DCF7F42AAB42C1ED9F1622D0199E327C964F2453B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627418, "uuid": "4e78448f-c214-4c4d-931f-4e5179153162", "value": "1536:keDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2e3:nDAysJADlV378P3RPVJLdCqXjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627418, "uuid": "49134b09-0e3a-45d7-8153-ce9218aee47c", "value": 86108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627418, "uuid": "da0d3dcf-22d8-41f8-917e-ec07ad2238f0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627418, "uuid": "3d8ff068-5e5f-4a58-bc1c-9f5efe626a52", "value": "statistic-92694657.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2862e20f-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626618, "uuid": "191d507c-f0d2-45a5-b8a5-0b78cbb16aee", "comment": "Malware payload", "value": "cbee881841e399f9c99c33702512cff4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626618, "uuid": "d9a2da23-fe75-4d83-b7c9-1c9dd1d6c319", "comment": "Malware payload", "value": "007acbe43e170644da0e0bde4f0b2a6ff0da622c283266877817fb8edf135dd7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626618, "uuid": "2f648254-de43-4a49-a955-4cb1f4ae82d2", "comment": "Malware payload", "value": "fd2f674e8aa476780e6b96d1d82ed7334d9d4384", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626618, "uuid": "1301d95b-d090-4d97-a6ce-180a8cb0e5c4", "comment": "Malware payload", "value": "235a6d2bbd4b053c8cf07c6056b5192b2a7cd1f9a41222cc08f6d8a061b785ed109a472091446862426c61c08c0ba1ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626618, "uuid": "01ec7499-d053-4833-8a68-c7462f35adf8", "value": "E783021403FA9559F48E9E39ACE20ECF3F4AFAF43D1A58E1966E046563298510B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626618, "uuid": "164e81f1-94f0-49c3-be19-778bf304490e", "value": "1536:nDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wBUsq:nDAysJADlV378P3RPVJLd+eh8wBVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626618, "uuid": "4edc8b4b-b54e-4619-98e6-c52951650bcd", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626618, "uuid": "a814347b-a8ef-4f3e-a95b-3220a68310d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626618, "uuid": "d5df3061-5fda-4527-b1de-444d82671b48", "value": "statistic-381697085.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9240c4e-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624767, "uuid": "0b36260a-4e04-4ccf-a1f6-264db3d59061", "comment": "Malware payload", "value": "d5ac651632404c02eae3a90c5515ef47", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624767, "uuid": "a643a0ce-6039-4c00-8d27-8f503e6faac5", "comment": "Malware payload", "value": "008c5dcabdaed29e40d21eba766e82fd90dcfae1392151acb4c950b0cbd3158e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624767, "uuid": "3d61dfe6-6fa6-4ba6-a342-f04f6773c393", "comment": "Malware payload", "value": "7350f6896f34caf6f806b1e8fab8432cf16fca97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624767, "uuid": "662b07a1-87c1-4534-85bc-e5dfba2c2f5c", "comment": "Malware payload", "value": "b97a66c2fc53bc4efed024cf106cef32b04b123406f7f3342960d873020f1154292493d1525d9aef047dcce5018020c4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624767, "uuid": "301174ff-e235-4709-92da-82b8faa58c53", "value": "298302D9203DC5DF717C6B0AB6AC893EBD0D6CB5210064AED4D8266EAC4DAFB9C53030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624767, "uuid": "4234ff5d-ee11-4cdb-82bd-108b8074a7ad", "value": "1536:oG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttkI5EzJKE9LfFSp7msR:oGEhrHJoEsBMG7qzkWI5AB5gpSsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624767, "uuid": "840071ee-ec8c-444f-9861-aa0bf2a44089", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624767, "uuid": "f3889117-9ec2-486d-aa6e-b37eb4e1bfbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624767, "uuid": "e4e2388e-6bbb-4e82-8cdf-b59d4b2ec545", "value": "diagram-993959417.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ba36f1-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622418, "uuid": "f73cd398-2bf1-4af9-8a60-c5d152e4af0a", "comment": "Malware payload", "value": "1f8738825f09b46638e82df4b5dba4b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622418, "uuid": "fdb5b47f-73e6-4809-9cac-cf582f87ff4e", "comment": "Malware payload", "value": "008efa2e01c78baafbd16e68ce5bc5564f5768f0b0b73a646174251f5cabf2c3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622418, "uuid": "8efa4b3d-bf9b-4e09-9edd-1a5f04b8703d", "comment": "Malware payload", "value": "2c92de38b4153cecbe1844be330bdad90ba88c76", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622418, "uuid": "d7def644-06c4-48d4-9476-53fd74218183", "comment": "Malware payload", "value": "dbaef01e225d97d648662706001b86eb4a13af3f0bc55b0397a48282a672f902717ea2835f49955c8d1eb7304f115f2e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622418, "uuid": "b78958c6-a853-455e-b2df-45c29a50cd68", "value": "DB8302D9203DC5DF716C6B0AB5AC893EBD4D6CB5210064AED4D8266EAD4DAFB9C93030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622418, "uuid": "bb9cedec-8a7a-4798-8ef1-7d03bf28b55d", "value": "1536:YG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttcI5EzJKE9LfFSp7mUl:YGEhrHJoEsBMG7qzkeI5AB5gpSUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622418, "uuid": "acc11cb3-0d52-4080-b692-bc4eebcb6b5b", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622418, "uuid": "84bbc933-4d27-40fa-884c-7649f72646e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622418, "uuid": "a2756e24-3cd3-486b-a501-9825a1e293ac", "value": "diagram-1369486740.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862d4412-a7ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619593275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593275, "uuid": "f8e558a8-47c6-40ae-8f7d-e0249b980e0e", "comment": "Malware payload (Dridex)", "value": "cd06fdb7e199a2668ceb910e3044563e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593275, "uuid": "ffbc31c6-2f93-4398-b794-fe7278d880b5", "comment": "Malware payload (Dridex)", "value": "008f4c6f29e33c3cf20170db83f6816224c55832a38b95440c89758d6211b64e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593275, "uuid": "e242171c-8d5e-4f68-b9c9-02ccbc22b4f2", "comment": "Malware payload (Dridex)", "value": "b91533935bc574035185711ad3b26592a97ecbd4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593275, "uuid": "b7c427b2-e919-4222-9ec1-a73fab1840e1", "comment": "Malware payload (Dridex)", "value": "839985a9a309cf97c14186e1f6fe9971cfe23526eab8480dc607cb5aa1d547886675f72cc08c07dd1c0a59c81a310484", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593275, "uuid": "de8daba8-ef89-4b8d-a5f7-fe44e07e48d4", "value": "A1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593275, "uuid": "bf51a6aa-23d9-40d4-a08f-ec0adfd98eb4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593275, "uuid": "a40c30f7-31b5-45b5-82c5-358b7f3ad4d1", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619593275, "uuid": "d7fcf1ff-af74-4928-a218-bf4c36e6aa8f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619593275, "uuid": "d575ef68-2419-4528-b292-2362c3b2247a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593275, "uuid": "e270b4a0-604a-4f4e-b1bb-e36536ab9e51", "value": "cd06fdb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287e31cf-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645087, "uuid": "4fe1bf4f-08b8-49be-ab49-42cfde094be6", "comment": "Malware payload (Dridex)", "value": "d151db2ce6cd1abad2cdc4006dd69694", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645087, "uuid": "8fdc7935-0513-4ecd-8641-1b5ec3f9d421", "comment": "Malware payload (Dridex)", "value": "009dd8f0a3ef70ec4189dc966146f989ff557dbaf82994161de1466bf6b2bd1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645087, "uuid": "920220ce-23b1-46e9-a6f3-634631842e5a", "comment": "Malware payload (Dridex)", "value": "921832530caab0f8e7142dad4caf14b83047c73f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645087, "uuid": "803f27fe-ff31-42b8-a734-e4bd5f66cc7e", "comment": "Malware payload (Dridex)", "value": "0bcec1075d8bb7771124144943925abb6b69d22ea1064bd80a700f7fdbbb9c87e90607d9287cfb1136ef811a7bbd8f29", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645087, "uuid": "b9b3011c-c598-4302-a064-2ee161064600", "value": "80F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A94DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645087, "uuid": "8b6197e5-f058-417e-8e23-31fcd667a8c7", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645087, "uuid": "857e415d-4072-4bb4-aad9-5ea90966975e", "value": "3072:+1Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2HGkFY:AnS62Fl+pkeJl3CvRStrFl+EYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645087, "uuid": "47c3c9c8-0308-42b4-b23d-1db22ea407f8", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645087, "uuid": "96578261-f796-4a89-b112-13eda5f6c04a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645087, "uuid": "52a75971-2c32-41e4-be07-9a799d095494", "value": "d151db2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbecc820-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645388, "uuid": "5b16208d-9acf-498d-8eb3-3eaa67fe07dd", "comment": "Malware payload (Dridex)", "value": "77d6e114fe92aa2cd2706bad9e536880", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645388, "uuid": "06a8d15f-4359-48c5-9663-894a00ba39b8", "comment": "Malware payload (Dridex)", "value": "00a0078ddf982fd71fa988d86de1349fa96506a0c5dcb520cbf9d90b7563966e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645388, "uuid": "44ddc6d4-43a2-4a97-ba39-b594aa14c8bb", "comment": "Malware payload (Dridex)", "value": "2a2d8dbb8ea5046eacc66a3f81804df08c937aa4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645388, "uuid": "446a0c24-6dde-4c3d-bd5f-4976b868b768", "comment": "Malware payload (Dridex)", "value": "4ab71b701a6d8e3a9167f1891ba616729ebaf68ee3b8c0998fc06d982ac0bb7fbbb7446dddd8e6a51df8c6220f4abe19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645388, "uuid": "63833e50-080f-498f-830b-d7ed7ca449a7", "value": "4FF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645388, "uuid": "c0fe83b6-fa7c-40e9-a8c3-b637845c80ed", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645388, "uuid": "7c831750-0c64-4bb1-b5d5-4ed6e5c99095", "value": "3072:A58CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYbZwd:JnClX8WZ7/HrRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645388, "uuid": "19552f7a-47eb-4884-8884-41dd4caf9cd0", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645388, "uuid": "ad204939-21bb-4c71-be27-58ed90d31653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645388, "uuid": "1be96ecc-dc3b-428d-b8f1-78e777dc69ce", "value": "77d6e114_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc379f26-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621337, "uuid": "9b03a30c-057c-4663-a51a-efd274c42f1a", "comment": "Malware payload", "value": "c6fd9ca53887f85660ed26c95479fdda", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621337, "uuid": "318ad4ac-03dd-4749-b19c-7a2fad71ecdd", "comment": "Malware payload", "value": "00a5bcb9d0cb41d4244868c001f9d3b1ff7b5406543e350bd6fab93333223863", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621337, "uuid": "1b2a7519-92a3-4dfe-b716-f88c4dc08a7a", "comment": "Malware payload", "value": "7ce5aa9df4ee11d3b3646e6e85e1c8a0f57da252", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621337, "uuid": "fb12161a-a7c8-4bc5-9747-a7699fd7737c", "comment": "Malware payload", "value": "d2b968a70552056e9720e0c77af86d57ec051ed4ae8c923b6efcb4c7d63863617ad44af96469e10ff5b7424af6f7cfb8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621337, "uuid": "72f410b5-0469-40f7-b47e-bea0993cfe84", "value": "5E83121413B94A5EB8CE8E296CE31E4F2B9AB8F4192B55D1794D04E1F2374660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621337, "uuid": "4ad1e4d7-8441-4d28-bcf0-cd4ade254f24", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdPIkGV8BAY0wN:CDAysJADlV378P3RPVJLdi8BXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621337, "uuid": "ef1d881b-3c71-41dd-8c9f-3b3cb2954bfe", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621337, "uuid": "302d25d6-588d-4e65-a15a-810687b10b7b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621337, "uuid": "d0575d58-3398-4ca5-8d76-d98a7ae319da", "value": "catalog-577247760.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29111baa-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620177, "uuid": "e078fc3d-fa17-42a8-9eae-dc5522df9fbf", "comment": "Malware payload", "value": "c41b9af6f392c4e247ff1b22eadaa7af", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620177, "uuid": "34031220-1259-4d80-8424-7187bd76d8f9", "comment": "Malware payload", "value": "00b78c92df89bca0b66b37ffb6004dae620288a269113cff25c52cbeb7061f0c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620177, "uuid": "40825179-12f0-4cf9-8917-718fe1cd8052", "comment": "Malware payload", "value": "472cae04122d0a7984a80d83d629908cbde89fdc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620177, "uuid": "13b7265e-1e85-4604-91ff-dcc7a684c011", "comment": "Malware payload", "value": "f75b5ec48fa0da343d1e6fb44b1570fa2d0b6c89b6cbbe5cb6d65c52ba9b67f975de21636c91218aabdd81afba43b746", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620177, "uuid": "c82a0d04-7ff3-426a-a8f4-35ee7b88ad54", "value": "5283021013B54E4CB9CE9F295CE20ACF2FA7F9B8160D69F575290894E722C474B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620177, "uuid": "4c761578-7c32-43fd-a471-f6fce08440cf", "value": "1536:VDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJg0:VDAysJADlV378P3RPVJLdlDpH+jAJg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620177, "uuid": "6d8b1ea4-6db1-4b10-80eb-98e61cfaf560", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620177, "uuid": "ef74b980-daa2-48e8-b662-db103f29cf6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620177, "uuid": "14b203f4-9c4c-4718-b4c5-dce467143670", "value": "catalog-1816627665.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2108fa-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621254, "uuid": "f8459b06-5e53-4d9e-b081-c219d383a6e9", "comment": "Malware payload", "value": "e0dfde931422981b1f2bda96767bd8d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621254, "uuid": "b09043c1-8d92-4b76-b593-450130a38f50", "comment": "Malware payload", "value": "00c6ce45d85ee5c3dd7e3b2d6914392b15ff0c93d542d4460ce24a7839482c65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621254, "uuid": "f3f96315-f975-47e8-8bac-836624fb0ff5", "comment": "Malware payload", "value": "1c1018a2a3de830ef3e2f0d181d50a4eec89dbf3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621254, "uuid": "ea7f3a91-a039-4f61-b979-8a2ff086b8cc", "comment": "Malware payload", "value": "c946999b86921fb4b88ddbbf1d77c65065e97c18e4f2e6da81ed2ca647ea1ac8ab07248993dcd41791195f40ca687fe1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621254, "uuid": "f24a3aa6-0beb-4a6b-892d-b8c6a10b6da3", "value": "3A83027103AE8B5DB4CE4A3958E21ECF2F46F8B42D195893551604E4E32BC669F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621254, "uuid": "7e593734-82bf-4deb-b374-ece24d35b3b0", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd1DsMrbsTmHvVRn2:PDAysJADlV378P3RPVJLd1DsMU0dR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621254, "uuid": "4e880373-aa23-4d66-b6be-650791d15330", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621254, "uuid": "d992df8e-e4cc-4d45-a85d-8f66d57882ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621254, "uuid": "5892d617-dab6-47fa-811c-51fdefcf91d6", "value": "catalog-502384891.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a72dfed-a86b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646379, "uuid": "e9cc1b40-d81d-48de-949f-3278486f0b08", "comment": "Malware payload (Dridex)", "value": "62eee163caffc66a2a9415367c2f56c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646379, "uuid": "fc5b1f03-c036-4b65-a7cb-c7630c5743cb", "comment": "Malware payload (Dridex)", "value": "00c7d37bf6a54e1d522ba6f8e3752a286e2ab6ec88e1b1a3fa937ea768dea0ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646379, "uuid": "678ee5af-39c7-4897-a576-017be0fbd45f", "comment": "Malware payload (Dridex)", "value": "86974abb5baf329509685249ceeeef1bcc3a5900", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646379, "uuid": "a689662d-9716-4bf3-940e-dce4744a12e5", "comment": "Malware payload (Dridex)", "value": "61bb51582df03e2625ea7290af0ec31ab8679937f7b744ae30cdaf522b533f74c3899289b237830328419a58b457d2be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646379, "uuid": "fc7926c5-4bf4-46ed-82f5-243256f5c64f", "value": "39F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646379, "uuid": "c543f717-2469-4a81-8b40-9f154bf55ede", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646379, "uuid": "4b9bf3ba-d756-496f-b153-c315183ecdc6", "value": "3072:nnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:qy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646379, "uuid": "dd27a757-136c-4abd-9398-f313617d3508", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646379, "uuid": "1981e20f-5718-4c36-b4b9-f758cf0b7bcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646379, "uuid": "f357454c-4b46-41d9-9e22-eb1ecf1683ce", "value": "62eee163_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb0d1bb-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619619, "uuid": "10849b63-94d2-4605-8cc5-7b7a8198833f", "comment": "Malware payload", "value": "5b2d86731e7b9b64dcd4d40062df5e92", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619619, "uuid": "102c101a-919e-402a-9434-62a0848bd53c", "comment": "Malware payload", "value": "00e3aec95b656e63540a0f1268dd9b8385466a727c0eb393ff4a9460d0528ae6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619619, "uuid": "94c0641f-1d6d-4dfa-b21e-979977c99400", "comment": "Malware payload", "value": "e05240c8e4d1ff4d47da52aadd18ab422c6547c1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619619, "uuid": "2ecd2bfd-8ead-4677-8989-0ee940542f00", "comment": "Malware payload", "value": "ddecda0d1373757c383f3351ec9612f6cbc99d280b2cf5243c973597e919bc8f075900d3f314e574759af0fd112082a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619619, "uuid": "18d18553-a900-47dd-ae51-2eec831a8c12", "value": "648312D073FE8EADB4CD9E2855E20DCB1E5EF974290CACE165AE04A492358452F3493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619619, "uuid": "fc5a864b-1901-4d1c-ae77-419c8dd9f76c", "value": "1536:EDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1HwdR:EDAysJADlV378P3RPVJLdIeJLOnleJQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619619, "uuid": "c0baca06-3fd6-4245-93ac-3e0edd94d044", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619619, "uuid": "66a7e68d-4b28-412a-a460-cf353bec3532", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619619, "uuid": "4f540389-c0d0-4ac1-b946-eed478af88e9", "value": "catalog-138435682.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85493905-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622909, "uuid": "e9096c8a-1195-4a99-8466-1b4a093b5b47", "comment": "Malware payload", "value": "db8aa92c29a07038e6bb0933860acf87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622909, "uuid": "bc8ebf73-ad9b-4b46-8d69-c4b407ef6e62", "comment": "Malware payload", "value": "00e469f9201c26d9eeacd03c1a74268ccbddc5c6d49a97db071a43359a3df28b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622909, "uuid": "e4c3d5e1-6271-42e6-b12f-c1e8040903ab", "comment": "Malware payload", "value": "c9926429d7bb12da7c82c5d9faacc5be96314124", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622909, "uuid": "f0688649-05f3-416a-aa3b-6ae5353924e9", "comment": "Malware payload", "value": "f1a9ee64d8675fe2f57c4120edad019b330e5cb949b6157d043a6a88cf241d4165aed241255e06f2e1eb7befa160c5bf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622909, "uuid": "81442060-fe8f-432b-99e7-c49032130cef", "value": "D283028C153EC1EFB6BD3B45B1FDC47EA50EECB47408248DD4C9266E9C89AA35C871A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622909, "uuid": "db71b9d8-42fb-489f-bf8b-68696c7858bc", "value": "1536:oG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttB0ZKvCjFevNZIJldvFD:oGEhrHJoEsBMG7qzkf0ZUOTJvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622909, "uuid": "931c3e5f-c480-4344-a253-619ab5664548", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622909, "uuid": "e2c77396-2135-4c39-92bb-04518249a9ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622909, "uuid": "b158324c-5b87-400a-8cd9-92bdb424c891", "value": "diagram-1738373246.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35431974-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626640, "uuid": "1458542b-c879-497a-81c9-17c92481f64f", "comment": "Malware payload", "value": "fb18be759e186919bed285555b781054", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626640, "uuid": "127f150b-7968-4f51-bb58-71741657ea6e", "comment": "Malware payload", "value": "00ede9c611cc27ca1314c4ded9c74919fab561e7838619cf38487675f23af9fd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626640, "uuid": "8d7dbcdd-207b-4e7b-83eb-f16e55803c03", "comment": "Malware payload", "value": "3e947150d1dd2d53035a0b8788db28d8bde33037", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626640, "uuid": "c0bd710a-4ab6-4f57-8322-860e1394800e", "comment": "Malware payload", "value": "9f1ae7a6d5c210fe79d9cac999d30483241c865fd48ab4243185d4d7a8af241f19ba65031678a02cc4b54ec58b1b737e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626640, "uuid": "1cefb6fc-0cef-4d9a-bed4-c89c6b465219", "value": "4D83020413BA491AB5CDCA2D8CC31FCE3F57F8B415198862A55D0199F627C6B9F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626640, "uuid": "f1c1b457-48fb-47c1-b6d2-ec40479da96a", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdM8ZTrIKrVAN3n1X0:XDAysJADlV378P3RPVJLdkKuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626640, "uuid": "114b5816-2c13-4c42-b107-6c5d5fc5c169", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626640, "uuid": "e41766a0-6630-40d0-94ce-3e77947b9952", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626640, "uuid": "d8565098-d740-49de-819c-0095bbd16b8d", "value": "statistic-397374844.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0a0064-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639568, "uuid": "b8e5e246-44d8-423c-847f-bedfe324031f", "comment": "Malware payload (Dridex)", "value": "f696d5cbbc6b3f4d74b7a1ce06878d64", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639568, "uuid": "190bc189-95ee-42f6-8762-9f4a36959164", "comment": "Malware payload (Dridex)", "value": "0103c2c2aeed3fdce7d4b4dce936b89d12e3fb6c11a03a040842c83df6effe13", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639568, "uuid": "b180eafd-8681-4afe-9db5-68168d662807", "comment": "Malware payload (Dridex)", "value": "8056f0249612d8ae540e3ea1d1099b4483fe23b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639568, "uuid": "6cae7870-498c-479e-964b-155aca296a98", "comment": "Malware payload (Dridex)", "value": "318d7df3413285d46d72223d220308aa888fb56dded3da04eec21296d663c3898ac90fb55541ed14936068e1c482d00f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639568, "uuid": "361d2903-51aa-46f2-8077-fac7c9f17ecd", "value": "F5F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639568, "uuid": "419b0b91-d069-4f38-903e-d94bf269686d", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639568, "uuid": "2704e2c9-7c56-446f-b501-735ae57a54fe", "value": "3072:tZSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd21GkFY:jnS62Fl+pkeJl3CvRStrFl+EY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639568, "uuid": "bfca72e5-a368-4177-b62a-a398e84e0a8f", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639568, "uuid": "749d1fe5-8258-4104-92fa-8c06945310d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639568, "uuid": "b0f6abb2-21c7-47a4-a0c2-d760f1f86848", "value": "f696d5cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187693fd-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1619620579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620579, "uuid": "4aa96d3e-7a74-4ca0-9abc-efb41d46997b", "comment": "Malware payload (OskiStealer)", "value": "88d1770a52e372a6bfa4526406701e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620579, "uuid": "dd15af18-6b8e-4e55-91c7-a62bd0e6b389", "comment": "Malware payload (OskiStealer)", "value": "01063f0c3fe705a4f04dc01658c6923f5a759aab1e01f061e31c79fd4f7c5ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620579, "uuid": "32a201a0-26d9-4106-a6cc-f3a59fa56ede", "comment": "Malware payload (OskiStealer)", "value": "c1793e09e50c6a8016811c6b81008150969e19c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620579, "uuid": "d9f8bc11-71a2-4651-a073-c4949633db87", "comment": "Malware payload (OskiStealer)", "value": "21cb794cc4fe8842fd3d2fcebac6b744106a8d2835f071e61f1c573144c88f8c9ebc60a2c7c214d087b7f6c1964c415f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620579, "uuid": "9d170288-97fb-4a1f-9ecb-4419308d631c", "value": "14C4013053E88F56E1BFA7BD28B2500017F2B516E733E35D7E99009D0AB67C18696B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620579, "uuid": "a524f3ac-f618-4d0b-a5eb-9d0c1728e8c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620579, "uuid": "dded7f1d-6519-4a4a-89c0-e46c57283af7", "value": "12288:MzPkx17m2lWIAvkq/YM5umZchws1G0MBRlieqQDJNdYCNj:J7m2l1aYcDZ4wsISeLfdFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620579, "uuid": "57439673-1a3a-4dc1-a0b5-fb9c91fd01de", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620579, "uuid": "920964e1-167a-4966-8a2c-cfa886a623cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620579, "uuid": "d2cff392-b6e9-4b3c-a7f4-bcd68a2a6515", "value": "88d1770a52e372a6bfa4526406701e60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46661a86-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619639124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639124, "uuid": "3f5c419a-3df5-49fd-8251-4010cf4ac1ab", "comment": "Malware payload", "value": "7fe6eae9e1ff7e2ea29c99306a931b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639124, "uuid": "045c9b23-dfe6-4248-bc75-cd4f566af468", "comment": "Malware payload", "value": "010c508c6585a83a44d25fd374e5710d71f21df7401987dd6032d7dad58c02be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639124, "uuid": "e0cb08e5-d5dc-4d13-9228-0d7ba1fd1e07", "comment": "Malware payload", "value": "cceedd8c08b9009fa72c73ae80d36ed98dfd75d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639124, "uuid": "bfaf0e80-c868-4ae5-97ed-5ae034de0d6f", "comment": "Malware payload", "value": "f132de12999d7bb97fb9a8620c20fef1f13a88db20d3b8a4bd85d99d6ec56f5c456d5af4e9582c5633b9a8e6dfd37f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639124, "uuid": "662d003d-4fd6-4059-adcc-738ac8f4625b", "value": "86948D396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639124, "uuid": "2d399529-f50c-4a81-957a-57b9bd4abe5c", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639124, "uuid": "fdb0b139-4eed-4221-97d2-51213a75417c", "value": "6144:SWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmm:SWrsTwr03pdf8vhhOKJETlBym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639124, "uuid": "d9bf6416-956a-435f-8d5a-872a3fe9388d", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639124, "uuid": "6c77d8f6-a0c6-4ccc-b812-2b91a6ca49bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639124, "uuid": "a38ccb02-3259-418d-896b-f09010834f21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a53d87b-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624957, "uuid": "77687807-8c43-4a48-aaf0-286cb8b9c19f", "comment": "Malware payload", "value": "e8af2fd309d73a19273a7954256e47d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624957, "uuid": "6b048e9a-80ea-4a9e-ba5c-9720ee9e54dd", "comment": "Malware payload", "value": "0114dbedb40ef982f1e0a3032e570fde5ba9481568488f63a5d1fbbaaef38944", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624957, "uuid": "e2911d96-8d5f-46aa-999e-b9568d480edf", "comment": "Malware payload", "value": "1d7567dc8de2e8d93d2508295012e8ab03403484", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624957, "uuid": "182cac5e-31b5-49f0-85b5-a157465d6d76", "comment": "Malware payload", "value": "deecdc703ecaab886f76718c4f1384931eaa96acf540540494afd7e1292cc8b6dc23a5dd64f95f1737e7e3b3449b2a97", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624957, "uuid": "a54c0f47-a59f-4400-95b7-289ae867700a", "value": "FE8302A453BE4A5DB84D4E29BCA20D4F3BA6B6743D0E5CF1B92D0485E231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624957, "uuid": "0265588d-8e90-48fe-8eb0-c4052239f18a", "value": "1536:fDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdjhsMnSEwJPTmU:fDAysJADlV378P3RPVJLdtxpEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624957, "uuid": "ec5f2fd5-d3ca-4a0d-b6ac-0331fafbceb4", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624957, "uuid": "4d47cb0e-229a-48d9-af67-2c8641d2ccee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624957, "uuid": "0f452f7e-cdde-4891-9ca8-b81a608d3df1", "value": "statistic-1134574423.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f0a1a5-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622959, "uuid": "857a2cce-6d67-4e81-80c3-7834a88b124e", "comment": "Malware payload", "value": "4929026de6d78cba59d0b49f5daa162f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622959, "uuid": "0be807cc-6b11-4f28-bc4f-be1c98884e98", "comment": "Malware payload", "value": "012161e2b90196e49b658b92899d1a2c62df37e378d6a39d67f541b82ed93761", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622959, "uuid": "71b1f5fb-3dfb-47e1-b962-8390239ef205", "comment": "Malware payload", "value": "93e9f1061e665d1e51f84091a873e5e5c46b80b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622959, "uuid": "ae0af103-d957-47de-a73b-a63d6e294ca1", "comment": "Malware payload", "value": "1809c291be2b4677c9a052391e9ea6b3b96421e2f747c7e68826ff8a11c258ec6c62e94c3f6866d360190d6a09f27ba9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622959, "uuid": "e228ff1e-9b20-4acc-873d-59f2baf66fe6", "value": "FE83024C673FC2CF767D6E08A5DDC43F680DB8B56044389ED8C46A6B588ADEF58A7420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622959, "uuid": "450dfaf1-442c-4e0b-a2fd-8bc904fd0476", "value": "1536:EG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5ZYkCxGcf1gpQn4Sw:EGEhrHJoEsBMG7qzkrZ2xGHmna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622959, "uuid": "135190a2-6ea0-47b9-ab01-8dd1909eb4b1", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622959, "uuid": "e4bb8078-9cbe-40d6-abcc-a864bc33db8e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622959, "uuid": "0b4418cf-a4bc-478a-87d8-3482e33379f6", "value": "diagram-1763743546.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b9b205-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620123, "uuid": "8901b53e-d265-4ff9-a0bc-45b9e90fdc1d", "comment": "Malware payload", "value": "d31e359dfa7ac766d2947a6bf2cb5c83", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620123, "uuid": "50957616-4597-417b-9e43-dc168ccaac3d", "comment": "Malware payload", "value": "012baa20017c0d7a42544cbfc59dfed0250c258d7abd5a12c0ab377a469f6664", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620123, "uuid": "68b91169-0ab1-40ca-b384-9cb39aba42a0", "comment": "Malware payload", "value": "319dd3dd07fd0f94db7f1438b4f16d6481d8e184", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620123, "uuid": "b855718e-5cfb-4a24-8147-84e42ed12bd9", "comment": "Malware payload", "value": "488033dded5ff7e96f14987379682cfa3728e9821f7ef2b8520803304af129edd1d504caa39333acf2f05482199e4c6e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620123, "uuid": "b3e6a6c3-6012-4f4e-bea5-2e60d7c62ec1", "value": "7783121413B94A5EB8CE8E296CE31E4F2BDAB8F4192A55D1794D04E1F2334664F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620123, "uuid": "ab172783-0109-4934-be95-67176c4af628", "value": "1536:mDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wS:mDAysJADlV378P3RPVJLdP8BX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620123, "uuid": "01d6fbdd-a904-4d07-8967-ef1d621f8845", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620123, "uuid": "d94872d4-0975-49dd-8c21-745b52b0de6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620123, "uuid": "1e067785-8cff-4c2b-ac1b-0fb94b75b775", "value": "catalog-1783382732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9279938f-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622072, "uuid": "722be2ba-435d-4e03-a5cf-24fc3baf86ef", "comment": "Malware payload", "value": "feb0ab304b69683bcc5777c96c008fe0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622072, "uuid": "9cea65f9-97fe-4a74-bca4-cd38f67ee65e", "comment": "Malware payload", "value": "012c22a49cf8b88fe9a618c0bbccea396e9004a97e585653c39ccab9bc323436", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622072, "uuid": "ccbb7d80-bfa6-4b9d-87f2-3b344c8b349b", "comment": "Malware payload", "value": "d6135a1b2ad5dc3d2e3c795ad46c1f6a03b68ac7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622072, "uuid": "3c0836b8-49de-4e7c-aa3b-2f175bcc89d1", "comment": "Malware payload", "value": "ab2f88527da669d29fc05f38c2ea2e55f83a412fb81065aeecd52da8ebbf2ef042bef5d616d6e2ebe0f9313c4c99b095", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622072, "uuid": "f8cf0a5a-680d-4872-b1a5-82587daa9061", "value": "7583028D653DCADFB1AD2F09A3CDC53FB61EEC613004248DD8C466A69D49AE30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622072, "uuid": "eaa0e5a4-760b-47e2-b1b6-a6758c829f6f", "value": "1536:2G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttje6n6475e0NEnP6/:2GEhrHJoEsBMG7qzk94q/NEnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622072, "uuid": "6837eefb-a28a-4f07-99b9-126d257f3f02", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622072, "uuid": "f81b6421-5ffc-4ee3-8585-dbc044efe1aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622072, "uuid": "df84fd87-690a-4d76-94b9-d8f87d8ea747", "value": "diagram-1112381270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbef0419-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623108, "uuid": "2306e9fc-fc41-4b21-8de9-8157144465f8", "comment": "Malware payload", "value": "c415bc30f2422079a692927f18ddfdae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623108, "uuid": "1fcc0108-8ee8-4ad8-b5f0-161bfda0fd82", "comment": "Malware payload", "value": "013a09c02c8a821ee53dc6c8caa09e72b324a37f4333ce83268027069c50f489", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623108, "uuid": "88d7eb13-10bd-44c2-88ab-865b206640b5", "comment": "Malware payload", "value": "fe91940019195c4f2a525699122dce82b2e8b0b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623108, "uuid": "810468c3-3e6a-4fc1-aa68-238f9b8b5c57", "comment": "Malware payload", "value": "42e730f5bafda8f4a7b1e3e2bd80e5732f9091de42cb4ba4342ef4760d3542a1f9a6b697b5d747084ecda7a818ff825e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623108, "uuid": "f890112d-b76a-4770-a327-d7756f6d439c", "value": "CC83028C653EE2DF767D2D08A2D8883F780DECB4614434CEE4C81A6B5D8EEE75897460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623108, "uuid": "2bf7c2ac-e730-4cbf-bb0f-273fd6cba98d", "value": "1536:pG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSo:pGEhrHJoEsBMG7qzk6h12xGwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623108, "uuid": "321a26c1-41f7-4588-9754-99227fcd9771", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623108, "uuid": "47c8ab08-16ba-4a72-955f-b64599527aa0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623108, "uuid": "1224f42d-5600-4ba1-977a-97b7174c61e5", "value": "diagram-1865188427.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481870ae-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619639127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639127, "uuid": "1a235555-d2c6-4630-bf83-91c59858c837", "comment": "Malware payload (Quakbot)", "value": "db20e9689571bb63e77baa012089fdb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639127, "uuid": "14c68daf-dd48-46d7-9d02-eebd9a21fa16", "comment": "Malware payload (Quakbot)", "value": "01596783dcb85974bd32608ce577747c69bff024f11f2c7405e56ef1012dd480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639127, "uuid": "1deba403-2b7c-4e96-b2a7-e19bd11e56fd", "comment": "Malware payload (Quakbot)", "value": "983cf4f37c0d5d88f6469aa13fc2181aa0a49f36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639127, "uuid": "5d3032af-1c8a-47a1-9085-678e3f1e961f", "comment": "Malware payload (Quakbot)", "value": "dcaacfeff3c2f1738eee17a5d598932567b5d666ebcdfbf59ba3314984b5ab44dad88373db52c048ab64693086720e86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639127, "uuid": "2ced2cab-776b-4a9f-ad40-f1a53d4bdf72", "value": "EC947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639127, "uuid": "e66145f1-a654-4b2c-8a6c-be5b5339d15e", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639127, "uuid": "d2beca0a-cd54-4ea3-95ce-26af8f41e31e", "value": "6144:yyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmX:mTwr03pdf8vhhOKJET5ByX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639127, "uuid": "fa2eb2fc-8844-434d-80a3-fd65cc68338d", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639127, "uuid": "0f28a78d-272a-4fe7-bd85-0cf3fb6153fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639127, "uuid": "bca83362-0277-4dec-9176-ef84f0ceeebb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3422ce98-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622773, "uuid": "eb319650-713e-432b-ac2c-bcb33bf5aee0", "comment": "Malware payload", "value": "0e5888b5dd39f889ee26d9884c752a7e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622773, "uuid": "d8bfb276-6faf-4f1f-9dc9-4dbc96ddd1b3", "comment": "Malware payload", "value": "0159f121ce7ff50f252d9427f45ba76c0ccdcddfc5de3158df0f6f0eca7428dc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622773, "uuid": "a5bfe69b-4926-4d81-a700-8010e69ceaa4", "comment": "Malware payload", "value": "b92aff7882a139adfe05b790e0b1bcaa13e13943", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622773, "uuid": "b0aecb84-da3e-445a-a752-28940a7b6a7c", "comment": "Malware payload", "value": "a6deb86267759c6624077e26da90f75d17d6edfca6c3364b1eb5f363e7cd1314a9111acc910ed338672ed8aaf40cc7ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622773, "uuid": "3e2e05e1-a6c3-4f91-a7f8-99130d1e739a", "value": "9883029C253DC6DFB0AD3E0552ACCD2BF90DB8B83004784CD8C56667CDA9AD758EB590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622773, "uuid": "e7fc0697-d95d-4f94-b90d-e9db4fcd5c00", "value": "1536:LG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttHrjMQ:LGEhrHJoEsBMG7qzkVrjMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622773, "uuid": "8145d496-f7cb-4cc2-b30b-7425511a93ad", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622773, "uuid": "b1f64783-822c-4210-99f0-59f799f17d47", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622773, "uuid": "29464fa5-7d49-4043-890e-a4ffb04b64c7", "value": "diagram-1633022258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f1d616-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647098, "uuid": "e76528c4-b524-4ced-ae84-ce91375a64b6", "comment": "Malware payload (Dridex)", "value": "1c0c18b6e2bd6b1edd2ff964e24ca322", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647098, "uuid": "8eccf981-c8a2-48b3-968a-432067d0ea37", "comment": "Malware payload (Dridex)", "value": "0174656b0ee41e79bb50772b2cd1e14c34d4d50f0441dcf1411211dc4365829a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647098, "uuid": "15f80e89-d2ae-48bd-b72c-ad7d78a77f7f", "comment": "Malware payload (Dridex)", "value": "5179ef03d2bcd9e149c0d2738962ec536eb169c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647098, "uuid": "8efc3d2c-907f-494f-a569-563acd71a111", "comment": "Malware payload (Dridex)", "value": "31c62677761e8aaefaa32db8e16fd12081e9b06972fe3767058f88ea358e01525f10681c5957dd8e33ba47cb53bcbcae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647098, "uuid": "8dfb3f60-c3ea-455f-acab-4dca0a100732", "value": "6BF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647098, "uuid": "0e0aedfa-9f50-45bf-92dc-eff1c4de385d", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647098, "uuid": "6e16a0e0-b7fa-40f0-8af8-645163c31447", "value": "3072:OET2d85tleLD51fC5AHYEoefukoTFMpGmj58D:gy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647098, "uuid": "3e2c0ffb-a339-4e52-bac5-51f45dbd72d5", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647098, "uuid": "ad8d6161-4b72-4d8c-a0c0-969c076e8572", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647098, "uuid": "4ba3aa4f-cb87-404f-9371-0634ad377ce1", "value": "1c0c18b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f93073-a861-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619642377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642377, "uuid": "a4f11aa5-195b-4dc9-ac8c-a931b7b97fb1", "comment": "Malware payload (Dridex)", "value": "94b6989125484b0b695da9110646b3d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642377, "uuid": "429b9c3f-92af-4920-9ef7-df22b5a91371", "comment": "Malware payload (Dridex)", "value": "01758ead03b8cb7d58b8ef18a77d18ce37d471b800764eb821a9d226a8b3dbf0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642377, "uuid": "8dbc77ad-6a7d-4223-978f-7f2be3de9416", "comment": "Malware payload (Dridex)", "value": "d273862c696017e5ea1c7b7fdb891ddc9d6393f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642377, "uuid": "bb99e31b-9cee-4eaa-8c1a-1a5b9ec19c94", "comment": "Malware payload (Dridex)", "value": "7a915cec7d1382d58c0309fe09dafdfaa20be45e146e47c99790d0397cf77a0aa8c14e8b84cfefdf595addd468d5d5d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642377, "uuid": "7c4e80a4-5e02-4b1f-a627-a6c42c01464d", "value": "C2F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642377, "uuid": "40ed43b0-77eb-41e3-a3bb-769089f48ede", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642377, "uuid": "98a54fc5-6276-4f9e-a78f-8195e07cbc44", "value": "3072:uk8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY+Zwd:enClX8WZ7/HrRCADTR0VloZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619642377, "uuid": "bed3b12d-5308-48c7-93bf-2b2fb68356b1", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619642377, "uuid": "39f19004-1341-42f4-a388-e4f0e47e8a55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642377, "uuid": "7f0e7340-ef6e-4aae-b176-99e842f5b92e", "value": "94b69891_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1897b9b3-a86d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647208, "uuid": "51a3d012-c571-4faf-a705-f7569d8668e6", "comment": "Malware payload (Dridex)", "value": "0e2ca35416bad162b87c0caf182e627d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647208, "uuid": "d2eb00d6-653f-45dd-a63e-171fb7b8f0ad", "comment": "Malware payload (Dridex)", "value": "019c9d78e7d316a6936a4387c16e2ccac58c40582904bfe86bd9ff48ec7f26ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647208, "uuid": "9628c44e-ce0e-40d5-88fe-94cdcffe095f", "comment": "Malware payload (Dridex)", "value": "4e7605b9f11d98bfb11f2b46be8c6f4a952ac7ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647208, "uuid": "4c139195-85d9-4b2b-9a1e-ba21588470fd", "comment": "Malware payload (Dridex)", "value": "fe22cf625b5827c315bd6855981878fd359990586d5ad29aace37252da8274e4ea21fbc5d43842b1f4bab077ece154d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647208, "uuid": "aa609cb1-22af-4910-830a-bfdddda87ea3", "value": "F3F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647208, "uuid": "43f8806d-b5da-4642-b6f3-5638481b860f", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647208, "uuid": "872d1fdd-9d9a-4b9d-b7c3-c2d83ac36e22", "value": "3072:dwT2d85tleLD51fC5AHYEoefukoTFMpGmjE8D:Vy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647208, "uuid": "6a8d0ee3-946e-455e-9183-f883b1243607", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647208, "uuid": "187ce96e-40ed-46e2-a077-06b0af9a4b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647208, "uuid": "9fa082fd-dd0a-4655-8ac0-d1ff9105343d", "value": "0e2ca354_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4db70d-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620723, "uuid": "fbd86a7a-49e6-44c0-a91d-91e5f2f13f68", "comment": "Malware payload", "value": "3c267d15773d2d8482a7c671179c07af", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620723, "uuid": "b829b1e0-b8e8-4c41-80e5-9809994cf9f2", "comment": "Malware payload", "value": "01a0719ff9021a684c6e8147d683879ecfcc70acb61ec3410952be6246461410", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620723, "uuid": "1361f07a-4c5a-41d9-860a-dd6336d443ea", "comment": "Malware payload", "value": "3f0a66365432ff20a248faeaf4ed99d397d045bc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620723, "uuid": "5e1549cb-53d3-426a-af97-14f6578278e1", "comment": "Malware payload", "value": "6c87936d307b0b8b2d3097701ccc50e3f9c7d906f418e847c7982979a675f0050b5762e0ec0da6f6c84b628260c4f8c0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620723, "uuid": "8ac4832f-17b8-4edc-b27b-f2be096ef8bb", "value": "F383122413B79F0C70CD893E98E31E8F7B5AB8B42D2E99F1556E0466E123C561B2447F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620723, "uuid": "375826df-cfc3-41d1-90fa-5725fd0ec2c5", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKpka:PDAysJADlV378P3RPVJLd+Z8Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620723, "uuid": "3f936bef-5c35-4a21-b62d-bd94ec36525e", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620723, "uuid": "bd98d707-096e-48b0-9d8d-a5f66fc5b771", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620723, "uuid": "712172cf-615c-4176-9ec4-7f89127f20b0", "value": "catalog-2094672072.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb62029c-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622651, "uuid": "c4a1f6f9-d6e2-4939-b689-417045ffb62a", "comment": "Malware payload", "value": "2a1519fc16f24a35084deafd5532f0d7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622651, "uuid": "216516b4-e1e5-44ca-a95d-ed0cbf5b8037", "comment": "Malware payload", "value": "01a1f3eb6fe382e272be80dd6b7a155c073787aec6364fb03340ca0ddb0c08b3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622651, "uuid": "4a178afe-9dd5-46ea-8e4e-d88247d0c569", "comment": "Malware payload", "value": "8b804cb20efb75765c1428dc03e910329e8e4a47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622651, "uuid": "527f29ff-0d75-40ad-890c-ff28c70d3bb4", "comment": "Malware payload", "value": "95f13e500672f7279774fa2195db71ef1f5f5367ce566652bd44b666aecac94e4ccde21c18611f8c2979f4a0422aff90", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622651, "uuid": "d40ebea8-42a2-4305-b8b4-74c711c5c138", "value": "8583028D653DCAEFB1AD2F09A3CDC57FB61EFC612044248DD8C466A65D49AE30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622651, "uuid": "b6fb5dcc-9ad9-4b53-bc08-745fba3aa78e", "value": "1536:LG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttje6n6475e0NEnP6a:LGEhrHJoEsBMG7qzk94q/NEn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622651, "uuid": "a650af4a-5bb9-4c25-93c2-9fe54ae2ded3", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622651, "uuid": "326b3375-b122-40c8-a3ae-018559fdb74d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622651, "uuid": "ffcc44e4-e627-4022-b21c-c4fee9f86235", "value": "diagram-1540346243.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd946ebb-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619191, "uuid": "4776430f-4689-44eb-b412-bf4b99e73d55", "comment": "Malware payload", "value": "8be11141337b2a9ee6fa4661ed334d9e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619191, "uuid": "72726a3d-0189-458b-8421-a66441703962", "comment": "Malware payload", "value": "01b2456b71c7eef0cf681b890761790d4684d3a76132d871e4feb441f8f3b28b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619191, "uuid": "7273e2d7-bfcd-4b3f-bc95-cea5649b702d", "comment": "Malware payload", "value": "d010276d307f3c05dfe00c455ae6851c4269f4e9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619191, "uuid": "db7e08e6-92d8-4252-beeb-e8747c844096", "comment": "Malware payload", "value": "0ffcb523fc40bc2429efcd1db25c73aab49a7cf785e78499450c06dff7203c85578eab11a118c02d9eb7d5e70c04b42b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619191, "uuid": "743b721b-220d-4e3e-907a-cc606b0321da", "value": "DC83021413B94A5EB8CE4E296CE31E4F2B9AB8F4192B54D1794D04E1F2338660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619191, "uuid": "47ff8356-7e84-4712-8936-0cc9d3e6b3d9", "value": "1536:GDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wY:GDAysJADlV378P3RPVJLdP8BXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619191, "uuid": "59ac7a90-6a08-49a3-8c70-27c9afaeb534", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619191, "uuid": "a26bfbf0-c1c1-40db-8e0e-74d96b65c64c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619191, "uuid": "1540943b-4ba3-4284-83c3-2f64bef1f93c", "value": "catalog-109864311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624a6983-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623280, "uuid": "7f66431e-bd87-452a-8cf0-e0b5ab32dbe4", "comment": "Malware payload", "value": "d5bd9c9c0dcdfff03eea22de8d814481", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623280, "uuid": "27c8616b-f9e8-415f-9d98-a7bf462b71a5", "comment": "Malware payload", "value": "01b4d92aa2bb7a7374016528575a48b3aea841bf962755ddb492593febde171c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623280, "uuid": "93b5bd25-368d-48ab-b174-23bdc05b0fe0", "comment": "Malware payload", "value": "79c011244e5ba84422e90e6b04e1d407eaeec310", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623280, "uuid": "7267cd98-599f-4477-aeda-8d6f25a7e3cd", "comment": "Malware payload", "value": "1e08f43be848d818234138fb5a9a8e9ea3af2c798505599e81d973792b992f1f07ad4ef0f07866c48c486109f3b2c248", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623280, "uuid": "addb4878-0aed-4295-b02c-e2c85803ec7d", "value": "638302CC6239CADF717D3E4AA6D8C43A790E98BD3040349DE4C066AF5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623280, "uuid": "2c9d6440-14d0-4606-b5ca-f3df0d30b196", "value": "1536:HG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGr+:HGEhrHJoEsBMG7qzkEEVerr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623280, "uuid": "205b65fc-2439-4289-8c6d-1e092fa210c8", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623280, "uuid": "c1882dfa-d3a1-4450-8654-91441c8fe77f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623280, "uuid": "4a570137-313f-4cc4-b701-fd71d6dfdaa0", "value": "diagram-1982537301.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7878107c-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639638, "uuid": "6845533d-f064-4be6-b66c-abe186511e85", "comment": "Malware payload (Dridex)", "value": "1a424a4ea8e6e3370921d09e61a4980a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639638, "uuid": "df19e6d1-a921-4d9d-8a34-2bae5c2266be", "comment": "Malware payload (Dridex)", "value": "01cbd982fa2f804ea9cf2fe72f509666684aa34e1d9212cc3912b9dcc4b21aba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639638, "uuid": "a4d4b7bc-99c8-4d5a-8410-b20f3ad5bd11", "comment": "Malware payload (Dridex)", "value": "e69d0cc00058d7bda2ed42427e1e8c67cb1cd96c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639638, "uuid": "bd4b43b3-17d2-4ceb-8635-8460c7269708", "comment": "Malware payload (Dridex)", "value": "148a029f9d7c3acd340a10af8222c7a7fcd0d64a9ffd003783ee321e2a15fc34e66020c94be231a0a57c1d9a9bbe42ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639638, "uuid": "c5e872ff-4257-4613-a909-acb9a1a40d2e", "value": "75F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639638, "uuid": "2f1619c0-ccdc-4562-bd46-05375c8c89b4", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639638, "uuid": "5bcb756f-e918-4fbb-b5c0-737449f22a61", "value": "3072:dUT2d85tleLD51fC5AHYEoefukoTFMpGmj48D:ly5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639638, "uuid": "60d95bc8-d2c1-43a3-a931-96a8145250b3", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639638, "uuid": "79fffcd1-1076-400a-9ced-99981fa22c89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639638, "uuid": "fdb73540-28c8-4c4f-8cce-ee65e49e0dd5", "value": "1a424a4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc759fd-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622923, "uuid": "8a89b157-0001-4abc-a055-c6c1239f6db6", "comment": "Malware payload", "value": "8969e97556e7a1b2fc207c392b555e7f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622923, "uuid": "0decc0ee-f0ee-4f29-b6cd-28ecacf95d2f", "comment": "Malware payload", "value": "01e608b79f00f514f45bee89a89bb6e831dc1f6ed05eea722228a6d2ab0b4285", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622923, "uuid": "f49e6037-3052-497e-a4de-7e502f89a162", "comment": "Malware payload", "value": "e3767f7b0d09fbdf46b872fe6355727832b644e5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622923, "uuid": "cf2ee317-7c7c-495d-9b31-4d1fe782a93d", "comment": "Malware payload", "value": "adceccb9d252bf7601af7eb1b1c052a6e759d7a45770cbd66d7d30d9db14ac71065123669a24a57a36cf78b76b02b9ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622923, "uuid": "5cd4994a-4452-445c-8c37-828f5a1d3462", "value": "C88302886639D2CF79BD2E0962E9C93F790DE8B81088349DD8C06F5EAD45BE78C47560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622923, "uuid": "4b39b1e6-401e-4ceb-9272-5a572beb6689", "value": "1536:zG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttJ6RuoKryI8NlRu+dM:zGEhrHJoEsBMG7qzkONI8Nl4+dM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622923, "uuid": "1be70eaa-764f-4a82-b172-04a488c929e2", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622923, "uuid": "e1e7a148-be94-470f-9bc7-4c9b1768b03b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622923, "uuid": "2fb91c3a-d47c-4519-be3c-0c5aa1f388d7", "value": "diagram-1741992720.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b02ab8a-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621415, "uuid": "ee278bb1-f40f-46eb-8602-33c8b6d78fcb", "comment": "Malware payload", "value": "cbb61e73a48bc2ab620bf814a2e3c71a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621415, "uuid": "7084446f-0f0a-4cc4-9fe6-716df1e2ed54", "comment": "Malware payload", "value": "01f76731bceefca558bafe835ff727e222fa60c9bc032b0eccc947a2534fe20d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621415, "uuid": "5c2a9fa8-185e-42d5-b52e-83cbcce37606", "comment": "Malware payload", "value": "0480770823e001b07022417c4e79c0d864129749", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621415, "uuid": "92499020-3ab8-4ecf-b958-36c1f4630128", "comment": "Malware payload", "value": "d3351e491812aeca20ecb0bd52c8d67aebbae8c4be400eb73c9304f02ff6d97ea9007abdec08ac981b5008d20ab9e3f2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621415, "uuid": "7f2cec77-31fa-42e5-908b-5d514206e44f", "value": "B983027103AE8B1D74CE5E3958D22ECF2F87E8B82D095992541904E4E327C629F3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621415, "uuid": "2a7d5eba-3a60-4959-aca6-fc97158b0b92", "value": "1536:oDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVRr:oDAysJADlV378P3RPVJLdtDsMU0dRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621415, "uuid": "3df89969-5c2c-4f43-a431-00a324fe3091", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621415, "uuid": "32ac0e7a-5621-446a-9a41-18ff5d0bd246", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621415, "uuid": "67a0d982-d33b-4258-a60e-c23916719e77", "value": "catalog-649777171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ee19c4-a86e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647666, "uuid": "43a6dc43-86ed-47b0-9012-b11d7515188f", "comment": "Malware payload (Dridex)", "value": "2c1e1277c8046717759113518243b94a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647666, "uuid": "8cad7ce7-b08f-41ed-b140-cd386aa22093", "comment": "Malware payload (Dridex)", "value": "01f964e77f592cea1931e1cae8fe4f315b6dfdf79789e950f2863ac8a4c4fb02", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647666, "uuid": "c67c0d4f-746a-4ecc-a8a1-6b57f764d2a2", "comment": "Malware payload (Dridex)", "value": "e0f2c4338e34428d801bc3fff567031195a01e48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647666, "uuid": "891a88ff-99d1-4fc5-a9bb-4450660f3346", "comment": "Malware payload (Dridex)", "value": "2dee109c3253568e6cc25361617bcd0c44703e7f4ad7e77350f431cbfaff2ba1df928f410366720741eee44650f3c41d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647666, "uuid": "ed8f18a8-c9e6-4e76-a335-7857efb42f7a", "value": "2CF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647666, "uuid": "43a8fe4b-f7a7-4bc7-8071-a29f85f8bcc9", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647666, "uuid": "1dcce23c-26e8-4dc3-9674-53140de0a0b2", "value": "3072:sxT2d85tleLD51fC5AHYEoefukoTFMpGmjY8D:dy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647666, "uuid": "6b41481b-3c43-441e-a167-5a70dbc1b505", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647666, "uuid": "47051883-45e9-4261-84fb-03514e1d466a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647666, "uuid": "5e5b193c-6036-4045-b161-2c0cdc74f2cf", "value": "2c1e1277_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4139d08-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640597, "uuid": "31fd7c0c-ea2c-4277-b470-5f582b84c384", "comment": "Malware payload (Quakbot)", "value": "17aeb95020b6ea90647a1a719bb13cd3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640597, "uuid": "cb308f34-ce59-453f-85bd-8297c225413f", "comment": "Malware payload (Quakbot)", "value": "020438b1b718bba9729ad0d02e15aaa370931654bb8f168124ee030fe2a120b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640597, "uuid": "36dacd46-7487-4685-b871-a4b02259cc5f", "comment": "Malware payload (Quakbot)", "value": "d6bdcc49ea551928c39602cba92f82527a305e60", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640597, "uuid": "80e118fb-d6f1-4563-ad16-a5b556194d9f", "comment": "Malware payload (Quakbot)", "value": "b090c5885cc19edec0c8e5e66c62d941d75ac8b81662e133be4f724d602cb266ee370a3d1fb7a2f99edf7e67c07efd6b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640597, "uuid": "552635fb-1abf-4103-811d-0d6d0b8492c9", "value": "52948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640597, "uuid": "22b1bad4-15e5-4f35-afd2-86335ee7f274", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640597, "uuid": "77c17d94-10dc-4668-9f49-63dc897e31d4", "value": "6144:YVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraU:dFNmLKSVpJbPT+4xrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640597, "uuid": "c97afb24-79ad-4976-b546-1e2825b67d06", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640597, "uuid": "74db7fc1-9b81-4322-94b0-ad893c9e0031", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640597, "uuid": "2c2f32d8-8ed1-4560-991f-661d4588124d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477c5bd9-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624953, "uuid": "95206e1d-e884-4805-99e4-b5dbd06002ab", "comment": "Malware payload", "value": "9c31fe18d9ec58925d7e80872e3046c9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624953, "uuid": "faae0604-3ba8-4d98-8568-4925b48ad37d", "comment": "Malware payload", "value": "0210d72079b7838056adec83ce8429016f790bb406b18c859878617b1e11064b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624953, "uuid": "e7c7bf47-e94d-4d2a-880e-47ad8a7cd1c9", "comment": "Malware payload", "value": "9bcdd48ad014a41cd7744117485c39f05ed374b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624953, "uuid": "3307e4e7-cc56-4909-bbd1-cfd7800411c8", "comment": "Malware payload", "value": "e023943f866fbdec26142726eb67310b0c365d65f0d84d6e5938eeb283069cad4a12c4236cec4db7a1bbf0eeb0ea9f07", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624953, "uuid": "1e31b98c-7ae5-4581-a4bd-f861a29aa020", "value": "1A8302A553BE0A4DB84D4D29BCB20D4F3BA6B6743D0E5CF1B92D0485A231C561B24A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624953, "uuid": "be76c572-7092-4d56-b7a8-a698afdb3ab6", "value": "1536:yDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdjhsMnSEwJPTmzU:yDAysJADlV378P3RPVJLdtxpEeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624953, "uuid": "dd540f5f-0326-4847-b6c2-3cbf70c6be33", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624953, "uuid": "39ab2bc4-a6b4-4b3c-9575-13dad2bef9fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624953, "uuid": "b1a4b89d-0e0b-4d18-9264-a63b88f32c42", "value": "statistic-1132114455.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292f1644-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619748, "uuid": "f0812660-60e9-424a-ba68-90298483fe7b", "comment": "Malware payload", "value": "32faaf3f8c431eaa18dcc29421392895", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619748, "uuid": "d0e01582-611a-4217-bf23-0c9beb8f7279", "comment": "Malware payload", "value": "021ad12cebda315a4cf0cd3b76be14a42afff1a43ed89ad998a1b04fa6882d4c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619748, "uuid": "98599eb2-b532-41e0-aeb1-1304cd847cbe", "comment": "Malware payload", "value": "0e153c15e94c36ccf9bbaf53a45aa5db86cea16a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619748, "uuid": "fdb23d6a-479b-4a88-b760-44abb5901c90", "comment": "Malware payload", "value": "6e1a263389f6a48f796be793131a24e6ae4a505193442d6506e3ec83cd287e8c29a5f58eed0eb7675be266d1ff5c7c0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619748, "uuid": "f746bb8c-7754-41ee-87b2-b8c78db23223", "value": "DE83135453B94A4E78CE8A196CE31E8F279AB8F41E2B55E1795D00E1F2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619748, "uuid": "3f4fbb69-b87d-4ee3-bd51-cd13d333a15f", "value": "1536:oDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdeIkGV8BAY0wb:oDAysJADlV378P3RPVJLdz8BXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619748, "uuid": "ec31630d-396b-440d-904f-de6de09e1503", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619748, "uuid": "900008b6-896e-4a37-84ba-0728429ea5e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619748, "uuid": "e2712ff6-f639-42b0-9703-291fd28ccd52", "value": "catalog-148015208.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990ae3a6-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626378, "uuid": "aab71060-ca56-40ba-adf7-3e899f72e0d7", "comment": "Malware payload", "value": "5bd1220ca03a03e6c94ca8e690ec45d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626378, "uuid": "7ea89947-70c3-480b-8da8-3f55bdc67d7f", "comment": "Malware payload", "value": "022cbd7bec914163a1aebdfc9d356ffcfb228b966c5c78030fa0b3f1f2939170", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626378, "uuid": "1f9da3da-e522-4820-8796-55c163bc27e0", "comment": "Malware payload", "value": "5ea5501af6d364a77c0b99f498fb67dbf770dc50", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626378, "uuid": "02affdc7-9879-43fb-9457-113e6a98b68f", "comment": "Malware payload", "value": "79455b5704e83d29e76263decd6b41f6318add7a3306bccb0f95d1e22cf945a8b78df7acb457e1fe5691056fd0d7927a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626378, "uuid": "023e37c5-a524-4320-8f05-95033a634a13", "value": "9583025013BB8EADB58DC93A48E20D8F2F56B6702D5B5CF2B12D0494F1238961A3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626378, "uuid": "6340bbd0-a34e-41e8-948c-76667c9af40c", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7ml:zDAysJADlV378P3RPVJLdw7ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626378, "uuid": "3d900687-5a48-40d9-b360-aef55bb5a537", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626378, "uuid": "437dba3d-e2d8-4ef2-b56d-ecc71d471cd1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626378, "uuid": "34eb9491-200a-4151-a3b0-bce070609440", "value": "statistic-229196226.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8639f89-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624364, "uuid": "e66fcdd0-a38f-4e90-984e-c9d6ea6d79ae", "comment": "Malware payload", "value": "c1a722015a12db3737f4f9df5995bf87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624364, "uuid": "cf73760c-d6e7-46bb-a151-d73066bb0664", "comment": "Malware payload", "value": "0246ea6a0df8d3f8c33aac467cd8c5b7a1f31250d39c9b8bce2d68382e5c64b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624364, "uuid": "9034eac1-477c-427e-919f-f8f1f275cd3b", "comment": "Malware payload", "value": "0778ce6ca8686f2285f2ff5df4aff79d3375aec6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624364, "uuid": "e080d2f0-3a29-4e34-afb9-0e16426d721f", "comment": "Malware payload", "value": "d2fdf448e4798a7de9329855c106835df3fde66cf18ef71692ac56ece97c722b9e9108d99f115abff7f8b9be7cc1bb96", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624364, "uuid": "8b6f11bf-ec34-4cb6-9574-e83e80bf0d19", "value": "8883028C653DD6DF763D6E08A2D8887E780DECB4214434CEE4C81A7B5D8EEE75897460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624364, "uuid": "413929b6-03ec-4d88-a976-7ffe87c5d9ea", "value": "1536:aG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSt:aGEhrHJoEsBMG7qzk6h12xGwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624364, "uuid": "f062dcf6-7c26-4113-bee7-dc8848764f3f", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624364, "uuid": "18d0e731-6012-42ef-9f1a-ef1f054b2029", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624364, "uuid": "ffb5df17-6d63-47b0-9ba0-7bf0b8782cf5", "value": "diagram-728407446.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee142f23-a7cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619578846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578846, "uuid": "1c15af5b-5256-492e-8fe2-278e9e4d2e59", "comment": "Malware payload (Dridex)", "value": "2f80cf4997beda1e8bd18a70bdb90526", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578846, "uuid": "be06d20b-a24e-4885-97f5-dc64d033b33f", "comment": "Malware payload (Dridex)", "value": "025a88860c1516a90f36f26f872366f138b52b6c705d38c3a151e5a4798158c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578846, "uuid": "4072aa99-97f6-44a6-bac2-800210a13719", "comment": "Malware payload (Dridex)", "value": "febdd634c1ec234a2d35b1198b95e43c0538e9d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578846, "uuid": "5f4429fb-b70c-4652-a543-f14b0b5753a3", "comment": "Malware payload (Dridex)", "value": "3110345f9a9b973a5e89ea8f93654e144ad0ffca282cdd0d77105022d8980db6309f1b0b79e857d9cb42ce85383bd772", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578846, "uuid": "fcb9ee68-124b-47e0-b3ad-3f457c948f4f", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578846, "uuid": "27246e90-6e31-4336-83e1-dacf6aaa7849", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578846, "uuid": "0cf1416e-a507-45da-84e7-47aeed0f55eb", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619578846, "uuid": "55fab612-c9c9-4083-abab-8470fce8d073", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619578846, "uuid": "7e6d6264-4fa7-44e1-b637-044fd5639932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578846, "uuid": "a8501000-a747-4bec-9eaa-8ccb7dd1d956", "value": "2f80cf49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955733a4-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622077, "uuid": "44813ca8-654a-4ba6-b8a1-5f65f69ae316", "comment": "Malware payload", "value": "c1f0d129a18a55141ce468a7bf4ed85c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622077, "uuid": "cfedc98b-9355-434e-bc70-d098f896fc65", "comment": "Malware payload", "value": "025ee916b19eb65156b8c7e8c8afbc7e83437849c69db670b5337d295b8f1bbf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622077, "uuid": "e6580b21-f07e-44c6-b7a9-8e31fb7c8d87", "comment": "Malware payload", "value": "43f27a01597b4fa99e9c0d49426c03559c48a414", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622077, "uuid": "49823c65-dff6-4a93-ba01-64ea3b930d14", "comment": "Malware payload", "value": "39df5ed6c0f4f061fda90b6ff6062a42361b4f7bdbd460c2807e07913970ce31145d6904293fa0d443f919b0313691fc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622077, "uuid": "d4a7c2f5-6cd8-4654-bce2-1b5e78a1fdd1", "value": "D583028C6339C9DF727E7E5A62D8C43A6D0E99B93004249DE5C076AF1D899F70CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622077, "uuid": "e96ec17a-348f-4716-b23f-60c8a2a2bc86", "value": "1536:4G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZDEVejoGr2Aw:4GEhrHJoEsBMG7qzkHEVerrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622077, "uuid": "f9908736-fbfc-4458-96cb-c7ccb6fc1325", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622077, "uuid": "b2ed09db-bb17-44d1-a373-ed0597826785", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622077, "uuid": "c5ae1357-ccc2-4ff8-8db7-b1a4d6a409e2", "value": "diagram-1116840837.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c8097e-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640600, "uuid": "83d70a63-b194-4fc0-853a-1b681a4f193e", "comment": "Malware payload (Quakbot)", "value": "9cc6f7816fe85671a28396b88ac6e630", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640600, "uuid": "9e7eb989-62e0-480c-9cbe-06944697a558", "comment": "Malware payload (Quakbot)", "value": "02637cf6aa72561ea4cfe0485c7a3c8937a33f1c96fa4fa67072a19d7f7a44f1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640600, "uuid": "5cd4a86d-d80a-4de0-88b5-7f7df0afcbaf", "comment": "Malware payload (Quakbot)", "value": "bfd3692e3b5fabd0ec974ec1dc9bec557be47d73", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640600, "uuid": "9d290efc-7e33-4312-9d9d-ca85a0524d4a", "comment": "Malware payload (Quakbot)", "value": "09dbea06b1b2f66d734b8a05d016eb3ca6af8ab0077274fb30e0223fdc094c443c557d0b7dc864d97a4f7af07a6d4710", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640600, "uuid": "db3887e8-8e25-4c08-96af-8942a4be749a", "value": "78947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640600, "uuid": "209754e9-c4d6-4708-a51d-ada2abedb044", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640600, "uuid": "110b900f-5967-4214-9c13-27fd697be38f", "value": "6144:3yPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmC:nTwr03pdf8vhhOKJET5ByC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640600, "uuid": "18d17681-161d-4d45-8e62-668e390b7497", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640600, "uuid": "a394b590-898b-4102-9950-7844528b87da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640600, "uuid": "613bd4ad-b9fa-4675-be8a-2ba001087674", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eafc252-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626387, "uuid": "91763fcd-852a-43df-beb8-8ade7351caee", "comment": "Malware payload", "value": "40bc559059be86e3a3d217635df62fcb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626387, "uuid": "c8f8e317-f28d-473f-90e6-67c0a60f90c8", "comment": "Malware payload", "value": "02755b9dea176812fb7652507e47703232d00d6afedc9150901ec3db37ead1e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626387, "uuid": "c389e3c6-5fd5-4baa-ace4-c50da0cf9ffd", "comment": "Malware payload", "value": "be9f541e92743d13db42e9c8420065d7cb41c57a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626387, "uuid": "c7c89380-d690-4488-8874-43c2a8a39a7b", "comment": "Malware payload", "value": "7ed90e403a09af1bba7212c11238130d3827721fe6cb91496c9c0d031f2931b222604b7e917d85f571cfb0d6989e9fad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626387, "uuid": "f685af14-fbb8-4ca9-be29-6c1cca3187ca", "value": "EB83125403BA854E78CE8D3C8C931DCF7B37FAB4352E5DA2555904E8762AC424F24A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626387, "uuid": "2f5a94d0-7c7f-478b-bea2-a0468a003f66", "value": "1536:hDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdt3BfMtlF78EhtKg:hDAysJADlV378P3RPVJLdBBfUlh8Csg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626387, "uuid": "fa3c6186-421f-43e0-8829-8faf3324d263", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626387, "uuid": "b9503b3d-de0a-4664-b836-ba99d0889fc5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626387, "uuid": "90078aed-4bbb-4449-ada7-e3287a30c49f", "value": "statistic-233050774.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234066d5-a7e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619589673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589673, "uuid": "82c57e11-949f-4950-8cb1-5e9df956725e", "comment": "Malware payload (Dridex)", "value": "a3db9ec9394ed5cb09c57713ba23caea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589673, "uuid": "7159a275-5a3d-4a8a-9128-6ab4dd79cce0", "comment": "Malware payload (Dridex)", "value": "027b8cdb44474362c3bb3bdd90313b2def049178fbeff75de392fd3a8c964fa1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589673, "uuid": "da5567c7-dd76-47bf-8e2c-2f10f6261893", "comment": "Malware payload (Dridex)", "value": "2e8b0d92bc30e3781d9d2e09b88f905a601be608", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589673, "uuid": "721b2930-a5c4-47ec-b945-5835e88ffc4b", "comment": "Malware payload (Dridex)", "value": "59ca0b9c86f2656e20b0cf5dc8ceb1257d9cac1330f24cb35ca2652bcbd64a18bb1719bacd76794d8401540c1a0f46be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589673, "uuid": "e5243e08-884d-471a-9e94-e542b82a5ee7", "value": "E9F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589673, "uuid": "ef3f37f1-4935-4b99-bdc1-34d2aa087298", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589673, "uuid": "02c5603d-b84e-402d-bbb0-a91d951f4c69", "value": "3072:/IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619589673, "uuid": "142f79e8-0eca-4075-87e0-59ba67d297e5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619589673, "uuid": "3d654f2f-d3e1-4171-83ef-4c9bde43b0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589673, "uuid": "78ef350f-152c-48c9-b606-2ccfd59b5bfa", "value": "a3db9ec9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830e16c8-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621187, "uuid": "8bda495a-def3-43f6-8ba6-c41289d51185", "comment": "Malware payload", "value": "8d535809679cc9ee89477a8eb46eb75b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621187, "uuid": "dc4d3d06-f21c-4db9-9663-a8875f15978b", "comment": "Malware payload", "value": "02875fd4c8d2b807356ae077e0a4f6c757c97f41f355a786cf4f260323e38f48", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621187, "uuid": "773a6402-417e-47ef-9089-5adca8da3419", "comment": "Malware payload", "value": "c90acd659cee49cece1843850e9f39ab96c4af55", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621187, "uuid": "2cfaa0f9-1caf-43f2-8a59-73aa9a5fb32e", "comment": "Malware payload", "value": "f5c19f005499fc15a2b367ac7004504c09599ddf1030a4ae83e0e00d1e40fc606c6450ecc964ca55f1503f83cb17b8d3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621187, "uuid": "cdac8bca-afbd-4cd9-b429-344fa7c96d52", "value": "65830114137A064CB4CDDF2A5CB31DC76F56BCB82519A8F6906D00A8F6338526B2CA7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621187, "uuid": "780271fb-4e86-466c-be8f-44eb923589d0", "value": "1536:fDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsR1EPCO0UwJ:fDAysJADlV378P3RPVJLd8EP90UwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621187, "uuid": "5142babe-9aa2-4680-92ed-230ebda66852", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621187, "uuid": "aad9b9a7-dd7e-4af3-8911-04aac0cfd305", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621187, "uuid": "0f2f8055-5924-41c0-a0cd-c62dbf62320f", "value": "catalog-449497727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7823d2f-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640602, "uuid": "914f5653-49c2-442e-b3b0-8ac95303eab7", "comment": "Malware payload (Quakbot)", "value": "2ab14e4dadfc8a78fe56183b95fafd14", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640602, "uuid": "524de863-be80-4dd0-bad2-e045b17bf5d2", "comment": "Malware payload (Quakbot)", "value": "02ba8129a59e1a855e4dc884f2ce12ac32a74cbdf72d0f5e31a8e83482c74b81", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640602, "uuid": "4f6056fd-c621-4c4f-861a-93ef3a234a8d", "comment": "Malware payload (Quakbot)", "value": "c7eb4b6d02637a9835b8bfec58625eef4e678e5c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640602, "uuid": "76e026da-6506-47cd-9aeb-eb0899e9c54a", "comment": "Malware payload (Quakbot)", "value": "55b9a77034e18614d9069591d671bbcd4f67a5a6160f89c71794dc9c9362d7936811d02b076111eeed05195fb1886a5d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640602, "uuid": "4900e44b-395f-431a-8582-0c8987f6a2b4", "value": "7E949E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640602, "uuid": "eec2e2a4-6355-4678-8741-327f82f906ed", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640602, "uuid": "fa94bffc-e61b-4336-815c-99b8fadc5b67", "value": "6144:0VWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraQ:5FNmLKSVpJbPT+4xrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640602, "uuid": "06b7d9f2-6217-4a87-9e2d-8784ff2ca8da", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640602, "uuid": "9ecc56ca-6d6b-4cd9-bfaa-39a184d48ca6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640602, "uuid": "ba019fd2-2294-49ef-901b-dc395b9bab80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5daa11-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625281, "uuid": "d0cfbeac-3a04-4945-b218-7530db563c56", "comment": "Malware payload", "value": "dc2be05eec77d11f2a369593c320152f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625281, "uuid": "571c8c0d-02ff-48f2-ada8-7d5f85dbe676", "comment": "Malware payload", "value": "02be32ece3802774065f76f681dd9fd04be7b86e766828a7250217b910fffb1f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625281, "uuid": "4cc07552-8bb9-4c65-a971-125bd14f7030", "comment": "Malware payload", "value": "7ba73f27fd497e550a6830e6fdb5c4e2340596ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625281, "uuid": "f84c4f81-029a-4db4-a71a-07c33999994d", "comment": "Malware payload", "value": "e5c4b0e8ddb15ba6e81f69989cf128105619a75f182d27b1f13e41255e5d5f910b13ea1080b6520c3970190df48ea01c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625281, "uuid": "70530066-47b8-471b-8728-d4e687a9d21f", "value": "1083020403FB9559F48E9E38ACE20D8F7F86FAB53D0A58E1976D0455B72AC910B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625281, "uuid": "8b1a9714-fc0b-4ffd-b721-aa608ff1e93d", "value": "1536:RDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBVb:RDAysJADlV378P3RPVJLd/eh8wBVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625281, "uuid": "99afba48-abf3-4641-b8d6-1a4072f24833", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625281, "uuid": "422958dd-6a43-4f5b-885c-718b171a7c55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625281, "uuid": "7be9ac58-df88-4f7e-a63d-2aa19657b445", "value": "statistic-1365155381.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ee0a14-a86b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646336, "uuid": "5e7ef8c5-66cf-4f76-b716-e417ea101fa6", "comment": "Malware payload (Dridex)", "value": "30e4f72065f7ce861898069b39ae5ab2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646336, "uuid": "5f5b7e62-7d2b-4408-8e35-492f11e25d37", "comment": "Malware payload (Dridex)", "value": "02c4c6a0444e2a35e576d4a25c99813f9ff656850025bf9287d3828a06651393", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646336, "uuid": "6d9079b5-9790-4027-a028-260e4ba36906", "comment": "Malware payload (Dridex)", "value": "03ea02612e2aff01d648b8417a29b484fb50a9a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646336, "uuid": "cb1ca01f-9c30-4262-975d-19346edd4c08", "comment": "Malware payload (Dridex)", "value": "ec411d271723fec2377951b98fabb00ff8e6d0baf5d49fbf406ab5cb803d52841e461de3df7105c906d1e7e8eaf71f37", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646336, "uuid": "3593f847-41cd-49e7-8b21-7cf0425c0c16", "value": "7CF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646336, "uuid": "e23e98b6-073a-4de5-b33f-7902481ff30e", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646336, "uuid": "eb18490f-0ae1-446b-8e90-4f3f5007d7ef", "value": "3072:CnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:xy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646336, "uuid": "0fc6392c-7d6d-4ffe-927e-a56c8b9163ef", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646336, "uuid": "c79c4a1b-f706-4e02-85b0-003211437531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646336, "uuid": "17dae8f7-da68-47f1-adab-fa0ff3280528", "value": "30e4f720_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85b0eea-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623827, "uuid": "0e97766c-7fd0-480f-a1f4-ac8268209b86", "comment": "Malware payload", "value": "231487c5b6789ec4ed5d23233f09c377", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623827, "uuid": "4d62117c-3940-4b69-866d-e4df9577b8d5", "comment": "Malware payload", "value": "02cb730505c057edfa78765ac6675fcd9d78cd833e7dfa2ec0d26df3508ce213", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623827, "uuid": "205f9cce-bcd2-40ec-9633-1a2daf6ff679", "comment": "Malware payload", "value": "802e0bd9e834ee2eb407f427eba539262aae979a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623827, "uuid": "f1027e38-a4dc-45c7-855c-68885f3af447", "comment": "Malware payload", "value": "8f1251999131991e3e0b655f71c884fd5a0fc951a56624ce9d36349b0396db7cbed0a86f21da01c14073c9669e73df9b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623827, "uuid": "9d7d78d3-59b5-46b9-b3c3-8577e3895f42", "value": "B08302CC6239CADF717D3E4AA6D8C83A790ED8B93040349DE5C0669F5E899E71C97470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623827, "uuid": "08fa0edb-f134-4d2c-ba22-04d85960062f", "value": "1536:gG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGrE:gGEhrHJoEsBMG7qzkEEVerrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623827, "uuid": "f7c191a8-3e8a-4c8b-8c8d-1bd4351f4f18", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623827, "uuid": "c03ccad8-91e1-481f-9163-e40d0e5c6431", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623827, "uuid": "d6dd9292-a132-436a-b3dc-80abcb046a87", "value": "diagram-43468042.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8af9f2-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621471, "uuid": "34b2350c-eb5b-4505-baa3-dffcf246fed1", "comment": "Malware payload", "value": "9297ca8297f6e7dbb4bbccdc1b69ceb5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621471, "uuid": "d506fcf8-ba9e-4144-b037-45cce06f846c", "comment": "Malware payload", "value": "02d2e307db4ce4e088ec7e07625137836d56b7675ca9d10e1e8537dfd4fc9a3c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621471, "uuid": "9b1febd9-ee83-4af0-be06-8cce11dbb608", "comment": "Malware payload", "value": "ae5298b4931c4002984bd46947592a8ea3f310d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621471, "uuid": "eed5d9c9-ce95-4893-aac2-b068570d1a99", "comment": "Malware payload", "value": "c6f638c6993e95125f5e88dcdd51f3cd2455810412f287991fe76aced2695f1ee06085891803fa67b7c055fabc6a4743", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621471, "uuid": "03494e65-350a-4027-8ebf-3845e30ec9c8", "value": "8A830250036B8D4DB58E5E3888A31ECF3F95F9342905A8F1753E19B4E32F46A0A2497D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621471, "uuid": "68bbdea9-7e9f-42bc-9aed-0399408df5bc", "value": "1536:8DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGneL4XqG2DbLXH2:8DAysJADlV378P3RPVJLdg36GYT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621471, "uuid": "7a1fa506-474c-46c8-82d1-f98ff9b7620f", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621471, "uuid": "de5f406a-23f5-4d79-a565-d62c27ca17c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621471, "uuid": "5df8024d-92d6-441f-964c-bc8432b9f489", "value": "catalog-691062781.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501e7aa9-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625826, "uuid": "cc4bd938-5d91-46c3-a0d2-8e58ebded03f", "comment": "Malware payload", "value": "1ff4facf2d9dcf18a97730743a66ce13", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625826, "uuid": "b36c9782-79ac-4e7d-97cd-1b5775add065", "comment": "Malware payload", "value": "02db5f403d546a8440cbca829bcdcb5122f3a58f3d72e77ade73c2f42822b13c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625826, "uuid": "ea510e42-a8c5-451d-be6b-d0b6736d68e4", "comment": "Malware payload", "value": "53f67e8d63cea1d631a517797db3674f51b054a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625826, "uuid": "17c9bda0-5df8-4e7f-80b6-d2c4cf0517c1", "comment": "Malware payload", "value": "0ba2ef773cc64b64d1fc3aa1e2e673c512363a8c580efc11cf2c6b8832226affab704f81dd1b667b1a52046f8beaa1e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625826, "uuid": "3ad60f2c-9045-4520-bdc8-808e983efe6c", "value": "DB830250437ACB19B5CE8F3D4CD3198B6E9BE9F42A1D6CF1652D00E5F72A8051B14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625826, "uuid": "0045de61-7637-4a8f-8f8d-b379f6541e52", "value": "1536:gDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdI8oZePFOLVEr0xkvUHtKM:gDAysJADlV378P3RPVJLdI8oZeUM0eUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625826, "uuid": "e1ffbcb4-ebee-4214-9103-719931bde8ac", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625826, "uuid": "02d0b1fa-5dc4-4f2d-9904-3842078580ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625826, "uuid": "e2631ca8-8257-45a4-a795-b37f292a0024", "value": "statistic-1776078036.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f212fa2c-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619655, "uuid": "c31f04c9-c362-40d2-87f6-2bb14dcd6bc6", "comment": "Malware payload", "value": "d40cecc8a74ee20de5d2aefcf9264cb1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619655, "uuid": "ab9b4f77-94b1-4304-84de-ae43aea94fe8", "comment": "Malware payload", "value": "02e297791c12ecd40a209f2ad84e56ad936c3e96d33f4a96f352bebc6a2c412d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619655, "uuid": "0067e1c5-1583-40b8-80d1-e0af9e4ed276", "comment": "Malware payload", "value": "b9cac41124e5ecbe5f6328d1120ab861c2da2c03", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619655, "uuid": "f9aad6a7-eddc-42b5-830d-ae544ca784e7", "comment": "Malware payload", "value": "40df46ef9ae442bda8b12c541413bcd8b9f3770b0b3e5c3f37009df6af7fb97f6109f57a8848354c1e5f41dec5df3ca7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619655, "uuid": "132871a4-b7df-4837-8f93-417c8e9ec591", "value": "D083021513BF564CB88DCB3D9CA30ACB2F5AB974291968F2A55900D8F6338425B28D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619655, "uuid": "6116fbb1-ba6f-48ff-a5cf-d1ee937544fa", "value": "1536:UDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsRP6sCO0Pyp:UDAysJADlV378P3RPVJLdC6s90Pyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619655, "uuid": "d2a07e07-ed3b-437c-aad5-112e7501bd40", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619655, "uuid": "ef202687-13da-427d-8770-f7a5e35d3585", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619655, "uuid": "4957f48d-1828-4237-bdcb-87701b6ddbc3", "value": "catalog-1409040440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1073ddad-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622713, "uuid": "f0606f67-1398-43d1-9c05-c36c29961873", "comment": "Malware payload", "value": "2aeb28cbb4e72f97cd10ba82bf0074f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622713, "uuid": "adbb9541-7175-4f81-b223-4b6b4490a661", "comment": "Malware payload", "value": "02e3e10ea8c28372a1656a88f04d5c6e48453476ac7e32e866158b911333322d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622713, "uuid": "7ee0f207-37e6-4f9f-8bc7-951cac100f57", "comment": "Malware payload", "value": "85a2c57c1cef0226440d45b4387870f489564b35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622713, "uuid": "7409a30c-7358-4b1f-a36f-fa16e9ffee9f", "comment": "Malware payload", "value": "78b986a4351c8cab9403f7c6826b911afe2dfc44080751d91fec4fbe69c718308095d8862754babf220c75420a73d608", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622713, "uuid": "fc1f9fd8-7522-4e60-84ef-33b52f09aebe", "value": "FE8302D9203DC5DF716C6B0AB56C893EBD4D6CB5204064AED4D8666EEC8DAFB9C53030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622713, "uuid": "3c81ec8e-949c-4605-9db4-2749322dc74e", "value": "1536:3G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttWI5EzJKE9LfFSp7m9:3GEhrHJoEsBMG7qzkMI5AB5gpS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622713, "uuid": "bab94743-b260-4614-8c3a-122ebb886ece", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622713, "uuid": "c97ecc1d-133c-4790-afdd-435453edc5f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622713, "uuid": "b64221ef-ac0a-42ea-b7b2-b9e0e4fc79a5", "value": "diagram-1589259349.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cf65c6-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639036, "uuid": "d1f6ee1b-869f-4f74-aa7f-334655b4b505", "comment": "Malware payload (Dridex)", "value": "7867c698934f84cbc674efb8c19c3d1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639036, "uuid": "b96b8b18-84bc-4523-b8bc-20582de93c8b", "comment": "Malware payload (Dridex)", "value": "02fa9fcf6243826c0a6115786977d5ad07c97e5db97eb4214169e5a63d8417cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639036, "uuid": "d380b0b3-6adc-467c-86b4-51c32ae191c8", "comment": "Malware payload (Dridex)", "value": "f9dc81f850ad1bd4f2d5709753da653fba41cf51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639036, "uuid": "db82fc6f-3dc8-4b29-9b00-3cc25ea0a1d6", "comment": "Malware payload (Dridex)", "value": "1b1a252fa603232d0fcec7890e72c1c4433e20b1b53b28b8d3a8cbceb20dc8090866a73aa0d8ed24131dcb6539b8ff41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639036, "uuid": "0ba433f1-a72d-4799-b228-c898c76943b4", "value": "96F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639036, "uuid": "902203d1-ca15-4b15-bede-54f7ce875a62", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639036, "uuid": "12d6a2f3-1d2e-4ccd-9f99-9d6d8704df56", "value": "3072:CZ8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY3Zwd:PnClX8WZ7/HrRCADTR0VlZZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639036, "uuid": "bd4dd2be-9015-4a42-ab02-03e49004d1b9", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639036, "uuid": "70c3bcf9-6f9d-470b-8bd2-bcd01c6ceb74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639036, "uuid": "44895ad5-6ab5-4466-95b9-916d97d87b4a", "value": "7867c698_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54478e73-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621968, "uuid": "5a602bad-2ab6-4f7b-84fb-445201345844", "comment": "Malware payload", "value": "6b51bd90ace061439a2b1063d86b2972", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621968, "uuid": "fcc110b1-1eea-4246-8ede-aa2c1ed74d2f", "comment": "Malware payload", "value": "03000933e0ae4bc4f0ce0daf3f19d1b0d39062242f5570d10f65dddf5ec113a6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621968, "uuid": "1dfd5c38-1b76-425c-86ee-48daa6644778", "comment": "Malware payload", "value": "481cf084c92b4d217bbc3e52da301d42c8066fd8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621968, "uuid": "eb0000da-cc6d-497a-911e-c9fc191ddb09", "comment": "Malware payload", "value": "1f97ce8e1c5a3dd45ad0e3e67186e9b0f9cdd0fc5725350f15c112f789e8dea1b60365fc53eeb8a4f9022503acac6852", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621968, "uuid": "003d2d63-70c2-4a1c-b11d-d9c4a37cadc4", "value": "7483028C3138C5DF37BE6A04A2DC887BBD09D9B93504385EC489655FAD8AFAB0C5F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621968, "uuid": "97bd7657-8fe6-470b-98b2-15e53f24d01b", "value": "1536:8G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+pB6:8GEhrHJoEsBMG7qzkZQxOo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621968, "uuid": "9a043121-b9fa-46be-ba3b-95e5c311b21e", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621968, "uuid": "d1b0ce79-1756-4004-a3a0-26e456f7b2a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621968, "uuid": "283ef8c5-83c7-468c-8e6a-488d9e77cd06", "value": "diagram-1042448028.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53367015-a819-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619611228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611228, "uuid": "fecbcbe3-d5d5-4a39-8f24-b19634c5ca08", "comment": "Malware payload (Dridex)", "value": "104017af4b84395e24b04225c0ae01d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611228, "uuid": "460cc1d3-61d4-419c-928b-44f5d9778afc", "comment": "Malware payload (Dridex)", "value": "030f0094b7975b377cabb158c09c1af00457ff223c1460c14653224cc3c0a8e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611228, "uuid": "b94927d1-7039-40a5-a328-67e4db24bcc6", "comment": "Malware payload (Dridex)", "value": "843bc10f1df992386221b4d3805ebbac685625cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611228, "uuid": "9b5f58a7-1709-4030-baee-0859481719aa", "comment": "Malware payload (Dridex)", "value": "9875c53542320c0413f65655543578e898ec130f5ac7d85e4c99231f81ac01436486b15846c89afcfe5df732ed7b147f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611228, "uuid": "e1b7b561-6415-499f-94d8-ea6df7281751", "value": "9BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611228, "uuid": "687acf3f-c64c-4c57-b440-9d5541374b57", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611228, "uuid": "b1d838bb-45b1-472c-afc0-f63c86e41c71", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619611228, "uuid": "0f5f4e64-14b9-4711-bdea-0f9ba5a2a696", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619611228, "uuid": "5ded0c0b-43d2-4415-8a4d-0877be1ee76f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611228, "uuid": "aa705640-6211-4d57-a308-3e5d5de580c1", "value": "104017af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9329b54-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623076, "uuid": "0423949d-776f-4d6e-b865-ad7776886091", "comment": "Malware payload", "value": "af30592a216b3e8a08ebf0b38c1d7c8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623076, "uuid": "fa5f725b-ee04-4f8e-b0ea-9df4e1b3d3a8", "comment": "Malware payload", "value": "03163ddf98909ecdef3e693c8a6cef69cdd87932b38a1ff5fe46acd88ba8cf4b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623076, "uuid": "a5f1c689-739f-41e3-9eae-4dc9cf0996cf", "comment": "Malware payload", "value": "c7274e07eed8ea2037f9d865a82f68fdbb733536", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623076, "uuid": "18b01059-2ef4-4361-894d-38201d502b8b", "comment": "Malware payload", "value": "c96cffd8e699668ed1cd188351453ae84f9cebe6053370169d19373955d302f3f5771a8913cf32246e3eb9f0ca1e8290", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623076, "uuid": "28d64a32-77d6-434f-83e5-6028956db01b", "value": "5083029D203ECAEF766D6E0A92A88C3FB50DED712044248DE4C476569D48DF62C6B670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623076, "uuid": "baf02bc6-9943-4fdd-bedc-9aff7aa8e93b", "value": "1536:KG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttDZuwHK68F4LXBZ:KGEhrHJoEsBMG7qzk5ZyFExZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623076, "uuid": "11035638-6b64-49e6-9163-d538a47aa9d7", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623076, "uuid": "2902d0b1-cbbc-41de-a1eb-1cc475b074a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623076, "uuid": "bddecba6-50f8-4264-a9f2-343d9a347d3e", "value": "diagram-1838501867.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771ff189-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626750, "uuid": "e5b9485a-0269-4a02-9e52-50c09ff99ea7", "comment": "Malware payload", "value": "412f903720d64c71bac282337fc6d663", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626750, "uuid": "985cbdc0-ee62-4caf-97ea-67ee418d582d", "comment": "Malware payload", "value": "0321c30c9513c67af376a80517015d6e86083caee9137831d15f08e553655a6c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626750, "uuid": "22f2f1a8-509a-4699-ad2f-b5158b8cfb97", "comment": "Malware payload", "value": "6f23f3d79aea2181e1e6c18571363d124358d1a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626750, "uuid": "a014b7ea-8b30-4631-a5b7-0c1d5840670f", "comment": "Malware payload", "value": "b2336597824d49be80d0d898c8d9f99c1a036751b0333d5abb624551c8dd3eb15e3304fc362df8cc3eb42bc4cc0ad80f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626750, "uuid": "007f30bf-9f68-4be6-800b-f8cd1c4e967c", "value": "B48302A453BE4A5CB88D4E2DACA20D4F3BA7B674390E58F1B91D0485A335C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626750, "uuid": "2ee90782-666f-4f13-8a7d-3e00d4bc1eaa", "value": "1536:jDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9hsMnSEwJPTmNKS:jDAysJADlV378P3RPVJLdLxpEDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626750, "uuid": "9c7598f6-aa62-46c1-9ad3-e6f57a0ce8c5", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626750, "uuid": "ed4ea385-89fd-495a-963e-ed94da5ecb8c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626750, "uuid": "715502f4-3438-4a2a-aca5-b0df1a12da20", "value": "statistic-481839566.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd95f9d2-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626063, "uuid": "02ace6a6-d9ca-408f-8949-0152c5906fd3", "comment": "Malware payload", "value": "7713ccddd5acd54bd79fd463b98619a1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626063, "uuid": "592b22d5-a3cb-4809-bf8f-11503d4e8a07", "comment": "Malware payload", "value": "0335f68538aa8655ead2f3e9e622c2b5b365fffb255b346664ff12a977508f62", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626063, "uuid": "aee4cb62-4ac8-4f1e-b0dd-0c837277c9d0", "comment": "Malware payload", "value": "9cf19f6799d3a42c88f9e1acff23ad6d6c892c0f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626063, "uuid": "94561061-5512-412f-aa4d-6dcb08a4090f", "comment": "Malware payload", "value": "d2ad58b818e4e2f2e072a75a66e186eea274c0b6f71a212aefff6ae1014ffd5e08d24a801e3860c9fd073b1dd32e8308", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626063, "uuid": "b4c31c5c-76e3-493b-a82c-a1d1e6c3c688", "value": "9683020403FB9959F48E9A38ACE20D8F3F8AFAF53D0A58E1976E0455B7268510B3457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626063, "uuid": "3130530f-d33c-4756-8d25-e310591b476b", "value": "1536:lDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBfy:lDAysJADlV378P3RPVJLd/eh8wBfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626063, "uuid": "a633641f-c580-43bc-8532-4f7bafe6881a", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626063, "uuid": "2a65e4f7-d96d-4d1c-a814-c2368c13dc3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626063, "uuid": "163f0571-3187-43de-b722-fbf3f5663b58", "value": "statistic-1939166948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5840adc7-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625410, "uuid": "ac29ec65-62e0-4dab-b60d-1ee9cf4d3670", "comment": "Malware payload", "value": "4917968f28b006a8abf132d1d2121060", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625410, "uuid": "f56494be-036c-4ab8-b240-29b3463b4920", "comment": "Malware payload", "value": "03456cc64e479fbc1ad22bac3cdc46109ce79cc5ed66281ded00ec4698510838", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625410, "uuid": "fed1a129-4b67-4277-9508-5a1bad51ac0a", "comment": "Malware payload", "value": "7ea732b13e4d7d3fd49ad4711fe08df542348001", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625410, "uuid": "a783eee7-8e63-43ef-8bd0-b124ec90c91f", "comment": "Malware payload", "value": "1a10f03433fc48e67d61ac615b0dd4011328e150a4c15539838ff4295763dae2ac631d7477aabe2fb24f3619710efb94", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625410, "uuid": "03b71ac3-2162-4de7-9715-deba062f8ba3", "value": "4583021403FA8559F48E9E39ACE20ECF7F4AFAF53D0E58E1962E046563298511B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625410, "uuid": "a98a80f5-45b6-4987-8f63-ce9331d11fc7", "value": "1536:VDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wB3mT:VDAysJADlV378P3RPVJLd+eh8wBWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625410, "uuid": "e17e27cd-e842-48a1-9dc1-51c182ad1b60", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625410, "uuid": "9a0fdfe6-320a-4187-b1f3-ad7ac385cf23", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625410, "uuid": "4cfdeaa7-cd21-4275-b010-ad5c34f49684", "value": "statistic-1487524306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31adcf8-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639414, "uuid": "e151cd28-38e1-4ea4-9768-3fa4d4fd70ed", "comment": "Malware payload (Dridex)", "value": "0729827e93dcd8843357ae03b651c690", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639414, "uuid": "83107f0c-520c-4a86-a094-eda58e31f2b0", "comment": "Malware payload (Dridex)", "value": "0345de92b9dfc2209f74e558de8940aa53584d06264da7aa9f22a5bc8bea7144", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639414, "uuid": "74fdd88d-4bd5-497d-bf3e-b782735c6833", "comment": "Malware payload (Dridex)", "value": "cf3ca348a0c7462ae8410da4c52afc98473d6d14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639414, "uuid": "26874141-84c3-4d71-9537-f2940af74d8a", "comment": "Malware payload (Dridex)", "value": "fd99b4bac5f31b699440b546fd3142ca99e682f2872d38adc06b4d420e57f25cf4432eb8cf342040a76137c79d106e74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639414, "uuid": "9ae2fa67-61ca-4c30-8c22-9b0570198e49", "value": "4FF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639414, "uuid": "70c7ccda-da6d-479b-be48-db8b1f744b72", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639414, "uuid": "91e535ea-c5d2-4b00-bfe1-bc414185bb87", "value": "3072:rIT2d85tleLD51fC5AHYEoefukoTFMpGmje8D:jy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639414, "uuid": "fdecf0ed-e672-4f0d-bc28-06085eb2584d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639414, "uuid": "da4f17e1-620d-47f2-93c6-9a323a02dc04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639414, "uuid": "f6555c22-054e-4fbe-bff5-a2602d63c32b", "value": "0729827e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5953c36f-a877-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619651611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651611, "uuid": "eff925a8-ce89-4520-b349-b54ad41c5829", "comment": "Malware payload", "value": "5a4a8b1a86b665d8798de80133362f46", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "FoundCore", "colour": "#CD099D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "RainyDay", "colour": "#58B605", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651611, "uuid": "042db396-b4ae-40f8-801a-828bcf6d7a4d", "comment": "Malware payload", "value": "037e17b85dfd4671dc748701aa31b028438e44edee620070510438bcb56f022d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "FoundCore", "colour": "#CD099D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "RainyDay", "colour": "#58B605", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651611, "uuid": "b4a4741e-0a20-4b0d-b433-cb55c754ea79", "comment": "Malware payload", "value": "21a43984a9dbd15ef352e78e48110c2f22d7bcc5", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "FoundCore", "colour": "#CD099D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "RainyDay", "colour": "#58B605", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651611, "uuid": "334526b7-8a8d-410a-b46b-6c4850709ef1", "comment": "Malware payload", "value": "50ee7823dc3b534a58fcf6938df05fbf6fec256790ece386e6e87ae878fa0a2d832e6c00fdbee54643f486897632fa77", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "FoundCore", "colour": "#CD099D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "RainyDay", "colour": "#58B605", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651611, "uuid": "2d943141-e04f-4329-b8e6-8255e8611f54", "value": "1A636C10B6D1C4B1E0BF1E395434D6A15A7E3C204FE5CDAB3B99022E5E741E2A731E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651611, "uuid": "9641ce59-0ea1-402a-944e-ca5529017be7", "value": "51f196fb15187395fd755e231fa0e68f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651611, "uuid": "0b023ed5-e941-4bf3-bc9b-2911511e23ec", "value": "1536:MO38Mfw0SKs332NZHYyHFQHBsWxcdr2P8gTb7GCtg:FQD3SqcFqMr20gTVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619651611, "uuid": "477d6cc7-27bf-4275-844f-335ce556dbaa", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619651611, "uuid": "eebe7ec7-578d-4037-b479-767e120ca7fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651611, "uuid": "ea90eeb2-b27b-4c46-a9ba-3e40b620213e", "value": "037e17b85dfd4671dc748701aa31b028438e44edee620070510438bcb56f022d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac6dcc1-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640608, "uuid": "72ad3e19-b886-4699-83e6-81f6c86fde19", "comment": "Malware payload (Quakbot)", "value": "15a52eba61f0055ba499122224ba9b56", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640608, "uuid": "5e08a10f-d6b6-47ec-b2d9-4d5ac291c7a1", "comment": "Malware payload (Quakbot)", "value": "0386d9773218eab3638a7f7ba8d1c993ee5945a0442abb53e675e3ee94a5021b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640608, "uuid": "862ba704-b4ed-463a-8ced-6bd98d9a712d", "comment": "Malware payload (Quakbot)", "value": "7b241a9a83bb66a879567abd3830672e6a547804", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640608, "uuid": "1fe14bbc-570c-401f-ad88-4e221cef5df7", "comment": "Malware payload (Quakbot)", "value": "e6cd5b9d20e5743447941f2b3aa137fc0e7d5dc7e236a626ddd94ffe7cbc395b6e548361ca43358c833bcfa8a7a69d92", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640608, "uuid": "ec97d5dd-86cb-4908-af11-c402dd00d785", "value": "5C948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640608, "uuid": "95af63f0-9e2a-4192-8ce9-cdc792411d4a", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640608, "uuid": "4645651d-be57-48d6-bcf5-c1241478aa8d", "value": "6144:PWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAm9:PWrsTwr03pdf8vhhOKJETlBy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640608, "uuid": "cbdee898-5aad-4005-b463-926314471af4", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640608, "uuid": "c1044eac-f5eb-475c-9db9-d7a8f4a1ff54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640608, "uuid": "0545a0b7-7a55-4d6c-a2b8-3c465644e2c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d4ac9a-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619131, "uuid": "82cf915f-1e5f-4e9e-ad45-eedc81f91326", "comment": "Malware payload", "value": "b3bfe96ec0633c5b71b2fce918ed9509", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619131, "uuid": "3a70204f-e6d1-4259-9ce5-1c5d4b006a9c", "comment": "Malware payload", "value": "03a3c5604d2817a50396679fb38367d36c4bff0feb4506247cae68f2a002e1f3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619131, "uuid": "0bad1cf9-ec61-423d-8836-2cb401a823b6", "comment": "Malware payload", "value": "67a974e1f92db9679e4c3db900841e671daf56ba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619131, "uuid": "209fd766-992c-446d-8095-b7abdc2fafed", "comment": "Malware payload", "value": "7e26ce0f1b2c21ddfd0cef7e54a537b9583741b0f8ee677500e99b0027d3af92160091442cc29d488613a65e8d8b3fac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619131, "uuid": "975cd3a8-96a5-4610-879d-eec9783dee88", "value": "6183021413B94A5EB8CE8E296CE31E4F2BDAB8F4192A55D1794D04E1F2374664F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619131, "uuid": "5462383d-daff-43bb-8ff0-594764879257", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wq:PDAysJADlV378P3RPVJLdP8BXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619131, "uuid": "7809c5eb-7796-491b-909a-cb2f03f0468b", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619131, "uuid": "37263c51-ec50-47b1-a11d-b04c2e2f6492", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619131, "uuid": "107ac020-99e3-4672-8a7f-f1ba879f587d", "value": "catalog-1050688903.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5868ca-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625095, "uuid": "6ae24943-097f-45fa-b53c-bb2e322f1a9c", "comment": "Malware payload", "value": "3f259caa31dfabaf3642f67dda0ccdea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625095, "uuid": "265ee415-3462-4da6-8cd2-f4dede711fc6", "comment": "Malware payload", "value": "03abb64a05d08ecb49e68990a7c48377d3a8f71956eaf62422ceafb7fa958ac5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625095, "uuid": "8cee61a3-ac65-4054-b997-55abe7e98132", "comment": "Malware payload", "value": "7a5bf903c98a8580aea8cbe9acb7ff84cf83ccc6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625095, "uuid": "baeab0f9-2586-447a-8db0-4b9eedf3216b", "comment": "Malware payload", "value": "fa7282f261f9a71278ec013455e33cc403a01476174d97d5bc0f729e18b05669d4491a8aaeb10b71a662916656489319", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625095, "uuid": "04d91418-8413-42c7-ac6b-1488e184d12f", "value": "18830250537ACB19B5CECE2D9CD3198B7E9BF9B42A0E9CF1912900B5F3668051F14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625095, "uuid": "c7a407ff-1bbe-4685-a6ef-f9febc74f820", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd2/8oZePFOLVEr0xkvUtX+g:DDAysJADlV378P3RPVJLd2/8oZeUM0eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625095, "uuid": "27c7f1a7-7cfb-44e7-8373-114a6b9bf552", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625095, "uuid": "0ca88014-7a72-4546-8805-7427e5791fe5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625095, "uuid": "4cbd0130-f9e6-4ef9-a67a-31a626057769", "value": "statistic-1224296165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc810180-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640611, "uuid": "ef8d4fbf-6404-4bf0-b765-e5175fd2f25e", "comment": "Malware payload (Quakbot)", "value": "20b347dc15613731322ed168fcacfe61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640611, "uuid": "967287e5-7441-4f4a-a61c-e8fafbddaa8f", "comment": "Malware payload (Quakbot)", "value": "03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640611, "uuid": "9f6e0051-91d0-4afb-b36c-f8cfc0321c00", "comment": "Malware payload (Quakbot)", "value": "874bde28492b1edfb2f0376770385fbfdf7aeec4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640611, "uuid": "33aa1ea3-4562-4142-a588-548ae486ce0f", "comment": "Malware payload (Quakbot)", "value": "f503c410e3d6ef9bc6dd85cf9f8cddf2b365749be62e11e3a0519b74957157de7f59743b5d8be16a07524a0d78c93f4e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640611, "uuid": "04b89c8e-78cf-401c-9edd-5033707a4b52", "value": "0D948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640611, "uuid": "f5bea86c-da28-48e3-8e5d-100d642be293", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640611, "uuid": "838b2732-c5b4-4466-b684-43af8494f9a5", "value": "6144:CWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmG:CWrsTwr03pdf8vhhOKJETlByG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640611, "uuid": "0f1c53b0-64e7-42d3-a786-e9ab418e26a8", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640611, "uuid": "758d7b05-5b69-44f2-92e5-1864330a6795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640611, "uuid": "3f85001a-c85e-4686-89af-8180832ae860", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3898b5-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640614, "uuid": "2a353e6f-32d2-4421-a42d-3b80112884b8", "comment": "Malware payload (Quakbot)", "value": "df3e641ffcaf29baf26d648f3e340979", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640614, "uuid": "85102a9c-4c22-43fd-9845-b4a77cbfd171", "comment": "Malware payload (Quakbot)", "value": "03bbdffb47af3f70c65bcdac92cc08e41cfab85fbd0ff976d75fbcf18cd12552", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640614, "uuid": "6ab23f1d-561e-42f5-9d9e-45822d6d3ac0", "comment": "Malware payload (Quakbot)", "value": "5eee63f1e4a878f20f8ce4ca9d651c65c4494b7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640614, "uuid": "09b0454d-dab5-4bfd-a1bc-3b12672aff2a", "comment": "Malware payload (Quakbot)", "value": "f953ee28728461376d348bb8a253bb120911cae35db8af51f6981158bd0582acfd833c1f89e252ab2dfe6008a2d6df3b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640614, "uuid": "3f445338-8114-4735-95e2-1529885fd899", "value": "D3947D396A26D063D2BC27B143C3EF580E67EAD57234540612A2DF183EB6395BE36F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640614, "uuid": "2591ea4d-3ecd-4921-9535-d9dadd7405d5", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640614, "uuid": "4799ab1b-b0c8-48c8-968c-d85bed4bc8df", "value": "6144:cyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmu:UTwr03pdf8vhhOKJET5Byu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640614, "uuid": "06eaa8ff-489f-41eb-ae5a-37d083fc01ec", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640614, "uuid": "bddaaa21-85c4-441d-b7c8-47df05206666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640614, "uuid": "46519488-9c59-4864-891d-8c4039d3bf62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5301aa0e-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639145, "uuid": "3d66f963-bc84-4ff5-8b3b-b6cd4477bafd", "comment": "Malware payload (Dridex)", "value": "e0242762bb2dedc7b1d27ce987414a9b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639145, "uuid": "ca8de7d6-a751-47e3-a067-2c444cba85ad", "comment": "Malware payload (Dridex)", "value": "03cd0d7589612b2f896853a161df161cdd1aee8ae80170b45123e6647859e600", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639145, "uuid": "2af7a436-140e-4806-bd3b-a950f4a54f00", "comment": "Malware payload (Dridex)", "value": "bc5833e1383f8e5dd56d8f148139f14493ab4722", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639145, "uuid": "62aab223-c5b7-44e2-8171-37a15f2d85e5", "comment": "Malware payload (Dridex)", "value": "b426794c3d730dcc7e9c7d05cf11e9727069ebbcc2230fa65793fa028b2367831f17f84b978e9142a589f894fa201145", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639145, "uuid": "0259a4ab-2607-4fad-ba97-5d9fbd3769b1", "value": "12F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639145, "uuid": "b2f9db4a-223f-467c-b91b-1c85f5ef7a73", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639145, "uuid": "93f445a7-391f-4942-ab10-cf6c56881fb9", "value": "3072:YZ8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY3Zwd:ZnClX8WZ7/HrRCADTR0VlZZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639145, "uuid": "394888e0-4495-4c51-8f4f-d4e70e7e8f32", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639145, "uuid": "3af211ad-2e3b-4094-ae00-6b695d4c1c9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639145, "uuid": "def74bca-7339-42d9-ad4c-f86e5e0ffefe", "value": "e0242762_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffb107a-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640617, "uuid": "080803ad-5233-4d3b-9a5c-e423c896412f", "comment": "Malware payload (Quakbot)", "value": "b8bab31f5770a26d8f6c783236c88421", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640617, "uuid": "ea3cebdd-ebc1-48a3-aa42-1a5f26754c31", "comment": "Malware payload (Quakbot)", "value": "03d5ade4b4a85f617886f37db7e3be95d9ade2b2d5eaaa6e492661c221cb2c50", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640617, "uuid": "eebe3375-e6ba-4dd5-808c-0a06e74408ab", "comment": "Malware payload (Quakbot)", "value": "ed403fbf3e67310a311c38452c002b99891baa56", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640617, "uuid": "22ecbb2b-62bc-419d-91df-c8f3514e353f", "comment": "Malware payload (Quakbot)", "value": "1114654f92cd6f72fe6e8a6556c340075cbe4c65a4fea9a3ba1df4a8dea49de70701e06e9c801b78a77bc9f1dbf49ef5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640617, "uuid": "94b45096-9a6f-4003-bb95-62b27ce03a9b", "value": "87947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640617, "uuid": "298f6b1a-ece3-4a69-9f74-3dfd5774d40c", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640617, "uuid": "57f4824b-8067-46d9-9b74-cf0fbd88f810", "value": "6144:KyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmQ:uTwr03pdf8vhhOKJET5ByQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640617, "uuid": "72b38e3e-1687-4591-bb70-6f7ec08851c0", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640617, "uuid": "f6a163af-824e-463c-a9de-eb86f4f23475", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640617, "uuid": "5288137c-544e-41cb-aaed-136222ea2975", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39b384e-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619577, "uuid": "66d35e82-11d4-4f9c-ba28-c3389ec2e835", "comment": "Malware payload", "value": "858da68c1c3db910ae6fbab620a8330a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619577, "uuid": "c247f443-fe00-41df-98b0-c39d953546f6", "comment": "Malware payload", "value": "03db552644a07cda59b7a6918bae2dab29194c050bf02666535e260fd70cc772", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619577, "uuid": "280ac6b6-c0d2-44d7-839d-93565b551f11", "comment": "Malware payload", "value": "a108c306778f37095ecc3b33816c48aa3dabbc34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619577, "uuid": "9c2810a5-2d14-42d7-bf74-e900c97b40de", "comment": "Malware payload", "value": "4db4774a26890a4ec5790dc97ac3ac1bb119ce3a96b8de800e3b7a5df618cb525f30dd499e95b2549157b54c1e66d0d3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619577, "uuid": "919b59d1-786c-4f5a-b8c8-4082adc2dc8c", "value": "3D83122413B79F0870CD8A3E98E31ECF7B5AB8B42D2E98F1516E0456E123C561B2447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619577, "uuid": "fb0a20f6-ddee-40fc-b4e9-d13a4f829583", "value": "1536:iDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKk6:iDAysJADlV378P3RPVJLd+Z8Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619577, "uuid": "138a9ad6-dfdb-403b-a3ae-e54707bd5a43", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619577, "uuid": "7e046bb6-6c63-4701-8121-b4594550ad85", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619577, "uuid": "b0a9e6ec-5c8f-4dc3-889f-1363c6da277a", "value": "catalog-1361776661.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f245d6d5-a7f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619596033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596033, "uuid": "1921f4d5-28d5-4b93-bda8-9db3644edf58", "comment": "Malware payload (AgentTesla)", "value": "ee965cfd144f9d8bdebf5ba508df4a73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596033, "uuid": "fc7b3bae-34cf-4d65-aba1-1030d341f84c", "comment": "Malware payload (AgentTesla)", "value": "03ed2935a78500e99635cfb4b349babe558d16f98fab090246b0314bd93029cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596033, "uuid": "a96547b7-ed98-4f0b-821d-ea8e3d2c7564", "comment": "Malware payload (AgentTesla)", "value": "36918a525b26c989efec6393e398ad5ac65993ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596033, "uuid": "214fe16e-8c8d-4c2f-82d8-9cf1e95677ab", "comment": "Malware payload (AgentTesla)", "value": "88a1a2830b25a0ef123d2169eda2e42037b924d8df81756e505a402e8fd286d1975a8ffce5ea59b55cd78bbef70b63e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619596033, "uuid": "76d4c846-e6ee-4233-8022-910c362b4cfa", "value": "CF053379B46F59A5B68FE59A2CBCFF1F80762B1B530C8D5A2DC43E3D1A52663830100B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619596033, "uuid": "5afda16f-04e2-4ff7-9f89-6c48a85aa7b3", "value": "24576:rnE2rkxl+ndSMOTe4/FMlsTZa0Ep+DiGk:rpGfZTtEkQ0E2lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619596033, "uuid": "8b30b606-dd6b-44f8-950d-f956cb9496ec", "value": 799575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619596033, "uuid": "15722cd2-dcee-4e35-8d4c-45b64f72ff7b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619596033, "uuid": "2e264954-b91b-4c02-9884-d8f23f6a9d66", "value": "Doc_26042021SC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1999cf5-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640619, "uuid": "8dd0443e-d93c-40b7-a98e-ac913abfd0ed", "comment": "Malware payload (Quakbot)", "value": "a4a5508c7ff6f2870d2e9d6c66e1fb11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640619, "uuid": "d56932e6-5f51-452b-98f4-a44ee1b56700", "comment": "Malware payload (Quakbot)", "value": "03f320c0cbdcf10ede41fadd28640709565555c7c89b18e616dd42a0258321e6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640619, "uuid": "bcf53352-5940-4817-b0f3-61350401558e", "comment": "Malware payload (Quakbot)", "value": "11405640cc09db79cfa572c2c2872ba87d374ad6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640619, "uuid": "a8f8f96b-e74e-4e7c-a69c-14c7863f734a", "comment": "Malware payload (Quakbot)", "value": "7ce64cb2dd922237f9828cb1a1ebe750771cda83e1e3dc9ed30c3bbabf5ab1a90be4b00409ded9ef68eaa8d6a19715b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640619, "uuid": "05ffbeb6-311a-4121-b7e0-f6528d758456", "value": "F1947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640619, "uuid": "bfdb3643-c854-4632-a37c-5629cc6b75a6", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640619, "uuid": "1b2b16bb-b536-44f1-a673-b0d02551686a", "value": "6144:ZyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmJ:dTwr03pdf8vhhOKJET5ByJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640619, "uuid": "f89ffe3e-27e3-486a-9f03-ec04e715d7f2", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640619, "uuid": "85a61c1c-d4de-4d3e-a097-0fe631362a6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640619, "uuid": "a52f2803-744e-47cd-baa7-43be5e2b8a39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7221cffa-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621159, "uuid": "28833a42-9b08-454b-826b-3ee5f3f2fda1", "comment": "Malware payload", "value": "ab4fead95c36c57874611a841c83a9d7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621159, "uuid": "2a919251-bbe3-4df9-bbc4-4c3743849c0d", "comment": "Malware payload", "value": "0418624a5cb4bc19fd2c0aee8025eb33878cb30fa27d04db74b7eef388ce6d38", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621159, "uuid": "6adfb01e-a131-48f4-b6ec-2d9454275ab2", "comment": "Malware payload", "value": "87cb3e013b5d5048af85539c1cc7736e9723ee04", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621159, "uuid": "ef6b9dbd-46b4-4983-8970-19e9902943b0", "comment": "Malware payload", "value": "d64845419864bfeff993c7d30e91b19225e0e1226caf29a9417ed2e930ad804c14d5ece4107448d67474e603289a08b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621159, "uuid": "5dd7e179-f0bc-442b-9699-5438cf75055f", "value": "4183021113B58E4CB9CE9F295CE20ACF2FA7F9B4160D69F575280894E722C074B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621159, "uuid": "3160f2a7-9113-4ba5-ac31-e4dfa7220297", "value": "1536:QDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJ6C:QDAysJADlV378P3RPVJLdYDpH+jAJ6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621159, "uuid": "3ea04ff0-27d6-4867-a29e-14516d4b205f", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621159, "uuid": "71603ac9-b66c-4703-b557-2cbeafe362da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621159, "uuid": "fe284213-672b-4182-80a1-1d59f34d3c5b", "value": "catalog-438744195.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f586e5-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625133, "uuid": "974fbae1-577b-40c5-81fc-fdd72bbaf9f4", "comment": "Malware payload", "value": "b346e0aa081894d23ddadb212c7bda03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625133, "uuid": "73e4ec25-803e-4f92-8c27-7fb272b60b5a", "comment": "Malware payload", "value": "04289db6bed5ac639a6152e2d47e217fe92f034b1b9590979e164c9c68d24475", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625133, "uuid": "fbc71c84-5625-4e1d-8dd4-1dc8c5943520", "comment": "Malware payload", "value": "e66ee26cfb8aa825eeb982984b86930f5ff145ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625133, "uuid": "1d4ae762-ce86-495c-9299-8c72471fb102", "comment": "Malware payload", "value": "03b9319dca2a56de0cec594a1701b0fbe174e6bb45acb49064956e2284436cac8b956ef8d328cc0f5f05cc96a482ad04", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625133, "uuid": "9036719e-1124-4d65-96f2-309da9b4f8e2", "value": "F983021563B9C998F58D9E2D4CE30D8F3F43A9782C1ED5F26229019AE227C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625133, "uuid": "da1b05cf-d074-4a6a-931e-591cc18c72c2", "value": "1536:bDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYPqXT/WkO0B19M24:bDAysJADlV378P3RPVJLd8qXjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625133, "uuid": "eda76d96-dfd3-40d9-b2bf-43ded93ff726", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625133, "uuid": "22fdb546-5d9c-4be5-8229-d36a8b7faa70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625133, "uuid": "15d775aa-e6d7-466b-8a25-135d869021eb", "value": "statistic-1254483046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21738534-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623171, "uuid": "65ee03bd-905b-4c87-b606-0af758034e11", "comment": "Malware payload", "value": "ac910f1c49caa81e4e96e76bfd7d5551", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623171, "uuid": "e39b712f-120f-471f-9184-8a2547080760", "comment": "Malware payload", "value": "043e74c6954ad2700378c8597d9514648e55d976eda2ecd634adc0706c1222c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623171, "uuid": "0fed6403-debf-43b9-a1f2-2dfdb0bf268a", "comment": "Malware payload", "value": "74dcaf40642c4427b285cce9afd164fe9fd00887", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623171, "uuid": "7c4eb80a-7880-47e4-b33f-e6d717598e63", "comment": "Malware payload", "value": "7734cc9bdbcb5c213cd63f606f4e06c6630eb9dcfee24d8b312be41a583888d72957bffa7da15f09675bed5e4bfb5837", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623171, "uuid": "de6cee7a-a8fa-439f-8a9b-beb2d89aa3b5", "value": "E983029C253DC6DFB0AD3E0552ACCD2BF50DB8B83004748CD8C46667CDA9ADB58EB590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623171, "uuid": "03af88ae-facc-4740-b5b2-69f3cb4505c8", "value": "1536:VG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttHrjMB:VGEhrHJoEsBMG7qzkVrjMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623171, "uuid": "58226a11-7c73-4d2d-91b8-2b3b0f8b5b5e", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623171, "uuid": "4513a5e0-435d-4359-933c-f2b7b298edac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623171, "uuid": "f00d61d6-6419-4cee-9b52-50972cefb3e9", "value": "diagram-1914148280.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8471ab2-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625544, "uuid": "d0f1a1d3-4c15-489d-ac34-b7619d34a4c0", "comment": "Malware payload", "value": "2b3fb87b1784fcd010f39898241ad363", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625544, "uuid": "039c8ac0-f2bc-466f-b329-51445e4a4cfc", "comment": "Malware payload", "value": "043e8a798205edc4d0d91d572df74a7c30220f0225028179fca6e4936dbb5c70", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625544, "uuid": "bd66d351-0868-488f-9fc1-6f85834ee686", "comment": "Malware payload", "value": "30e38e2f54857642270e45a3c80c51732d94e67a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625544, "uuid": "fcbef7a7-84a9-4673-9a02-64b4ddd4b214", "comment": "Malware payload", "value": "cd263e62c0696ab92a70bb9be9de4dcff4e6a642c4d78b2204d13cfeff587e7568715a12ebd38c5cb8d7dd79827f0151", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625544, "uuid": "a18b63d3-911c-4608-9f1f-b49edb8f83e1", "value": "7783026563BD8598F4CEAE1D58A30D8F3F52A5742C1EE8B5762D0186E236C534F3093E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625544, "uuid": "10e614d1-335b-4efd-8bf7-2688bc0a5ab7", "value": "1536:3DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdjhkT/WkOsB19M2SX:3DAysJADlV378P3RPVJLdtkL6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625544, "uuid": "e8632d1c-1a2f-40d0-ab1d-8e85f6fc3707", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625544, "uuid": "95f749d7-e1a3-42db-a2ac-016aee468bf1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625544, "uuid": "f3691558-e546-477d-b17c-9807ae3b4bf9", "value": "statistic-1581881189.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15209475-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624868, "uuid": "3d8dd29c-ee4f-4cf2-a66e-678f52b5e6aa", "comment": "Malware payload", "value": "f33ea5b80fcec46b8f19bf850c9ad0a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624868, "uuid": "3435fb29-d39f-4a4f-99a5-3b8b0e1b1175", "comment": "Malware payload", "value": "0443d7ab70eaaebc5b1ee1a5cb7826f4d216a90648049849c67d07127ff798d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624868, "uuid": "844444c3-687c-4f92-babd-9d64f942f1f5", "comment": "Malware payload", "value": "1403be79a0cad68ff245fcef8e770ffd7a73a5dc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624868, "uuid": "6572d1eb-c289-4c11-ae14-157ff71f2cab", "comment": "Malware payload", "value": "bc34deb4dd78fa8f498a2e08fc0953d561feb8d2e0400e940720b947740b5be69da59b7fd34f52cc024776144655a7ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624868, "uuid": "d0a2d54f-d0eb-4f92-9c59-12119bea3314", "value": "2E83021163BAC998F48DAE2D4CE30D8F3F42A5742C1ED9F662290199E327C964F3053B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624868, "uuid": "84cb4d6a-2247-41f2-aba4-8cce56253dd5", "value": "1536:iDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2oKC:iDAysJADlV378P3RPVJLdCqXjQKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624868, "uuid": "9642597d-a9f1-4118-8d7b-2b1a38a5a8b6", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624868, "uuid": "0bfc6d7f-6902-495c-b7e5-497073d198f0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624868, "uuid": "fa4c7ffb-f0bf-4527-a8b9-8cc89824ea69", "value": "statistic-1066784088.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e2b7b9-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619959, "uuid": "6b0c1521-f57a-4431-94fa-27f4583d04f1", "comment": "Malware payload", "value": "6d744236e9dfd51bdcc0e501f5467eea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619959, "uuid": "830aefe7-f331-4323-812f-2a6a5d28b2d7", "comment": "Malware payload", "value": "0443e5dc7ead53bee96d962538c690dbed8b6301d772aa860daee7edf4e16823", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619959, "uuid": "23fb7b30-f3ad-433c-9539-6d9b49c27af2", "comment": "Malware payload", "value": "1ba1358f65a80e5d7004772d1910b29c58990949", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619959, "uuid": "f9ae13f1-fbfb-4505-979c-04b8c8774234", "comment": "Malware payload", "value": "1b2214015e1debab4621dd9c08fe93cafe6d80ff36c401a97c2a1e14d15148fe1b2051dac79a1936c41aee12311b623c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619959, "uuid": "877c0543-2e4d-47f9-9864-e565875afd50", "value": "4C83021413B94A5EB8CE8E296CE31E4F2B9AB8F4192B54D1794D04E1F2334660F28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619959, "uuid": "f12fada5-4779-463e-8fc3-fa21840f0fa9", "value": "1536:rDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wl:rDAysJADlV378P3RPVJLdP8BXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619959, "uuid": "f54704fc-ed84-4b5e-9a80-b33c7c822dfc", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619959, "uuid": "c3c93686-d91a-4a50-a625-602bf5d8bfe8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619959, "uuid": "37855ceb-b647-4f73-aa8a-b74d0511782b", "value": "catalog-1647126699.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4dda7d-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626783, "uuid": "95e67a80-ffba-45a0-aba0-acbc8f1d0b5f", "comment": "Malware payload", "value": "915ab0a1e76b1ac935d1d65c0f0d4954", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626783, "uuid": "3b829781-7693-4756-99f5-04a42f99fc31", "comment": "Malware payload", "value": "045ae10cd64c9f17bfdf65758001ce96e2aecf2cccb5fe7f45d08f778f86fc4b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626783, "uuid": "c041f5c5-486c-41e6-8782-bd2d99fdc20c", "comment": "Malware payload", "value": "ac8a40d7d4eca2f3f851d4c1c3e1daf4a77b2d14", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626783, "uuid": "808efb99-a02b-4f3f-9661-2c504d48c1dc", "comment": "Malware payload", "value": "2019d87353fbcbab30882b72ecb658da91d057d8eefc2a9ce7a7067633b6014a7718c46295c1501c7b064dbceeb6287a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626783, "uuid": "76684b40-27c1-4926-bc10-60de518a2931", "value": "2583021403FA9959F48E9E3DACE20DCB3F8AFAF43D0A58E1962E046573298510B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626783, "uuid": "1a502d5e-f294-4a89-8039-a087237e682d", "value": "1536:WDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wBUhT:WDAysJADlV378P3RPVJLd+eh8wBQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626783, "uuid": "f8a85031-3843-4900-9bb2-a494e3db4230", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626783, "uuid": "9c36b01e-373b-4b31-80ac-ba3a402d2a45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626783, "uuid": "3fea55d2-a6e8-4019-ab87-abc7686c474d", "value": "statistic-510999471.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c284ce19-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623441, "uuid": "59d68ef3-a6a0-40f2-85a3-0cd8e1f2cf27", "comment": "Malware payload", "value": "ddf59fdc1269fd3fe6c65d4fd0f35f1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623441, "uuid": "ca84b6b9-72e6-4f3d-85ef-8ddc24c92aff", "comment": "Malware payload", "value": "048970aa90f84fee10fa7c1f10d5136b408b6fea8c05433f86c7042afc990df6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623441, "uuid": "26ded873-6efc-4911-805d-aaebe7158bff", "comment": "Malware payload", "value": "ba135c2fda221b63e058c7b31d60801f2a49f182", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623441, "uuid": "3086c688-9c94-49a4-a239-c999c128a389", "comment": "Malware payload", "value": "7b76f606b5e5f4b6cb1e4968f1ba3f1fdcf8423cad7d054e527cc22f9eed16504f44d2f14d78b27a189ec957a665c48f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623441, "uuid": "127335df-4f67-4882-a012-9f024d079728", "value": "83831288673DD3CF797E3D0A62E9883F790EE8781148345DE4C06B6A9D09BE74D47960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623441, "uuid": "98ad7035-ab71-4dde-aad8-a547aeec73bc", "value": "1536:bG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttT6RuoKryI8NlRu+dUXA:bGEhrHJoEsBMG7qzkYNI8Nl4+dUxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623441, "uuid": "dce479a7-e3fd-4671-ac03-9874009d01cb", "value": 86095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623441, "uuid": "26d87f62-3971-48e8-b1e7-d9648a4b3bd4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623441, "uuid": "14636e4e-881e-421b-a041-207a8b898670", "value": "diagram-2087566452.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8bf45f-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646867, "uuid": "2c07ec78-944e-49a9-97ea-93016ee43c77", "comment": "Malware payload (Dridex)", "value": "28824da90f9d98dfd3ab0d93f5c08c90", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646867, "uuid": "d1d06390-c71f-49d5-98df-d7eedb0314b4", "comment": "Malware payload (Dridex)", "value": "048ee4788a10232105ddfd4b9ce2f0ee1b53196a0fb69fff8725abdb4099809e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646867, "uuid": "f350c5cc-75fd-420c-a190-f0fe6af2c82f", "comment": "Malware payload (Dridex)", "value": "8f81f48dc7d301f6da6ab5875cb195720f3d2a7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646867, "uuid": "3c9af37d-7776-429e-b93e-c74d15cd733b", "comment": "Malware payload (Dridex)", "value": "e4e85cdcb741d0c31b0f499689389da8f4e0f5168e9d66dca85423684e032a85ba24b78cbb68233ef1a1066bf1e7aa74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646867, "uuid": "799f97a2-2e5b-4f41-b122-2a1aee62dfbc", "value": "1DF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646867, "uuid": "2460a043-c1dd-4775-abf3-2c9c615526e6", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646867, "uuid": "d2238d98-9a0b-4710-9824-59c128e9d4fc", "value": "3072:ioSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2aGkFY:JnS62Fl+pkeJl3CvRStrFl+EYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646867, "uuid": "aff5b81b-da3a-4ff5-844d-b9e8bc0ab7cf", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646867, "uuid": "1ff9ab79-51ec-435c-b755-7c626f7e6220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646867, "uuid": "107b0794-8c64-436c-8f18-693d12c7bcd8", "value": "28824da9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1dad8f-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620264, "uuid": "d9a5b30f-e385-4029-bdbd-ddcedfa0a12b", "comment": "Malware payload", "value": "831c6444ee357d7dba459bdcce04a43b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620264, "uuid": "98cd4463-7f0b-4506-8d57-511179b7d41d", "comment": "Malware payload", "value": "04b25afc484c6cb63dd5b6ec2594b844c4ec0c38c6a86a5855b4c193f930e813", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620264, "uuid": "d1244d46-3490-4bca-9ece-6cad615e5f1b", "comment": "Malware payload", "value": "a78bce20779d5bd58816540c4569b5ff307de47a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620264, "uuid": "bfa2d993-8971-4533-bca5-92ac696c8a71", "comment": "Malware payload", "value": "8ab85f8e21c4d5d734e128e2d8ac40078a843bf82951d178d22aea7f9302fb1540d72baf6fbd81f17a0f589e4a17071b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620264, "uuid": "147eee46-6cc9-47bf-890a-f9fa4e6a6fcc", "value": "0C830214237A064CB4DDDF2A5C731DC76F56BCB82519A8F6906D0098FA338526B2C97F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620264, "uuid": "993afcc4-885c-4cdf-87fe-3606cc929d50", "value": "1536:MDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsR1EPCO0iAC:MDAysJADlV378P3RPVJLd8EP90iAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620264, "uuid": "eaeb0903-c672-4dec-9367-5add8b2e2c69", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620264, "uuid": "f5677b7c-baa3-4da5-ab83-694de01c9340", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620264, "uuid": "6f798ab4-75bf-4d65-86d8-057f0834a152", "value": "catalog-1878578466.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92b0934-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620392, "uuid": "e2c67f9e-fe0d-4deb-aad3-6ae70bcd9f42", "comment": "Malware payload", "value": "fc13e2579e31ee6483e670ddf5d8c31b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620392, "uuid": "e7f472ad-f9aa-4bcf-bc37-9e3c8695bf59", "comment": "Malware payload", "value": "04c1a965a137a84f31883afa2e3b65dbf5a8d8e9525f65563963f256bd2e2513", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620392, "uuid": "3a61dd77-1fa0-4c3f-a9cf-79a3504f2152", "comment": "Malware payload", "value": "5d74cdc171ac1aad167250c452b52b2e554bc3a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620392, "uuid": "4df14618-c6d8-4545-ad44-b9e2ddd7e0c7", "comment": "Malware payload", "value": "ef307be4e947b7d090634583efea699a67452ff7968ed006e398f997b04d0792d566bfc8193c3aed37487f3b5f4a3a9c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620392, "uuid": "9d9a5443-286f-4f3c-9acf-7403a89fe05b", "value": "1883027043EA4F4D74CE8A3A5CF21DCFAB6AF5B43A1D48B0566E0451D227C962B2853F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620392, "uuid": "f37c76e3-56ad-4291-83b5-97668ad3d709", "value": "1536:rDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiE58VP0IsOzCy2BXcEnvCC:rDAysJADlV378P3RPVJLdd58VnCy2BXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620392, "uuid": "ed809f4d-d9c6-4cf2-942b-68433e0c4d91", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620392, "uuid": "239cf4f0-474d-4340-b616-983183dbe050", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620392, "uuid": "dc413817-5855-4ca5-9f41-485c347e480b", "value": "catalog-1980218348.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99012c34-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624230, "uuid": "6b435e63-83ff-42dd-8440-31d661aaa969", "comment": "Malware payload", "value": "998d7f69f98d5894301af398103de9aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624230, "uuid": "7a155fb7-52a0-408d-91a3-a8f43c42bbf3", "comment": "Malware payload", "value": "04d0de155bb016eb538a729178e5f3c043acd56e8a48790a0a47a299d2d5f99c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624230, "uuid": "c06ef19b-b07a-457c-bc69-20f2047d0722", "comment": "Malware payload", "value": "06969cc0bb707274092ea11a64e7530aa12dc5a8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624230, "uuid": "69755132-f7aa-4080-872c-5c75c1a5c1b2", "comment": "Malware payload", "value": "aeef1b137cdd2c5d6393c1117888810f6ebde07ad238edc121230ec2e86cd804cf5e6a714a8bf19d6b8bd410a2196ea9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624230, "uuid": "f304e2b2-94c0-4e81-a631-cde9a4a080eb", "value": "9B8302CC353DC9DF7AFA2E0951DC847E740EE8B42104154EE8C86AAB9D8BFE71857560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624230, "uuid": "b38e2a45-bcf0-4167-aabe-6a4f56934e74", "value": "1536:YG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttgKkApVr6wo+Rx5:YGEhrHJoEsBMG7qzk6xApxT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624230, "uuid": "27efcd48-7e74-4fdc-ac84-d50609c2fa03", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624230, "uuid": "d3d9dbf6-036c-4d7e-9285-31b40bb8eb99", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624230, "uuid": "abf7af0d-0293-4f3b-ba64-e0f46f3c745c", "value": "diagram-625921466.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c309e0-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620062, "uuid": "ae80820d-d09c-4f44-8aad-7a437eb31d50", "comment": "Malware payload", "value": "890b391f8c6c5504b5a457006081877c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620062, "uuid": "12f6bdcf-8ce6-4007-8822-cc4f4ba75d0a", "comment": "Malware payload", "value": "04eb0bd68108ab20182c85af31096dd368a3cf5786971784d0d8a07f14c6f998", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620062, "uuid": "19c8eca0-ef5c-4a5d-b67a-27cad35c3952", "comment": "Malware payload", "value": "b28212c4faa891dcd54e56034827ee4fcf8fa228", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620062, "uuid": "469e2ba9-0d04-4e10-8209-8a4dbac21f33", "comment": "Malware payload", "value": "86f6cf58404c476cfe24b8165f172603cc546fd305fbc7bd5b602f9dedb71998a0035d3ad6ea2df3c9e5a4051704e264", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620062, "uuid": "416e882f-5d6a-4d42-a634-3c9e067c8589", "value": "B583121013B54E5CB8CE9F295CE20ACF2FA7F9B4260D68F571290894E726C574B2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620062, "uuid": "b70c8a9a-01d0-4fae-a4ba-b23dcfcadc83", "value": "1536:SDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJniv:SDAysJADlV378P3RPVJLdYDpH+jAJnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620062, "uuid": "d850c636-56b2-48bd-95c1-cf14521a0234", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620062, "uuid": "ee4a2ea2-1189-4910-8b3f-11d344a6bb59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620062, "uuid": "acad64c1-4625-44f0-9ee5-1b66fe338c3f", "value": "catalog-173919256.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ef27bd-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622566, "uuid": "90348e33-4483-4570-af3f-c173b6f50e3e", "comment": "Malware payload", "value": "e12ad8778ae7d8de22092909df38f1a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622566, "uuid": "f677416c-1fec-42c7-a33e-ac227d045838", "comment": "Malware payload", "value": "05057b1ea86fa5bdc12561b6d011cf0fc1bf7891410d23cacd4f21caf6627459", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622566, "uuid": "d8afe6f2-d504-409a-bf35-e3e6ae66fd3f", "comment": "Malware payload", "value": "86546f6549304bff1b137dbf5c152f31b7aaef3a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622566, "uuid": "2d5b128c-5914-49f4-b852-28ee66756ecc", "comment": "Malware payload", "value": "55acd37f8896e44a7a50450f9c121fd46e0bc6150755cc1716f7884abc6f03a6d2374e474076de3664c52c8789347c5c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622566, "uuid": "195639c8-8791-4d20-ade1-ff8cc03a9bed", "value": "7D83028C613DC6EFB1AD2F09A3DDC47F751EFC623044248EC8C966A65D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622566, "uuid": "0adf854a-fcb0-4670-9ff2-a5b259693112", "value": "1536:lG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttPe6n6475e0NEnP6S:lGEhrHJoEsBMG7qzk54q/NEn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622566, "uuid": "7aaf3882-1543-4a89-a260-284ec2c2ce9e", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622566, "uuid": "259e05c5-33a2-498b-8297-bc1d9c9f70fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622566, "uuid": "57381927-734e-49fb-a3f2-3e2cbbc81994", "value": "diagram-1465782191.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0a3cb2-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622247, "uuid": "6c0476f4-5680-43ef-912b-a2cf0832d243", "comment": "Malware payload", "value": "a96372ddb3ba75f3f689a9ba5db4fc76", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622247, "uuid": "5cd46f79-8d7b-4671-8dce-5cefbc7d34ea", "comment": "Malware payload", "value": "0511efc0e2bbcc6a1016482276ae3f27487fd2d8e4b5409d6a1f8508732de603", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622247, "uuid": "1cdfbf9e-2eee-4ec9-8304-b59f0112526b", "comment": "Malware payload", "value": "0b36b64da7c01276e42aebf3e74c8f1b63f89155", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622247, "uuid": "9f5a1feb-f9ac-48e7-adb5-5c13f87844db", "comment": "Malware payload", "value": "badd0613b0f9a87a7c8010090d0e4b82e5785a9332f864edcb22c66de526ad0943d48de2c417d501d755edf20fff8a28", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622247, "uuid": "40db96a4-66ce-42b2-bd28-ac5a0e2e9f56", "value": "128302887A39C9DF37BE1E08B6DD887FB509E5783804358DC4C47A5F9C4AAEB085B160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622247, "uuid": "a27993be-615a-40e7-b546-9e0801673b87", "value": "1536:FG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttyds/rjLOq6afsc:FGEhrHJoEsBMG7qzkT/rjLOBfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622247, "uuid": "3e228913-f929-40ff-8d62-839df56601e5", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622247, "uuid": "b4f789ad-21e5-4b02-903a-8283d07c96d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622247, "uuid": "df3f55a6-21e2-411a-81ec-8b32144e6d8f", "value": "diagram-1246332094.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ba33e8-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624513, "uuid": "1474a00d-ded4-4bc6-98e3-5f7a24c06fcf", "comment": "Malware payload", "value": "151e06c76010f4288f1e9bf23cfd7de0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624513, "uuid": "39f9fa20-241c-44de-b476-7bad5e8cb123", "comment": "Malware payload", "value": "0520973e128195bf569c3dbdc41bed10e9fbea50500e6619c7f83d0cb4aff604", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624513, "uuid": "df986a22-7fb7-413f-8905-377a2d8216aa", "comment": "Malware payload", "value": "01b8804b2529f080fa9c249b49295a1bf15a393c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624513, "uuid": "3721aa62-9f4c-4192-aef5-cbbc2b38b08a", "comment": "Malware payload", "value": "998d0049e8f83e8b484f1f42b44328868bd4d197e44a4ea520092f4d7aca0c4f4401138c2eec44c64950b4828ebbdd46", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624513, "uuid": "288f3a2a-edba-47ad-bd7e-37e5dcb6f096", "value": "6383028C653DCADFB1AD2F09A3DDC53FB61EFC612044248DD8C466A65D48AD30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624513, "uuid": "72faf794-55a9-47e2-9975-7756dc71718d", "value": "1536:PG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttje6n6475e0NEnP6h:PGEhrHJoEsBMG7qzk94q/NEnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624513, "uuid": "98620cc4-c102-4f6a-a623-3025d448ca73", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624513, "uuid": "e950e30f-845c-4e3f-b59f-77454fd2b29d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624513, "uuid": "a68c1ed3-627e-44dd-a410-20b7e8cc1d60", "value": "diagram-81095815.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd00adc-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619626279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626279, "uuid": "0e462dc5-6e4c-4eb1-9a5f-6f1489187947", "comment": "Malware payload (RedLineStealer)", "value": "b304a31244e99cc5ef05b19ee446e5c1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626279, "uuid": "cb7b1d23-96d6-4c4c-a878-029f2836ef1b", "comment": "Malware payload (RedLineStealer)", "value": "05271d858a38fedd7b6bab5badedbe292010dfc1802aa09fb80b4cf301615bb8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626279, "uuid": "17680f9b-bb95-44db-9ccb-efd03c103ed1", "comment": "Malware payload (RedLineStealer)", "value": "79d2f34c3ba793b708ad6e7e53a487fcf47cc36b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626279, "uuid": "096ff313-5fe1-45ea-8f20-02548b65f3c3", "comment": "Malware payload (RedLineStealer)", "value": "5ae86767e52e2b873ebe789c0e72f789eb81a7a8494b7f79298bbad14ed123f7882c0c2b554f7e72b3b01b62d808a7f1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626279, "uuid": "25ad6c64-2c9e-4778-822a-8e7ea979735f", "value": "1E952336A1C10176D4622E71495A8636F47BBA400A7891DFFEDD0E1CDF333185B3A3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626279, "uuid": "25c8820e-1bef-4620-b501-7820314a42e4", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626279, "uuid": "b15d066e-2d54-4289-b809-e66d2478e589", "value": "49152:pAI+ktQowyQ+0HAIHbjStAl+wZ1Bpg1pljq+ahfs16pZWLt5Qly6O:pAI+kby9JjStAl+wZ1B0ljNI063WLt5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626279, "uuid": "77507bea-2fbe-4d4b-8013-f9ee6941137c", "value": 2030225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626279, "uuid": "68a251e4-6173-4904-b8a2-d1dc35e8d648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626279, "uuid": "3e065a9b-0806-4585-9277-52fc2f7fbcb2", "value": "b304a312_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a11ab9-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639420, "uuid": "4f574780-605b-4b40-83d1-02802dbe9bad", "comment": "Malware payload (Dridex)", "value": "cc4e903182a5ace09562183b9797722a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639420, "uuid": "19752e77-111a-4ab2-9e6a-42d2369e8942", "comment": "Malware payload (Dridex)", "value": "05280394fa8915eb2401ef91c5da8a857539dfb2d771f009654a2ee3777d6f26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639420, "uuid": "87fc3fa6-1d63-47b6-a226-f62d816b680a", "comment": "Malware payload (Dridex)", "value": "076115d6989349244eb15e5d44127bc5f81a85b8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639420, "uuid": "97c8dc2e-9803-4e7f-a373-95b3d29e4a1e", "comment": "Malware payload (Dridex)", "value": "d65c2c518a2ba8f3ed712b522bbb19469d4c01a1ee1f6af408dbb534ae93ddd0eaab6a6a7ac70b959418e5f6248d9ddb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639420, "uuid": "644c0351-68f9-4b88-8f0a-ea7527702d75", "value": "BBF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639420, "uuid": "9c6d4d10-d2e3-48bc-849c-f339641eb1b5", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639420, "uuid": "ca2fb7fd-1a34-4105-a846-bd623432fc12", "value": "3072:EmT2d85tleLD51fC5AHYEoefukoTFMpGmjp8D:Uy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639420, "uuid": "131e1c10-6f1a-4922-a402-5aabb7264bb6", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639420, "uuid": "717443d2-a3da-4269-8f55-17f114bdaf1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639420, "uuid": "f7e058f0-b8b3-41bb-a79b-a3ffa80b24a5", "value": "cc4e9031_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44728f1-a7dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619585729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619585729, "uuid": "22dc5c4e-e2cb-4207-b39f-e41e1bda8e17", "comment": "Malware payload (Loki)", "value": "1bbf03971615e8def4d9da920dfd624c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619585729, "uuid": "1de84d5e-eb8c-4f71-a63e-6c14902088f9", "comment": "Malware payload (Loki)", "value": "054973441906710acdd682629e21c1747ac37c0da24fda0f2ed860d4b1fe0bab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619585729, "uuid": "4a96ba65-6810-4c4a-907b-d3651b22a849", "comment": "Malware payload (Loki)", "value": "f7c8f1481d2a2be699b129df12c0fcf261d5325c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619585729, "uuid": "21be1fc8-8f86-4591-863e-1a703ea2dcdc", "comment": "Malware payload (Loki)", "value": "8f4b722718131cddb7045ca443d8ad27adafb5bd98a71373f91e30ef0ca532b3d777bf9a7ebc67eafe5d2f76681f7218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619585729, "uuid": "572a191f-b3c3-407f-af4d-b97071773200", "value": "3115AD8F58E4D9D7D2A256BC28B7B52103B32DC28A05DED93B187249337FA5E443660F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619585729, "uuid": "343b07e9-1a2e-44b9-833e-0a12f1d28a8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619585729, "uuid": "26d22add-2b09-4031-8cdd-fe3062f04dfe", "value": "12288:R/nXzTv/1V7Q38Zyw9iJQWY9iJQW79iJQWxLqtq1q6d+DES2+EwJHp6dKDarvY4I:H9iJbaiJbxiJbxtS2+PMtidB5iJbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619585729, "uuid": "f431a122-7ea1-4c0b-bd19-4174294cdcd7", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619585729, "uuid": "0b8caed8-108e-4d74-941a-8edd1fec9924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619585729, "uuid": "fb3cc304-76ef-43b5-9c89-da6648b63e28", "value": "DHL ReceiptAWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cbaf67-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626929, "uuid": "398d3c37-8310-44a7-b0dc-6021f155d6bd", "comment": "Malware payload", "value": "b3a14055cceb85b83fa7e00d39730072", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626929, "uuid": "f7b8e978-3913-42da-805f-72e05f9c8b3e", "comment": "Malware payload", "value": "054e8f7136cee2a3ed6a60bc07e763bb57f6ad74b6021ccfdcdb3250fa6b6964", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626929, "uuid": "230cbb3a-49f2-4d4a-9193-aa57ed4688ab", "comment": "Malware payload", "value": "43244e3bb4028113355e2646d311ca967aae1f4f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626929, "uuid": "0d38ffec-cbbe-405a-8981-d2c161c28edd", "comment": "Malware payload", "value": "3fc507e8e88f8be11cfc5b27b057a7d18abd363919fed25d618e9b73022b446fc241412fbf6fc78e9df234171cb0b21d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626929, "uuid": "97106489-740b-430e-a32e-ad366f670228", "value": "3E8302A453BE4A5DB94D4E2CACA20D4F3F67B674390E68F1B92D0481A235C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626929, "uuid": "cf856678-65c0-4009-994a-a6eea2188057", "value": "1536:vDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmTW:vDAysJADlV378P3RPVJLdBxpEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626929, "uuid": "31414621-65d9-440e-a1a1-69a927187029", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626929, "uuid": "523e8c07-05d4-4d5f-a2f2-4f8469141b87", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626929, "uuid": "3962c4e4-550e-4207-854d-3280ce8cbe26", "value": "statistic-606830328.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8aca567-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620821, "uuid": "50cb6acd-a7ac-4092-bc44-2ddc36c6f41a", "comment": "Malware payload", "value": "5af63b783bae595902e4f338a26f5594", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620821, "uuid": "bf72801b-301c-421f-be59-2d3cd1b327db", "comment": "Malware payload", "value": "0553f6fc56290403be77ff1e0f7974c42e7e18581c627b2e61b108f59a4eec7a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620821, "uuid": "4aed7d00-6cfe-458b-b569-e68d5f19fbda", "comment": "Malware payload", "value": "5ca1df89013a5897a4455927f9cecc2b88919b63", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620821, "uuid": "0ff91a76-d998-44d0-9990-69f253b170e1", "comment": "Malware payload", "value": "a2e90150d2be74b266988b1c8a9435eb90fda5678c443b152a4df55d30db30bee3cadc60923ce6b1c811dcf24bb06b5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620821, "uuid": "6ac96c4c-0072-4bce-95bc-a99fe728cd7f", "value": "FB83027103AE4B5DB4CE9A3958D22DCF2F86F8B42D195892512904E4E32BC519F38D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620821, "uuid": "ce7aa4a2-97c8-41d6-a1d1-8d04e1ad3798", "value": "1536:aDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRm:aDAysJADlV378P3RPVJLdcDsMU0dRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620821, "uuid": "76dc122d-7545-4a81-ab7f-307f904518d0", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620821, "uuid": "fbc115df-a014-45fe-bcb9-27d29c3eaf8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620821, "uuid": "d8cd0f4d-2100-4d65-bf67-9738c4b4f006", "value": "catalog-214095401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33505e3-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640622, "uuid": "775928c9-c3ec-4140-bd70-32da76a55643", "comment": "Malware payload (Quakbot)", "value": "631a089681b6ff0b5f0514e08a6f52e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640622, "uuid": "5cb914dd-a879-40ef-a9a7-0b265094883f", "comment": "Malware payload (Quakbot)", "value": "057415d29f5ee2c8f136e629aca11f1bd5c1ac6f47d26c40e7f058daa3a47e2b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640622, "uuid": "42eb244d-8d1a-4dd6-9a48-c96d20ba8bbb", "comment": "Malware payload (Quakbot)", "value": "a3e8bea27ef30fbe420f23c34f2c5328080d92f1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640622, "uuid": "9010c389-150c-4b35-8026-997db2414ac6", "comment": "Malware payload (Quakbot)", "value": "a2c3b1f304280553bc060d3110b68f2431c931cc1620a6d8c637f98c9ece2e0f8d37df72e1711d260749a5344c85955f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640622, "uuid": "413a8133-21da-4bac-b73a-90de54fb6edb", "value": "33949E7A6716D162D2BC23B143C3DF580E17D6E53238444612B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640622, "uuid": "778b7c1d-3d80-4378-b013-0dfa1aecdde4", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640622, "uuid": "30dafcef-f5f1-4db6-aef1-543d5ffac29c", "value": "6144:6VWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWrah:TFNmLKSVpJbPT+4xrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640622, "uuid": "eae5933b-5f7e-408e-ad81-eb97be339a40", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640622, "uuid": "0ff9859f-5a23-4ff4-ae65-4822bbd3c31e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640622, "uuid": "116845a1-b0a8-400c-b42c-fc6409e19356", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142e9e8b-a7e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619589648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589648, "uuid": "c275e3bf-3117-476a-8dca-fc72085e7c69", "comment": "Malware payload (Dridex)", "value": "82649a8b4a166d2d352ac9f8cbb193f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589648, "uuid": "fe0e12e2-3315-4eae-ba1b-4fb1ca696675", "comment": "Malware payload (Dridex)", "value": "057accbad1fca3a8fdb4fb7080ec7c63c915590e84d27fa9842629cfb7eaec0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589648, "uuid": "4a62991b-e45d-47c1-8f41-c16e017b92cf", "comment": "Malware payload (Dridex)", "value": "8a2673e4e7ec5df1983bef48cf902d735abcd299", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589648, "uuid": "1c955b70-2d7c-42ef-97ee-69ba6618131a", "comment": "Malware payload (Dridex)", "value": "4c2c45964dfc62d972c4c4dc99a4d65713f287917ed26861bc32278aa81ab3e2dbdc67b073f445342551ac56fc66f453", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589648, "uuid": "478b9f40-2f43-48c2-a22a-f3a8087ae87e", "value": "FBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589648, "uuid": "43baeef0-fe15-4738-9d10-006d977ed109", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589648, "uuid": "623915de-047b-48a4-95c4-390d778588e9", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619589648, "uuid": "5e276854-687a-49d0-b63f-f208f33c4b5f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619589648, "uuid": "c31be6aa-13ca-4ad6-a7ea-7e0a92904403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589648, "uuid": "85c5765d-9209-4779-bf85-394229e28faa", "value": "82649a8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d181693-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622036, "uuid": "96e41c8b-3357-4b17-b883-739a8b2c2652", "comment": "Malware payload", "value": "8d75a5f34c522fae4eeafe4403a08414", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622036, "uuid": "5f07605a-0af4-42e4-bc8f-861128d5e46a", "comment": "Malware payload", "value": "057b5a1c5378b437c31efc663dbf62576e6d99474430681678df0b53a29124e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622036, "uuid": "fdb50247-e05d-480c-8cfe-36a90ddc97ac", "comment": "Malware payload", "value": "9143a1dec2f88e2b8c08535753b4c6d727ffea52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622036, "uuid": "8a44a184-3f2a-4917-8750-b7c2f7b59915", "comment": "Malware payload", "value": "3a76dc993d7da0cd0487f73bb440d93a0d7b5628a859c56134a16a17857fb2e9cd92ee795b964de8982a9fe9c85f33eb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622036, "uuid": "2f67b718-1482-4633-be55-de616a39ae60", "value": "D18302CC6239C9DF717D3E4AA6D8C43A7D0E98B93040389DE4C066AF5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622036, "uuid": "475035e8-c1bd-4e86-b07e-474b8fae126e", "value": "1536:5G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGrc:5GEhrHJoEsBMG7qzkEEVerrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622036, "uuid": "aee20217-d9f2-47e5-b79f-97f275db838c", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622036, "uuid": "63559d28-2e08-4480-b157-82746179a4f7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622036, "uuid": "9510aefb-4b5e-44d4-a273-7813a54c9f41", "value": "diagram-1083334387.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1524e6-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619917, "uuid": "1cdbefff-179f-4356-a99d-2b73790a8278", "comment": "Malware payload", "value": "efb8c48e9542c236427865f42e380f92", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619917, "uuid": "43180e0d-f357-48b5-a997-6c338ce1d13d", "comment": "Malware payload", "value": "057d0e266ff30e1d2b9f955cd70df44827b6deb639a9bbca06286397a7e20b36", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619917, "uuid": "1d71ef96-9999-4490-a3e7-fa88fe9eb1a3", "comment": "Malware payload", "value": "d8c77da6eaef39f185125c79cbb503992f2b7643", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619917, "uuid": "597147da-0721-45ca-a6e2-8b6abee0f164", "comment": "Malware payload", "value": "4a4ffd28a2d65b1b2307dce571e2df4b4ee235af64f14bc341fbeaa875616f0a604c594ce3199537b0019a14844fe35a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619917, "uuid": "5e19ca57-e706-4ca6-82be-083876ba5a1d", "value": "3683122013B74F0870CD8A3A98E21ECF7B6BF9B82D1E99F1556D0466E127C961B2447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619917, "uuid": "8ed79f06-bdf2-4496-b1ce-aa5ba89937b2", "value": "1536:nDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9cZ8VzpIsOKddk:nDAysJADlV378P3RPVJLdGZ8VdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619917, "uuid": "1e84ca15-f2f8-43c9-8791-4c1a13aad2ce", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619917, "uuid": "97b0008b-6e15-4188-a90f-22dcd6597cb7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619917, "uuid": "3404222b-60e2-4e89-bb4b-58096d0625e3", "value": "catalog-1628998203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee84c103-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625233, "uuid": "a739a757-0765-4d2b-8dc4-8bbd1cfd3205", "comment": "Malware payload", "value": "1381df253523d84e32c324995d0a45b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625233, "uuid": "7484658e-5846-4f2d-90eb-ab4fb436ff42", "comment": "Malware payload", "value": "05847cec1bc943043e1f5ab1e4adfab2ffea0a10e8c6e2c0e8c3d975601c4587", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625233, "uuid": "fe2a8dcb-bbbd-4ac2-95be-611570c42a95", "comment": "Malware payload", "value": "b897229b6277408e649093ae63e50ed41d490226", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625233, "uuid": "8a958ed1-1fd7-48d3-b0c1-a0abbba1a42f", "comment": "Malware payload", "value": "a3ec88e9d6fa1de335ca27b9f42f337706d226b60b77b42ea3f080b419d212d8b4ecc3b855066e87a412da21a37fd952", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625233, "uuid": "03273858-73b1-45ad-8481-90a909f893eb", "value": "2483025013BB8EADB58DC93948D20D8F2F56B6B02D5B5CF2B12D0494F5338961A3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625233, "uuid": "dfbb39d0-b3f8-4c7c-b607-cc85c8a1828e", "value": "1536:lDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7la:lDAysJADlV378P3RPVJLd47la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625233, "uuid": "0c2509c4-adde-4069-b823-c58f2a450773", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625233, "uuid": "10f1e0aa-6782-4f0c-8c13-f3590c60688a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625233, "uuid": "56adb820-0917-4a35-9ff6-7ba6a7eae46f", "value": "statistic-1321474570.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b44c996-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627133, "uuid": "c6d7fad5-6dbe-4970-8148-ec5b54ce27e0", "comment": "Malware payload", "value": "309bd39b01b0c4fa72a6d304dcbf1df9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627133, "uuid": "6d75ad64-e1ba-4915-bc11-d7e180f6ac9b", "comment": "Malware payload", "value": "05ab6b746bff8767fa860c04d51c7da8490200593d79e79aa15e8c161008c7b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627133, "uuid": "169d7150-9ab1-4efa-ab9a-806afd2781f1", "comment": "Malware payload", "value": "eb2fa2e1db0dd30d540c0425d67a6502b2f045b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627133, "uuid": "87653fa9-569f-4fe0-a546-3a0fe7093251", "comment": "Malware payload", "value": "8d4cc9e77c00dd64ea4cdab27fdd654fa3f1e8ba9ab93e7bcff679804178efee8008a8f5e2e2f8f41136261677d7c67f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627133, "uuid": "10f90ddf-83c7-40b6-9a01-58875f802ddd", "value": "9683021163B9C998F48D9E2D5CE30DCF7F46AA742C1ED9F1222D019AE227C960F2453A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627133, "uuid": "20d844a6-194f-4756-9671-d7f72aa45a62", "value": "1536:dDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2v:dDAysJADlV378P3RPVJLdCqXjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627133, "uuid": "ccdd982f-171a-4721-b76e-4acc0e3c4993", "value": 86108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627133, "uuid": "eb99a20e-f4a1-4432-8499-65c705954989", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627133, "uuid": "49ff41ce-1f57-439b-b2b2-27cd36b0b953", "value": "statistic-73404306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d97d17-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640625, "uuid": "1f9e4bfa-7f75-448e-8b1e-775f301ef95d", "comment": "Malware payload (Quakbot)", "value": "5064a16d1b14cbdc636334f355cd63b9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640625, "uuid": "c4ec7b95-3ba7-4b27-9c26-77ac14bf2a22", "comment": "Malware payload (Quakbot)", "value": "05d31d46cffc9305f09d9120eeb626d439dae9f1b012f2112d9301ffc54e9e02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640625, "uuid": "7f6c1e25-ea3f-494c-aaec-542a252b2a40", "comment": "Malware payload (Quakbot)", "value": "da0adc46817dd6e22aaaa906eea1f6082aa87da6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640625, "uuid": "f2d608fa-eb86-43fa-b511-fb0744882eba", "comment": "Malware payload (Quakbot)", "value": "148fa01885d39a89f1b2867b9c24bd2942bbe0ebd23e654705cc455008dfd428f39be1cb08c955fc0ce9d36be296bf18", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640625, "uuid": "938b0427-a31a-4bc9-8d24-6d472c94ecb4", "value": "B8948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640625, "uuid": "418e0104-0043-4d2b-8623-d9fb34414cc1", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640625, "uuid": "329b0688-d9d1-480e-871a-6fa90643dd1a", "value": "6144:1WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmN:1WrsTwr03pdf8vhhOKJETlByN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640625, "uuid": "ffd801bf-6ba3-4877-b429-0d3c7f84a299", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640625, "uuid": "3d203923-3e65-4980-9dca-8eef4893f991", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640625, "uuid": "c875dce8-2404-4b97-b0ad-8b511c05f11e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c697331f-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640628, "uuid": "6d135096-71af-496b-ad10-1375d5419ec9", "comment": "Malware payload (Quakbot)", "value": "364ce55443ad1913ec6329720079a2c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640628, "uuid": "73f94b03-efa6-4146-99f4-4ba3db64518f", "comment": "Malware payload (Quakbot)", "value": "05e1600f1be9849764d6a9ebc5f9168b5fb07958eed26139c1489e21738f27b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640628, "uuid": "ac6d7eb9-1395-4d9a-a380-2c72053da967", "comment": "Malware payload (Quakbot)", "value": "5394a6e00c9bfc08fb422f605791ca95ffade9ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640628, "uuid": "5c4ff3c2-d367-4b48-b14a-806584dd0442", "comment": "Malware payload (Quakbot)", "value": "0365673ec9c219c2929632e6971c02e8b72beae9f7d9a9ab2e8d54285f30706dca7c92b728a1f55625e50b386957fc8e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640628, "uuid": "bf917651-aa02-46e6-ae79-e968442120c1", "value": "41947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640628, "uuid": "40ac8b83-7078-44b3-b6f1-9d02cfaf250e", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640628, "uuid": "b0643aa6-43c8-49db-a7d2-2d3163cbc28a", "value": "6144:zyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmx:jTwr03pdf8vhhOKJET5Byx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640628, "uuid": "339a406e-ff96-48d9-abd5-c4415fdb6785", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640628, "uuid": "0029321a-f447-4d36-96d8-f4bf95c848df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640628, "uuid": "910127c3-09d2-4e85-bd7c-0c0e95a62a9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc0dc99-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624799, "uuid": "58ea9a1e-96a9-44bc-a1c2-788d9bf66c33", "comment": "Malware payload", "value": "4dc9bd292e56b11fc10de7d0e3ade385", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624799, "uuid": "d60e53bc-6259-47c3-a8ca-7b3e92d8fc0a", "comment": "Malware payload", "value": "05e31d70b9d1c0608921ba10687ea047fa3a7e3d0dfdead2ecfefed4b7b645ab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624799, "uuid": "866ecd6c-04f2-4abe-b31b-702210b4898a", "comment": "Malware payload", "value": "05b9d41ae53581a082aa451339869febb093a213", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624799, "uuid": "70463630-c65d-48ac-b7c2-cb61d26610ef", "comment": "Malware payload", "value": "78f8d79ef8909c5ca2adf608cbbb4d08b446b4d9e5277798949b7cb4aec1e041b27a99b1c6fc1619927b961f6accca58", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624799, "uuid": "6eb89680-99b9-4892-bcc2-d54be7761cbd", "value": "DD83025013BB8E6DB58DC93948D20DCF2F56B6B02D5B5CF2B12D0494F1338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624799, "uuid": "b7ff14aa-82de-4114-89d0-2754c8d0e3bc", "value": "1536:9DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7h0:9DAysJADlV378P3RPVJLdw7h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624799, "uuid": "39b31aa9-7032-4902-b021-0f712b313453", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624799, "uuid": "892d4e1c-5400-4829-9d5d-8a3aa9500a42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624799, "uuid": "935a9afd-53d4-4e98-84b8-74a8e5216d79", "value": "statistic-1019460903.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83e22e5-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627316, "uuid": "8c2f2975-8dc7-4243-936d-60f6dd27d3e4", "comment": "Malware payload", "value": "8c3b1f83963f9affaca87f2583fbd2a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627316, "uuid": "ebce3493-96c8-4339-be79-1b0ef2a9057f", "comment": "Malware payload", "value": "05eb49e2b3af63e2f221af23cc2aeab3bcc2a141989242ccd529b797fc887ac4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627316, "uuid": "7479bfc5-ebdb-495f-8790-d822b9622fef", "comment": "Malware payload", "value": "017b327fbe8047e7cef6db3033f68631f1c29d56", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627316, "uuid": "8a7ea3ec-787b-4d1a-bdf4-87945077b5f1", "comment": "Malware payload", "value": "d29e0ee61a5375ab2d747a7733346ab069ea50fe66d69668b07c1f920a8e08820c0e7b290ca64e3349c106d43be0d5d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627316, "uuid": "099dbdfa-e079-4992-8c51-4e298ae19baa", "value": "4583021823BE4958B58D8E2D88930ECF3B66F574281D58A2B55E00D9F227C965F34D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627316, "uuid": "f4f92dd2-5ead-4511-8946-635ea71790c3", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdA8eTrIarVAN3/B1eM24:DDAysJADlV378P3RPVJLdzau8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627316, "uuid": "462440ea-7fc3-4850-b6d1-2a91c4d381e3", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627316, "uuid": "9d4ee378-fa4f-45ff-a83d-2293ce168084", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627316, "uuid": "33c10218-9c76-4a02-8962-f8e1e63f6285", "value": "statistic-854780674.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92757d6f-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619924, "uuid": "2812df7f-7820-468a-ab25-dcd70626a848", "comment": "Malware payload", "value": "82e0ca78986489b810730fce2302f060", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619924, "uuid": "3e5c2517-8258-4c9b-bbb3-7e2fbefa3150", "comment": "Malware payload", "value": "06006d5ef4cd684dbeab6cc8636d2c37a33a61e046e9f35276e0ea9688cc229b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619924, "uuid": "270e374c-641d-458e-81d9-32c9d3cdf8b2", "comment": "Malware payload", "value": "93b8d46897f8d5f54f12f20dabc6ae4efc70786f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619924, "uuid": "7b718089-4c18-431a-95cb-63f0084b3d15", "comment": "Malware payload", "value": "0d5d59103cf4c69811e48752e7419c4b90d69d6fea7b1752feda957edcb183586ba860d0c34b8dc788e7d3d8ce3018f2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619924, "uuid": "088cb82d-4452-4814-b213-85f4b741935f", "value": "D883027103AE8B5DB4CE5A3958E21E8F2F86F8B42C195893551A04E4F32BC559B3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619924, "uuid": "a5ddc948-bfdd-4590-858c-20bb51d71b17", "value": "1536:RDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRZ:RDAysJADlV378P3RPVJLdcDsMU0dRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619924, "uuid": "744f677c-ed46-4daf-a05a-330114099147", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619924, "uuid": "b137db98-7393-4fbe-ba28-a27f251a27d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619924, "uuid": "ca4173a3-165f-490a-ab11-7d87f5fd39fa", "value": "catalog-1631226476.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010a989d-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1619620539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620539, "uuid": "66fc4d33-9d6b-462d-bcba-a3e79f149b2f", "comment": "Malware payload (Matiex)", "value": "0a719c4a0920d961681bb1bf298f20cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620539, "uuid": "d26fd6ff-3042-4476-bbf2-03e900a79ed6", "comment": "Malware payload (Matiex)", "value": "0604764a03045027ec114caed98816a2d684081dda0830cc6d6ab3398566e902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620539, "uuid": "96d4a1b3-6ec5-495c-87a2-41e6e5425934", "comment": "Malware payload (Matiex)", "value": "9ebc9284582661c4e3b71b75d77bb28559ff1617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620539, "uuid": "e2186f3f-4ef8-4d3b-b64c-1e30c995dba8", "comment": "Malware payload (Matiex)", "value": "f014305ce2d044deac5b648ad2bdddfc6af83102e2c5f53d42e9ed700926129b28057c0f78fae504d94a7c7ae1e46f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620539, "uuid": "8f573385-b8f2-446f-a695-3f36aa4e1c9e", "value": "F925CE8F2CA4DAD7C2A666BC20F7956203B32DC28A05DED9735C7289777FA6D4416203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620539, "uuid": "b9721143-c40b-4893-9986-a04f899d31f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620539, "uuid": "5e0327f0-5b8b-4ccf-b1fe-719538e2faf7", "value": "24576:2siJbaiJbxiJbCnOwPkSUWjeaPVdBniKbs:2siJWiJNiJ9wPUWjeaPVdBniK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620539, "uuid": "837f0e00-3437-4702-a047-db38cab233e3", "value": 984576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620539, "uuid": "6c61a416-6566-4e6f-8027-e941685657e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620539, "uuid": "b5f6d4ec-e7ae-4f94-a1a0-eb914fecb515", "value": "0a719c4a0920d961681bb1bf298f20cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c496c52-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620800, "uuid": "173ab18b-709c-4404-aeec-0da5748ac66d", "comment": "Malware payload", "value": "8225107100545f94c6666836ec206f0b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620800, "uuid": "65946fa3-8400-44ec-8b77-a4ab38e629ff", "comment": "Malware payload", "value": "0611dadb71e6d3864d13b0f23b148795fa8ce99732a3f1f69060e5d478ff67af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620800, "uuid": "a1b58b30-2771-41dd-a6a4-47f720ed7d2e", "comment": "Malware payload", "value": "afc40e22ef70100e8eec1d74eb7a34c024d5090f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620800, "uuid": "a455b283-7061-4ee7-943e-28c3040c94d9", "comment": "Malware payload", "value": "6261ace4080c1e350de4ac94d0c4a8716a756cc6239b07e43cd2850fa0d636f4f48e4531ef400025e2741a3a0b969d96", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620800, "uuid": "55a3c39f-982b-439c-b249-b205e3884f9c", "value": "6F83021113B54A4CB9CE9F2958E21ACF2FA7F9B4160D69F571280894E722C074B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620800, "uuid": "94a28413-f573-4d51-a010-8d88ec28732a", "value": "1536:NDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJi7:NDAysJADlV378P3RPVJLdlDpH+jAJi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620800, "uuid": "086fcfd5-bf49-4b8b-b6be-0467be5e87c1", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620800, "uuid": "0aa9e916-0b27-45bd-a55e-79293777dcb2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620800, "uuid": "ee358291-56c3-422b-93d1-e3b67db57786", "value": "catalog-2134650087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228303a3-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620596, "uuid": "19ee9c3c-6e2c-44ba-a309-f608e0904261", "comment": "Malware payload", "value": "a807acc24803de21ddc7e36b6776fa92", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620596, "uuid": "e0066bbc-50f5-4133-89a9-78c23b7050aa", "comment": "Malware payload", "value": "0616e2e8341c4586239ec5623314e4b8c88ff701a3ef41a95e662eb8373fc20c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620596, "uuid": "3f85e792-3cb1-449a-b1f4-0aa1dac26815", "comment": "Malware payload", "value": "4e69d404451aa08732f391c93a0b08b9ea9c8419", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620596, "uuid": "4525a369-5b72-4285-ad64-f37bfd4734e8", "comment": "Malware payload", "value": "3bcb9465480f6656a000c3c0f4fb3affe607e1d5dfbaf7de529790b8ae47dfb272d0411c5bb163ad674033ef5e251441", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620596, "uuid": "80281fa8-8428-4bae-bfe4-8640d3271b05", "value": "AF83021013B54A4CB9CE9F2D5CE21ACF2FA7F9B4260968F575280894E722C574B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620596, "uuid": "e112344d-153b-4787-9920-a0b80d233207", "value": "1536:MDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJaH:MDAysJADlV378P3RPVJLdlDpH+jAJaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620596, "uuid": "9ee3f4cf-a1f4-42f8-9c24-46c23e48046d", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620596, "uuid": "f038d298-61a6-4b83-8f0a-2b6ca02922e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620596, "uuid": "c76be410-43c8-47c3-8dc8-0e6f24e73a82", "value": "catalog-2016226614.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f3ede9-a861-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619642338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642338, "uuid": "22b5f9dc-796b-4057-ad01-d46cc825211f", "comment": "Malware payload (Dridex)", "value": "cc07b4f9e85628ec6346ff0a1f56f78c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642338, "uuid": "441e260d-45f4-4f29-95be-195419d2373f", "comment": "Malware payload (Dridex)", "value": "0658534d991f0764303a4562b5fb9f1def25592d631ed7df97e6a54649102585", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642338, "uuid": "653433db-4974-4645-99b9-2c3554ba0ca3", "comment": "Malware payload (Dridex)", "value": "db56fb4bbc5a55b28fb12c96dbdbfec21d33bb01", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642338, "uuid": "7b33d7a3-b486-40a4-aa8d-5ee2b1d1a277", "comment": "Malware payload (Dridex)", "value": "c6f93a6a1a9f38855ba77f5a979c5cf2652712009a3b6da2de896f61577acb1d1790aa021e8d7d6220444860a4f6bd0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642338, "uuid": "9ea06357-0039-4a86-8f9e-c24d88986072", "value": "CCF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642338, "uuid": "21823a9b-c7fd-444b-a5a8-49481497b5d7", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642338, "uuid": "f934806d-7eb6-446d-b449-9e15e8278705", "value": "3072:APSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd27GkFY:8nS62Fl+pkeJl3CvRStrFl+EYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619642338, "uuid": "57ccaebe-7342-4b3a-8654-5d13174c2b8a", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619642338, "uuid": "72273aa4-8855-4cf6-a316-8bc8b2a7d0e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642338, "uuid": "06e0be71-e22a-4603-8113-13922b8a22cc", "value": "cc07b4f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd80ce95-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619997, "uuid": "3f4c7d38-08b7-46f5-9c24-cc172cc53598", "comment": "Malware payload", "value": "395c7a0e19cb16721694e8b2b0b62930", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619997, "uuid": "424e1301-e6ff-4d19-a82b-55f03d03ec13", "comment": "Malware payload", "value": "065c55c5ac78ec072fda02e213be48bc89586406a7e5ea5bf406e33122fd9b86", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619997, "uuid": "4a400b88-1377-451b-85a9-1c50e33050a7", "comment": "Malware payload", "value": "f3c22b05d6bfc83580baaa9e12485492576c1abc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619997, "uuid": "fe3c2140-9587-491f-bd0d-1a2ce478a59e", "comment": "Malware payload", "value": "6371aa737944f30b745fdc2bd6715ac57edc4158cb9262e27096ca6c0d7b1f6c442826caa872fb39868201c83e353751", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619997, "uuid": "30c257ca-3c02-4252-a917-4ba4b83c67cd", "value": "D383121013F68F4874CE8F2D9CE20ECF3F57F9B9291DA6B1612904A9E625C560B2057F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619997, "uuid": "5973a186-c47d-4882-bbed-025c537f1fd6", "value": "1536:tDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdVDpEDP9+jAJu9:tDAysJADlV378P3RPVJLdVDps+jAJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619997, "uuid": "595a172d-d3c4-41b2-bbea-69220bc41267", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619997, "uuid": "b217c10d-3031-417e-a1be-41020911db07", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619997, "uuid": "6c857e00-0823-4522-aad1-0f9ccf0367b7", "value": "catalog-1670909860.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c835b5cc-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640630, "uuid": "d43e6fcd-210d-415d-93a2-e595e033b398", "comment": "Malware payload (Quakbot)", "value": "79312347a5f64cae2b871deef5fe7cd5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640630, "uuid": "7765eb19-5eb2-431e-bb8f-9733b1663585", "comment": "Malware payload (Quakbot)", "value": "068361eb59492e109c7ef6f53ad2d2f8e3fb832c891166aed5e93a68292f28e7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640630, "uuid": "9fa9873a-5159-4cdb-bfc2-e6a6a6de4943", "comment": "Malware payload (Quakbot)", "value": "90f9e15185b851478a722f57c006b874e4cea4b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640630, "uuid": "ed5790dc-9da5-47f1-8559-aebcd37b8e59", "comment": "Malware payload (Quakbot)", "value": "97e258ac441962fbfe192e3cadf9ca1f9ae779d345429777c6418eecf5def68f15f00df9084171d2f3aa90a51f3d72fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640630, "uuid": "b2c69460-2695-4270-a414-2ed87f43c240", "value": "64948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640630, "uuid": "d0c20bbf-ed1e-4c35-9796-fed0188de9eb", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640630, "uuid": "3c600742-41f0-4bc1-9a06-b7fc88f00e51", "value": "6144:sWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmy:sWrsTwr03pdf8vhhOKJETlByy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640630, "uuid": "e8f3b797-4c30-43fd-8ea3-a6972089381b", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640630, "uuid": "6732d8c8-ee29-4826-9362-015c9bbc37b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640630, "uuid": "80034f16-d83e-43bd-99c6-a49452ff24fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b857c20f-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619129, "uuid": "ff5c36de-e57d-4821-affd-3861971f520f", "comment": "Malware payload", "value": "fcc7287ac7b4c75d024ea91fcda5510d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619129, "uuid": "5aba9eb4-acb5-424e-b94b-a2a2d891fd38", "comment": "Malware payload", "value": "068ee7e5cb438ec1ab0cb769326e3181199a7210dbd950401c9336f1d34d97ce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619129, "uuid": "64d0d383-1000-4997-a815-6131abcfebd9", "comment": "Malware payload", "value": "9ad6917a308e25d804f5db2d18d21c76e4bac31e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619129, "uuid": "1affee85-4344-4d5b-a078-db44d9f4a810", "comment": "Malware payload", "value": "45d58b02f1b0db93c639be9031e04daa40a9175bdba5cd6928b757d28693af95a39bd22b5ff66ff04abe091f3f00a847", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619129, "uuid": "2339aee9-ad1f-497a-a62a-578b05b85c82", "value": "A783121513BF464CB88D9F3D5CA30DCB2F5AB974291968F2A16D04E8F633C421B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619129, "uuid": "0827e6c5-a380-4038-b2f9-1140e9d22067", "value": "1536:kDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdRRP6sCO0PyKN:kDAysJADlV378P3RPVJLdL6s90Py+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619129, "uuid": "ea8f2544-77a4-4ff3-a2bf-e13b96407002", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619129, "uuid": "eccc0dfb-c20c-454f-b8d1-9671b32aa18a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619129, "uuid": "2b04d1d5-4db4-43de-be75-42ad0f081b10", "value": "catalog-1050651078.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613b69d0-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626284, "uuid": "816ce424-4d3b-4923-a1c8-400816cb1288", "comment": "Malware payload", "value": "bc9d0000e93d6d1195f6aacaae699f71", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626284, "uuid": "a17ce660-733b-4b61-a02a-89d995a0d801", "comment": "Malware payload", "value": "069187ef17914311c5752ca3892b15c2ce1603df3967953bd247fa269ceac58b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626284, "uuid": "575cee71-fb3e-49b6-bb1a-925d7535864d", "comment": "Malware payload", "value": "7855605eb4774e19a62a7412c74e47906fcf944b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626284, "uuid": "8dbad945-41de-4a19-a1e2-95fe65ceebe4", "comment": "Malware payload", "value": "a468fea3d8d15b5069b6f60e2f9b54387203fa139dd8fb0bdcf5e1f2a8f7d9935db10a28d4ffbffd1a943a17e9c648ce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626284, "uuid": "37bf0f9f-122c-4bf2-9b61-5204f8cad760", "value": "0E83029013BB8E6DB58DC93948E20D8F2F56B6B02D5B5DF2B12D0494F1238961A28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626284, "uuid": "fbfeefaf-8c6a-45a9-a152-6ad1b96d56e8", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7O6:CDAysJADlV378P3RPVJLd47O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626284, "uuid": "bfa232b2-adc5-45ef-86eb-eb6fb296429f", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626284, "uuid": "b678580d-3786-4544-aec3-fee5c7abd410", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626284, "uuid": "caec2e1d-82e1-43cf-9755-96d421316398", "value": "statistic-2109481591.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ca1bb6-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627153, "uuid": "50d782d0-3cbb-4066-b3bd-be1a84115797", "comment": "Malware payload", "value": "683d4b195c0ed8645139d8c5efac9216", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627153, "uuid": "932b8ecc-783d-4288-ab5c-4d0f5ec230c7", "comment": "Malware payload", "value": "06a0d12ec555696cda83baa2c97f1cf14ea79d9c1f7d37c72d48f84383acf1a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627153, "uuid": "53f146b8-3178-4b68-aece-2358c6cb0f73", "comment": "Malware payload", "value": "4bfe6691d29944bd6ddcaceae07694cb4b5958de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627153, "uuid": "d1433ce7-fc6e-41d3-9afb-9f9fb4d2d989", "comment": "Malware payload", "value": "2f204d1dc096af4408bb9b56a7d81001e3d258ccbd74ef761fb47587938af72ca0522935661ef15cf6c40b926b622e72", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627153, "uuid": "2122ed4f-e0af-42e7-89c4-9609978d6304", "value": "9983021823BE4958B58D8E2D88930ECF3F66F474281D58A2B55E00E9F227C565F34D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627153, "uuid": "7510e3cb-c431-42e7-92cd-ad5f45cdb7db", "value": "1536:xDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdA8eTrIarVAN3/B1eM2K:xDAysJADlV378P3RPVJLdzau8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627153, "uuid": "08c24f13-74bd-4892-b0a6-3baa55564171", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627153, "uuid": "3828e344-ac71-44d7-ba5c-ddf2d74159f7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627153, "uuid": "1798d130-126d-4bc1-bcc9-98a8bd34e5a6", "value": "statistic-744722596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e04cfa6-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626708, "uuid": "fb1425b6-08f4-4e03-b31b-18bfd83e9999", "comment": "Malware payload", "value": "dfbb9133be2c3fa173c951a21f8ad794", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626708, "uuid": "45b061a4-c846-494e-a7d2-c85a6d1de00e", "comment": "Malware payload", "value": "06a2286948727ab3073848c43bc473e81b0ec636ed6db16231e554837c4153c9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626708, "uuid": "92a0dac5-cefb-459d-b74b-c1fc61c66c94", "comment": "Malware payload", "value": "530fe0bd2c952ca3449a20c425bab14a9122f204", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626708, "uuid": "6d68f264-cd80-4912-9537-dab0a95b4e04", "comment": "Malware payload", "value": "934dc32c431ae3bc1cac41e893d0dff130f88d6ff09f16c93bfaf05c3c1ed550a6288596a15d106c1d5028041dfac77f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626708, "uuid": "f19b1140-9ada-4aaa-8fed-8bc5a480bce5", "value": "1683129013BB8EADB58DC93A48D20DCF2F56B6702D5B5DF2B12D0494F1238961A3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626708, "uuid": "1ac09d1d-22c7-4acb-a925-09883d4e0cea", "value": "1536:6DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7sE:6DAysJADlV378P3RPVJLdw7sE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626708, "uuid": "678401f0-5f8f-499d-af5f-9cb7b7ef6fbe", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626708, "uuid": "dc131549-a214-469e-ae81-42b0d8806d11", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626708, "uuid": "58cb467e-8a15-4f68-a974-7e20e054d550", "value": "statistic-443332287.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ff717b-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626029, "uuid": "af4e15e3-acd6-4d02-b633-bfec6ab6c8b4", "comment": "Malware payload", "value": "ef7e1784aa0b9afefda8beb2e97e3fc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626029, "uuid": "592a30fd-53ac-4da0-a379-20fe185cc7c1", "comment": "Malware payload", "value": "06a795cada9a34a81ece5b8d3420763d0f90986cb1de66c76ffca80bfb029fd8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626029, "uuid": "98b8ec97-a755-4da9-aad0-8898f896a8bf", "comment": "Malware payload", "value": "4521af04264f8294b4d7d16ea2f6df7044a8ea68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626029, "uuid": "e8d834c0-7d94-4c9d-ba09-5c5710a87508", "comment": "Malware payload", "value": "69331fe5c3dc508f5c805e113352d5a7cb3b60992b39709380784689a627646cb30bf7cf4ea8e2e69c3640f2a5b885b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626029, "uuid": "f37cb5ca-ccfb-4106-9e46-b608375b9037", "value": "8483020413BA4909B5CDCA2D8CC31FCF3F57F8B815094862A55D0199F627CAB5F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626029, "uuid": "262362a6-418a-4e1f-a551-18167e4fff74", "value": "1536:RDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n1KuS:RDAysJADlV378P3RPVJLdcKufS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626029, "uuid": "79193fdf-26f0-450e-865b-4a857a9ae285", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626029, "uuid": "168ee961-af89-4e8a-8e1a-09a01fa3cc7e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626029, "uuid": "22fb7d12-913f-4ff1-961a-52712621d3bc", "value": "statistic-1914167439.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2845b135-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620605, "uuid": "6060e500-0775-433c-853b-11f1c65a5871", "comment": "Malware payload", "value": "f0647714c880417274ebbd69938dca9b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620605, "uuid": "1e36f3dd-18c5-45c2-9dd3-906035e4535b", "comment": "Malware payload", "value": "06a7d2925a653759e6cef13cb85a1a3d15e0a8fae5113dbc2403a58d705ff262", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620605, "uuid": "1b2621f1-a473-44d9-aa15-bed256cfe0a4", "comment": "Malware payload", "value": "dfd9335495e68a98388fc62a8a1434c703aa840b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620605, "uuid": "258e1867-f023-4d68-8089-ad1f1af22f2a", "comment": "Malware payload", "value": "0365c89fea5a379fa2599f7e91bdd6b4e0f00d21b71f44c9e5172f3ff00e10d1b3a77eee536ad578c6ff8907d4caa327", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620605, "uuid": "07b93a02-46e8-4d0d-970c-8bd20d5bbd8a", "value": "ED83027103AE8B1D74CE5E3914D22E8F2F97E8B82D195992541904E4E327C629F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620605, "uuid": "0fe7100d-a3b5-4533-ba65-5652777310e7", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVR7:0DAysJADlV378P3RPVJLdtDsMU0dR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620605, "uuid": "ad383681-aa34-46c0-8e8a-33f1285dd2ec", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620605, "uuid": "7c83ba31-b9d8-4faa-adef-91d4dd688a3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620605, "uuid": "0d58079f-8670-4699-b882-b35fe6b1d561", "value": "catalog-2024080388.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0ac00f-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640635, "uuid": "4a15c9e4-d765-4ca8-bbcb-fedd379311a0", "comment": "Malware payload (Quakbot)", "value": "6e7673db321e1019146a2486e53ca1ed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640635, "uuid": "af999aeb-0d25-479a-9476-70d051c0ff9f", "comment": "Malware payload (Quakbot)", "value": "06bc8a64bb563d0f6658f6095994a88694514909eef75c4686688c8030828d3c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640635, "uuid": "b56c7de2-6657-4c52-bab1-aa74a333eae6", "comment": "Malware payload (Quakbot)", "value": "6685148138e03922e2149c6b1720f784091577d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640635, "uuid": "f83bc5f2-fff5-462d-b354-669e924418e8", "comment": "Malware payload (Quakbot)", "value": "d6a779da2ee6ce18150038558079199dd5eba574c9225e4d00ba295f0a4097d23e66c5556c9b25278eb0480edc09dfdf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640635, "uuid": "01a0606f-b510-4778-90c1-1e77d640b9b3", "value": "D1948D396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640635, "uuid": "2dca529b-0740-4d64-bc3b-262cc6208ef1", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640635, "uuid": "33516089-6074-4fff-83aa-f6c2ab0aff27", "value": "6144:jWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmv:jWrsTwr03pdf8vhhOKJETlByv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640635, "uuid": "16c31b94-df78-4841-8c74-2a37a0019c54", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640635, "uuid": "d3da57e8-d0f6-46fc-8a79-bd12b6d55ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640635, "uuid": "96f5d478-a8fc-45c7-ae24-120cd29cade3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58484568-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623692, "uuid": "8d2678c4-f7fc-4635-8645-d1226036a054", "comment": "Malware payload", "value": "4379648bc3697011bd21a51cb9bed627", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623692, "uuid": "c3727f10-bde8-465d-bdfa-4b0a9ec105c1", "comment": "Malware payload", "value": "06c51c0e70477b40b19b02ec5f0ab342f896afe011eef114c50177b02c1f2e4c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623692, "uuid": "84a69a01-b482-4bd0-b308-444c3fdf41ea", "comment": "Malware payload", "value": "4cb16f2166df7336d8d382ddc4d1b9f7ed148d63", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623692, "uuid": "31c8ca46-b6fe-443e-8695-720ffadecf7c", "comment": "Malware payload", "value": "0faccc05b1f66a4ff10e7f43866b5556e6ccd947dc0d1ea79533d12191d64910bf2dcd38e1c6df02e1e2dd040c4f87f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623692, "uuid": "9eb4431b-18dd-415d-9c03-de7e4d2a2101", "value": "7D8302CC313DC5DF7AFE2A0992CC887E740ED8B43144154EE8C9266B9E8BFE71856560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623692, "uuid": "85828a73-6d7b-4c31-ae27-8fd52f835757", "value": "1536:KG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttfKkApVr6wo+Rx8:KGEhrHJoEsBMG7qzktxApxT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623692, "uuid": "978389be-2119-48ff-99ac-4065266a94b6", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623692, "uuid": "40575624-00ba-4d47-a4a3-1d299c99ed07", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623692, "uuid": "a7fbcc64-8ecd-46d0-b5fa-2c02c7203abe", "value": "diagram-347419901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422ac530-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623655, "uuid": "dd225778-483a-427d-82a5-b0ea495c20fc", "comment": "Malware payload", "value": "d99931f867aef749fe0ec7b181edf1a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623655, "uuid": "38dab3b7-33e1-4f89-b9be-3c402be17957", "comment": "Malware payload", "value": "06cc3fc392845b26038fee79b7af9b9837416adc3753fa4695595ac5f2060505", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623655, "uuid": "285c6fb7-fcc9-43f1-8e7a-0ce1b26b2f04", "comment": "Malware payload", "value": "e506f2eab1228cc7323a6ef5fb0c42117ee24ccc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623655, "uuid": "99564355-6fb4-41bd-b1af-272c8a9f2039", "comment": "Malware payload", "value": "79338df56a1c7e4024554431d4c6d569ec0a9e2cab2b4ee898d5e65f3a3e3ebbf8e7ac20c0ca80eec6aed149fd5a0997", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623655, "uuid": "9aa8d6d3-4184-46c3-9608-be95080ce7fa", "value": "A18302CC653ED1DEB66D2D04A2DD883F791EECB4214430CEE4C8166B5D8EEE75857460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623655, "uuid": "d79c338f-22a7-4a01-92ad-03212878e7ec", "value": "1536:uG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttphWgYkCxGcf1aSm5:uGEhrHJoEsBMG7qzkjh12xGwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623655, "uuid": "cd44ab08-31cd-434d-9a17-0750077b771f", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623655, "uuid": "8712e66e-b38a-46de-b745-b4f62d80da55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623655, "uuid": "318633dc-ebb9-404a-ad0a-a37a8b003603", "value": "diagram-317928181.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070620bd-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625274, "uuid": "733eca08-838a-48d1-85db-955137b38b4b", "comment": "Malware payload", "value": "6fcaa0b38280447d8ff56f6319b7f7d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625274, "uuid": "e1fb7702-bdd2-424d-8349-1af476dfce22", "comment": "Malware payload", "value": "06dbd0a5d543f0cbd85d6b5984c382e71c0bb105048efd73ddd53c2e6ac9463f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625274, "uuid": "e846e287-6775-4805-9d7d-c97300145d0b", "comment": "Malware payload", "value": "e384ba91c1ff885124ed957b97bb8f920f8c2689", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625274, "uuid": "effd80cf-649b-4c36-b9e4-3834e7e57e35", "comment": "Malware payload", "value": "f072428778398a44ca1ac1e57749aa7812a72a91deea36b3b8500f0e6895dac8f63f6451ef6b0d6e7e8842381603646b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625274, "uuid": "1b772d04-15b3-4d8e-b709-f968fd4b7284", "value": "6D83025013BB8EADB58DC93948E20D8F2F56B6B02D5B5DF2B12D0494F1338961A28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625274, "uuid": "654108ad-b086-4aeb-9463-5b36e8416b5b", "value": "1536:3DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn70h:3DAysJADlV378P3RPVJLd470h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625274, "uuid": "b347409a-102c-4e0a-b87d-48f9e82e1fc5", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625274, "uuid": "7cbfdb2e-4ffe-413d-90ee-8a8ec60a5882", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625274, "uuid": "f2c5dd31-40f9-4173-9773-4df2deb5d83b", "value": "statistic-1359923331.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ec7cce-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626423, "uuid": "108b7f41-0dba-43ad-b139-9e97631d4146", "comment": "Malware payload", "value": "138fede4d4c738d90eab16d662d97fcf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626423, "uuid": "3890b917-5811-4c98-bd7d-3d8b6dbe9806", "comment": "Malware payload", "value": "06e092a4e7c5d158178be843fbc7217a055fe17ee82a943c6acec9d1f3a68e51", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626423, "uuid": "df69ee28-999e-429b-8235-eb7e9c19a8cc", "comment": "Malware payload", "value": "e1b6a3df035b681516c5626ca4c0a55209b8fb5b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626423, "uuid": "93e57fb3-0e08-4ff9-a5ca-499b8198d877", "comment": "Malware payload", "value": "80ceb99f9c6fca55216628d283ec1fd87cbd32872fc8a2edf91450b91b88915911f94e40522897ec0f3facc82134b8e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626423, "uuid": "3d02ed1e-5d08-4bba-b77f-b068ae4d37b1", "value": "3283025013BB8EADB58DC93948D20DCF2F56B6B02D5B5DF2B12D0494F1238961A28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626423, "uuid": "ad71c144-6096-41c3-b653-7c5f7a915712", "value": "1536:xDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7LB:xDAysJADlV378P3RPVJLd47LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626423, "uuid": "df338c89-357a-47b3-abde-1d7c454d5ac8", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626423, "uuid": "86b9a8df-0849-4aa7-94d6-c8a101574338", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626423, "uuid": "6d37ebd5-f632-442a-a4cb-547510dbae45", "value": "statistic-261128358.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd71534-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646173, "uuid": "f7ee150e-79b7-42b7-9daf-eccf7b642a70", "comment": "Malware payload (Dridex)", "value": "cc7e04b9b88f1e45b31b43395a552cc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646173, "uuid": "4cfaf568-b452-4c0c-a194-e032c5f8a980", "comment": "Malware payload (Dridex)", "value": "06e2b20ce3d4603b9e4d083f58e09bef0aec97cda2c59c1930c14e1266486606", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646173, "uuid": "13453d1f-22c0-42a7-b5c9-8bebf9c13632", "comment": "Malware payload (Dridex)", "value": "8a090020535f5b1b281edce2a7fa8578acb7e1a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646173, "uuid": "be376e1f-dcfc-41c5-b4c1-c99bc6bb111d", "comment": "Malware payload (Dridex)", "value": "9ca327cf2d7392ee412dc8836aafe0c4bf1d562f743dedc3232b71fab75a0d8bd9e447065b9340e321dd283ac3821d9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646173, "uuid": "17ec40ae-a9c6-41ac-a672-9aa901031d00", "value": "0AF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646173, "uuid": "beec7caf-2e6f-4a76-9029-08b4f65ea50f", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646173, "uuid": "a086afce-5b7c-4b10-ae32-2827f9fd6113", "value": "3072:ExT2d85tleLD51fC5AHYEoefukoTFMpGmjY8D:1y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646173, "uuid": "8473aa1a-391c-4f74-ad09-b1d3ce87d269", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646173, "uuid": "6ea93bd3-a71c-460d-af44-a89ef28fa3dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646173, "uuid": "c6160e57-8fdd-40b7-b431-c894470b3a88", "value": "cc7e04b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca6ab27-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640638, "uuid": "775b434d-3a34-47d1-9d5c-c201dbf59a53", "comment": "Malware payload (Quakbot)", "value": "6cf83600724ba8f4f4390262c9c37776", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640638, "uuid": "fc2927a7-fdb1-446a-b922-5ca5cfb8966a", "comment": "Malware payload (Quakbot)", "value": "06feb73193f9f4e3cafd2d1a59fe7509c343da52dd44c158029a2824ea76da26", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640638, "uuid": "493549b3-2389-4dda-984d-66603cd226fc", "comment": "Malware payload (Quakbot)", "value": "fd099e8dfcf54950d267753231d0e6c20f8dcd4b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640638, "uuid": "22cf820f-1185-454f-a0ff-4bef116cd653", "comment": "Malware payload (Quakbot)", "value": "c11fce6f5b6e3d6921b0f86428ff2b1a7199d29868509c2c8d82eea6cd161c28c2e9149661c80dbf40d171dc436751fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640638, "uuid": "82d9bd7d-3b00-4646-ab3d-874c31cb4464", "value": "F0947D396A26D063D2BC27B143C3EF580E67EAD57234540612A2DF183EB6395BE36F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640638, "uuid": "d769089e-0e6c-4459-a19f-43c8b5edade9", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640638, "uuid": "47fa857b-f0e8-4b32-8ef2-d2426194e2d1", "value": "6144:byPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmt:bTwr03pdf8vhhOKJET5Byt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640638, "uuid": "0ef3815f-6938-41f0-b317-c44647d26dde", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640638, "uuid": "a84ccc7b-89e4-48aa-a4bb-7cb3a2ef3262", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640638, "uuid": "246e9b91-eb2e-4f79-a836-192760b92f8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8803f3-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625797, "uuid": "ae71fe71-d8eb-45ba-96b8-6d88990f1d80", "comment": "Malware payload", "value": "d1820f5aff74b4b5cf6ffafa828a2750", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625797, "uuid": "9a169b5f-f34c-478f-a7db-b4c94aa1c66a", "comment": "Malware payload", "value": "07040b0b799404b3da59cc55a035ac67b4ab0b2af9446ad433b2385774a21cb0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625797, "uuid": "93650b89-67f6-4e55-8228-e8487debc2a4", "comment": "Malware payload", "value": "97e57c7190d8c0deef66e7ca28776f304d7e1620", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625797, "uuid": "e3f31fde-5124-4cc3-9e0f-572ecf048345", "comment": "Malware payload", "value": "50dad3b04eb60faf7e86aa0906376920214afeda43b8a655dc66e9d982b584f1fcdf1bf6a2a9c45dc08beeb41103aa67", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625797, "uuid": "993a02c5-8329-4d48-bec3-8105ee72f3f2", "value": "4F8302A453BE4A5D798D4E2CACB20D4F3F67B674390E68F1B92D0481E2318561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625797, "uuid": "7eb5f754-1732-4582-9145-332f7ba198e0", "value": "1536:qDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTm/Dz:qDAysJADlV378P3RPVJLdBxpEUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625797, "uuid": "a8ab6f0e-233c-4d54-9288-651696df8d2d", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625797, "uuid": "a9906b66-c89f-4598-8558-772377e21801", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625797, "uuid": "9aa52d6f-305c-43f1-a067-21ab74233272", "value": "statistic-1759986432.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae4de91-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627052, "uuid": "c01553a4-ede4-4d15-9ef7-f58fe4e5d85a", "comment": "Malware payload", "value": "fef7d54b217bfbc490e6913c722c63e3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627052, "uuid": "87069de1-665a-4b29-94d9-7c5102f0b77c", "comment": "Malware payload", "value": "07320992128c19215435766e2f144d9296946c138b4b63e6c3dcad88a7b6e301", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627052, "uuid": "9daca740-7d56-4e09-923b-7ab98201e52c", "comment": "Malware payload", "value": "e80889018aceffe25cabbfa25ca93574c718ef65", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627052, "uuid": "d1b0ef6a-e2d0-4728-88a7-23f1bbfc22b1", "comment": "Malware payload", "value": "82d8e297459de69f04a5beff7f28da3b951b5c10dde5f83be72628242e31adbe6a1cc6e3678d651045b6c55be8033e67", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627052, "uuid": "72bddbba-723f-4c41-bb01-356e28499c98", "value": "4583025043BACB19B5CE8F2D4CD3198B6E9BE9F42A1D5CF1652D00E5F32A8051B14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627052, "uuid": "4bd59708-1e4a-4fc4-84b7-e971c095d842", "value": "1536:TDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd58oZePFOLVEr0xkvUDtKS:TDAysJADlV378P3RPVJLd58oZeUM0eU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627052, "uuid": "f6b8b5d3-8f84-4d11-8d42-664978a23ae7", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627052, "uuid": "00b0db81-d7b2-433a-8259-70bb0b067d35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627052, "uuid": "b2e448a5-8ad7-4b5f-9730-c0c9ad895def", "value": "statistic-679116631.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2153608e-a82a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619618446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618446, "uuid": "ad421964-1ad6-4201-a283-137a170811b6", "comment": "Malware payload (Dridex)", "value": "f9f716956969cf4de9ddc65143c990dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618446, "uuid": "de06e54d-329a-4f69-9bd4-d6953d6f7c02", "comment": "Malware payload (Dridex)", "value": "07468ecf87df6388922b465fc8a1e2ebb340ac441229605b386609cd6055a765", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618446, "uuid": "d88b74fe-ffbf-493a-b090-609b510e463a", "comment": "Malware payload (Dridex)", "value": "b8f5ad5fa2004951262eba6fed5f7c5856ccc297", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618446, "uuid": "e92364e8-518b-4ae3-8483-3d67ea1a2905", "comment": "Malware payload (Dridex)", "value": "585e4bd29a3c2e80219a7eb6932b28c50b9662be2c4591771170a180a9270246f09d9fc0cfa42612e234a24ba885ca14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618446, "uuid": "0494fb7d-6b6c-4c29-8e68-7e9369af196d", "value": "E0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618446, "uuid": "8df319ab-4099-4e4b-bb59-9f45b658ad17", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618446, "uuid": "00d9a0c2-cba9-4f19-a8b8-9ee7787ff15d", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619618446, "uuid": "cdeccfbf-1e26-4583-84d8-9e3dd6e91597", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619618446, "uuid": "ee021e4c-111a-4cb1-aaf0-f4aeaed426d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618446, "uuid": "7b5e88bf-3de8-4489-aeb3-0fce5b10136f", "value": "f9f71695_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5cb295-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623723, "uuid": "35855af4-4fd6-420f-bcdd-9d4b160dd4e7", "comment": "Malware payload", "value": "c70b1720d2675dd7afbb496e45bd73f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623723, "uuid": "08acebde-4636-4d5d-9061-a10cea1a15ae", "comment": "Malware payload", "value": "0751fdb51203a212c7432fa6708bbc4afcbd795ab452443c15899b464f188d92", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623723, "uuid": "1073e42a-3bfb-40fc-ba0d-954147d070cf", "comment": "Malware payload", "value": "6f6ef44536eec7614753d20fcfd2bc908d4769a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623723, "uuid": "f8806883-1ebf-4ffb-bff6-18d908de3cd6", "comment": "Malware payload", "value": "b9143ece6881f8cdfbacfa10ff74f24928b515209cb84e6cdd9157b77870f16db8bbd2b7b3a61a2c2d6d4a5a0c1c725d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623723, "uuid": "f23027a2-347a-46b6-95e0-bae5ceb9829b", "value": "D68301C9203DC5DF71786B06B5AC893EBD4D6CB5210064AED4D8266FAD4DAFB9C97030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623723, "uuid": "6fb788a5-3aa9-43ab-a479-683c69170ebc", "value": "1536:qG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttkI5EzJKE9LfFSp7mUn:qGEhrHJoEsBMG7qzkWI5AB5gpSUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623723, "uuid": "65735478-543e-44d3-a854-418683e0beaa", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623723, "uuid": "6c1e9ece-3939-4ec0-8ec4-cc23647ac8f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623723, "uuid": "437de1af-ba67-42ad-9cff-f56de97c60b7", "value": "diagram-378258477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36194b9e-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626212, "uuid": "5d3009f9-ce28-4093-a625-4bab717c630d", "comment": "Malware payload", "value": "1d30e2bd581aa7047946e196a568d620", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626212, "uuid": "f61ae453-95c2-4bb6-9f17-6d515de4cfc5", "comment": "Malware payload", "value": "0753f8f055048bce5523aeec6fdebcfb111663de14e44e851b8bc2954c69aa00", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626212, "uuid": "b5afeb4f-ccc6-4872-8ca9-c7d7ef4472cb", "comment": "Malware payload", "value": "a7f4ff53bbcdc37a839de9e6df7297b06765be68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626212, "uuid": "9f280da7-e88f-4e65-960f-dd94c77c1385", "comment": "Malware payload", "value": "e842c4a66a01e20b779d2066937f063b250568390d6488c01d84af9c91e2021a68bb7e26f38022fe5fe9e92019efed8d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626212, "uuid": "5be55c87-b0bb-4484-82e4-94fb9f60a801", "value": "1283022123B9C998F48DAE294CE30DCF7F52A5781C1ED9F56229019AE327C964F3453A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626212, "uuid": "b98ba5d5-43b8-4476-b414-ea4930d7522f", "value": "1536:UDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdqPqXT/WkO0B19M2R:UDAysJADlV378P3RPVJLdKqXj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626212, "uuid": "8c87bbc5-2194-4fb2-80f4-aa747ae12567", "value": 86117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626212, "uuid": "48416aa9-d37e-4c6c-a58c-4bfd706b8f0f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626212, "uuid": "1d4ff869-d514-46cc-92f8-cbac75951c44", "value": "statistic-2052642020.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e8aaa8-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625668, "uuid": "322e02fe-5b1b-4cb5-ae79-8905f77ea4f3", "comment": "Malware payload", "value": "cb1ba57d6e5d2b0e0eaad64e56dae648", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625668, "uuid": "bbe9e38a-2491-4d37-b921-ddc0f479d94d", "comment": "Malware payload", "value": "0774c9f1e30d32838f5a94cac254b9fbcde4dce4da3655facdf26b3f2c88a8b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625668, "uuid": "ecb5012b-52bf-4bc0-91e5-fe093e2277eb", "comment": "Malware payload", "value": "ee67720fb3ed170f5b583b15d6df08d4fb4dc9b4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625668, "uuid": "ebe8ad65-b5df-4a25-a5db-19c5743e7694", "comment": "Malware payload", "value": "37f7c0c48f0ef04d4afce27b9166a034a9886fdd5266d2299bca295cc74d46ee43e7022bd1c94770d603286b3309af3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625668, "uuid": "6afb7bb1-2795-4d73-9560-a2e849cafe8d", "value": "5783021403FA8559F48E9E39ACE20ECF3F5AFAF53D1A58E1962E046573298510B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625668, "uuid": "4a8e7f2c-f2f3-4db4-a6cc-b7f24d1437d2", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wBUSx:XDAysJADlV378P3RPVJLd+eh8wBPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625668, "uuid": "4b62ea18-5096-44dd-9f5f-78bb843120cd", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625668, "uuid": "2289eadf-7edc-427e-9888-67b0f2f9104b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625668, "uuid": "d68d34d0-eaf4-4df0-a697-01a532779838", "value": "statistic-1665867220.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e590735b-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625218, "uuid": "1c20640d-fdd1-461b-ae7b-170ba22efa8e", "comment": "Malware payload", "value": "c5395de5b2a35993fd858ceb182d6422", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625218, "uuid": "847c44dd-670e-456e-bcd7-b31c17354bca", "comment": "Malware payload", "value": "077d31ad627d63cce86d651c09875353d9762effcf4dfd91d19a4e8890e1b185", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625218, "uuid": "93e55159-2214-4952-aa46-c5c8bb23f972", "comment": "Malware payload", "value": "1ced934788b5a79f45ed4530d78d9348e2060267", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625218, "uuid": "63a28ca0-6bd5-4995-9aed-9a1c4e417dbc", "comment": "Malware payload", "value": "3e042aefa7c7db6ef751448ee87a297e330f2fcccceb49e030b479b40074c54156187a40bb5702fc1c087def63c41000", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625218, "uuid": "03be67b5-eb1b-470b-b67d-de64f359988d", "value": "5B83026453BE4A4DB98D4E2DACB20D4F3F66B6743D0E68F1B92D0485A231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625218, "uuid": "d936b2ed-04fa-4dc7-9e87-9e0dfe389c27", "value": "1536:mDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmio:mDAysJADlV378P3RPVJLdBxpEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625218, "uuid": "d655a638-828e-4624-a8ce-b47f25f4ef53", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625218, "uuid": "3e50932e-3604-4e76-b19e-59bd1e26b403", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625218, "uuid": "aa312955-17aa-4478-940e-74f2f98c2aca", "value": "statistic-1315176545.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6cff29-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620023, "uuid": "d9d5e960-e133-46d2-9177-3e48a747db05", "comment": "Malware payload", "value": "9673a7c1b397b8203ca4dba54d8feb17", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620023, "uuid": "fbd838f7-314f-41bc-80e2-2779e5abb5e7", "comment": "Malware payload", "value": "077e0605b2963cb04080f507a273ef5e2857e3a44b8c497f7dc5c54c5d8072e7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620023, "uuid": "dc099ee1-0997-4396-bda6-932ab6c31fa8", "comment": "Malware payload", "value": "6fc609520d6c84a0bff77d3e9177cbf5d59bb6e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620023, "uuid": "71936b73-ab25-48a5-b943-e63a29d5ad83", "comment": "Malware payload", "value": "3fbf6332306d1e60392b87e63782c5df07cf1727f8775a6f5ee96fd00d7020fc55adfff44b5e8b005bcce0a3e44ad7e5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620023, "uuid": "e77270fd-6c36-44ac-a2a7-c7247bf8f714", "value": "4183022513BF464DB88DCB3D9CA30DCB2F4BB9742519A8F2A55D00D8F6338425B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620023, "uuid": "38a2ae32-bbaf-4ffd-9be8-bd1390e73fda", "value": "1536:VDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsRP6sCO0Py3:VDAysJADlV378P3RPVJLdC6s90Py3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620023, "uuid": "95471651-5568-4759-b657-fbabac319b6d", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620023, "uuid": "ef7591f7-5560-4851-b05e-72b433b396af", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620023, "uuid": "735757e0-65fb-4dd2-b1b1-66f3821019c8", "value": "catalog-1699983646.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1496bb3a-a869-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645483, "uuid": "0d3ceae3-0244-43be-8c3b-aabf93d183df", "comment": "Malware payload (Dridex)", "value": "7779d133239f6d6243b0575c43a33cea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645483, "uuid": "671fda17-f920-4500-b9fa-0ad588fc236f", "comment": "Malware payload (Dridex)", "value": "078651bc2d6079541f23bcb487699bbf4cd7c28458ccdc4fded04c50df74cbb8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645483, "uuid": "7db3b2c4-dbbd-4a88-8841-d2ac420dbd09", "comment": "Malware payload (Dridex)", "value": "1f815fb55b32861dd4a7634838f539a8bf116784", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645483, "uuid": "b95c02ab-49db-47f3-bcf5-b9f4a79d540e", "comment": "Malware payload (Dridex)", "value": "50dfa87f11385df828dab2049b3fa3b3bf745fc6dc0293ee9db4800228f33ae1ebf90d0dff277f9c8156a9055288576e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645483, "uuid": "58d5f6d0-c087-4bf3-bf63-31924efe860f", "value": "03F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A94DCE9173248B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645483, "uuid": "4f9eda78-4419-4a9b-bbdd-8a16b820706e", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645483, "uuid": "2a207deb-72a0-4f75-8105-8bbfbc4d02ea", "value": "3072:+1Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2HGkFY:AnS62Fl+pkeJl3CvRStrFl+EYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645483, "uuid": "9771acfb-7f77-44cc-9703-296d9c9748b5", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645483, "uuid": "8ffde704-518c-413f-9b61-6285f7180f0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645483, "uuid": "c81106d4-4a67-4c2a-b587-2819be87b5b0", "value": "7779d133_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3369f7-a819-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619611274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611274, "uuid": "2f6d178b-c5c0-4cf6-9675-4d3798bdeea0", "comment": "Malware payload (Dridex)", "value": "87aa0ea58ed579e1366327e49ec0d96e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611274, "uuid": "e6f7ac35-e0e0-4177-a81a-080fd0e0f259", "comment": "Malware payload (Dridex)", "value": "078861dd988ab650b1a036cab8330102c92eb17a53d88890fcbff4f4631418b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611274, "uuid": "b07c16dc-d16c-40f8-8f76-3dc794d388b6", "comment": "Malware payload (Dridex)", "value": "0a67056434fed269aefbdb3927692447f12c6b69", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611274, "uuid": "5f7240da-34b0-4040-a384-7658e53afb22", "comment": "Malware payload (Dridex)", "value": "992a4198667d8db92dcbb78d807ca53f935fcc7053b80d2098fa8929a0b00aa34037ef6dca80a03b4cddca98832f05c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611274, "uuid": "e671248f-81dc-4fe8-bbc2-5dfec8c534d2", "value": "C5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611274, "uuid": "04a63a3d-5d3f-4489-a7a8-afe8cbb4f75c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611274, "uuid": "35fde6f9-3e4f-4de9-83f8-2ddc8cb7f3a8", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619611274, "uuid": "245aa1eb-61ff-448a-abc8-b7f375b67fb9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619611274, "uuid": "74c40a0d-1a5a-4c1a-b0c5-beab76e20227", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611274, "uuid": "6317db8c-1079-4aca-a6c4-86c905ec92ea", "value": "87aa0ea5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc607ffb-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639778, "uuid": "290d07d9-9103-4bbc-a3c3-9802979361f9", "comment": "Malware payload (Dridex)", "value": "dc47128ec1327e5bb4d7c2def38a75a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639778, "uuid": "429e11b2-e15e-4936-8803-448cf5f8f8de", "comment": "Malware payload (Dridex)", "value": "0793ec9f5d124f8153e53a2a3648630134437b5432c3021fc7d25439f60e7894", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639778, "uuid": "241bb03d-2429-4f97-9952-a880c5df0504", "comment": "Malware payload (Dridex)", "value": "1318e0cbfd5ada22a05d0ca3308a936b9a92d0d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639778, "uuid": "4403171b-a4ad-47fb-95c7-849c0b1cf5cb", "comment": "Malware payload (Dridex)", "value": "850c55e560342e538420a3758563d32bc07bb4aa3f5e03a7642e07d5eca30b82cd778b88a5afcc28b5def6d51ae218e9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639778, "uuid": "fd387137-e985-486c-9df7-288367af3a3f", "value": "4CF3CF41D5A6C458EBDB2870C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639778, "uuid": "fe84d705-a758-425c-a83b-72e7dbd203d3", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639778, "uuid": "93091364-9d0f-47ef-b37e-713c6e5abc2f", "value": "3072:wZT2d85tleLD51fC5AHYEoefukoTFMpGmjG8D:py5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639778, "uuid": "aed57fc8-6861-4d5b-b11e-275184a859e2", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639778, "uuid": "03bf6794-ac5e-4ac9-8182-6db5850a0522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639778, "uuid": "db222536-a14a-45cb-b692-2566fe3dd444", "value": "dc47128e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26edf0a1-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626616, "uuid": "b8bbe5b1-1d59-47f7-bf90-968600348369", "comment": "Malware payload", "value": "68ec813a61d9253cd3c0c15ee78d6207", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626616, "uuid": "5070dccb-686c-4402-a3e3-dc2a48a5dff4", "comment": "Malware payload", "value": "07954a05d4afccbd66d735ca0715bf654fc1b924d0f5ec7afb3444e728a55d9f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626616, "uuid": "3b990d57-6e51-4faf-9a7e-7015e6f369fb", "comment": "Malware payload", "value": "7a1757425804ea4bff891c642274840a7a704693", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626616, "uuid": "19c9a164-aca2-4560-b61f-46b98e607ffa", "comment": "Malware payload", "value": "4078b20de3397d7e07a3025f9b8bd233c0a99d955da7d8b3391355727e656948b7fb3e9cf47bc57389eacd36b6bc2028", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626616, "uuid": "8db4ae61-3320-485c-8164-9ba1da2b3fdf", "value": "DF83021403FB9959F48E9A38ACE20D8F3F8AF6B53D0A98E1976E045577368510B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626616, "uuid": "24883f94-9417-4d18-8ecd-d24965a1e2ec", "value": "1536:ODXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBxm:ODAysJADlV378P3RPVJLd/eh8wBxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626616, "uuid": "ad18ee32-3f72-4fc0-ab46-5c50fc89db2c", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626616, "uuid": "c5516c59-1835-48fe-8e8e-6662cd7eb826", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626616, "uuid": "610ce3d7-edb1-4eac-badf-7c3e4ae0ff7d", "value": "statistic-377959817.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81c30e6-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645355, "uuid": "d7276682-096d-4bf5-b53a-e51db8eefd7a", "comment": "Malware payload (Dridex)", "value": "a2022f34babd4eab066aa76d75430e26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645355, "uuid": "77bfcbd3-d2c5-43d3-a801-6872ef377302", "comment": "Malware payload (Dridex)", "value": "079a6e772da2866f461bc5f14e946d6e31c8846b02135d8d649f59e784af72cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645355, "uuid": "734641c0-4967-4a5b-b8df-5739771f5fa3", "comment": "Malware payload (Dridex)", "value": "142d8c818b2d6015de71ef20dd7886fd54a0b9c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645355, "uuid": "e45f59d2-2a14-4572-8aee-a510316d4feb", "comment": "Malware payload (Dridex)", "value": "9b553f33b80f9ff703240af7bdfda90440f5a2bd45d049a34fa257caced70beae3a9ce74be77a39b70ee4612542680fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645355, "uuid": "1298864b-7420-46c3-ae42-821679222cf9", "value": "06F3BFC6E7EFE0D6C02BB43385CDB036EF6069D88A3ACF35C104892E69D7D549A35469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645355, "uuid": "fa0ce862-a183-4bfc-b07c-d20f3d9fbd4b", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645355, "uuid": "12328e28-af7c-4b08-a3aa-ec02e6f53fa6", "value": "3072:U58CMtKJlXoDRl4epTGmoAc7iTRilfn6wlYYbZwd:lnClXSRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645355, "uuid": "aebb90ef-82de-44ba-bec3-39acff18747e", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645355, "uuid": "f7098ae3-20d8-42c1-9b11-35dc28496e34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645355, "uuid": "1c59ff7f-e336-4636-9560-f69182f43b6e", "value": "a2022f34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddf6dcb-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621608, "uuid": "cdf7b066-dc4c-4e00-a8cc-1afe75f53abe", "comment": "Malware payload", "value": "e2a5ac3c1290a7061543e04e423c258e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621608, "uuid": "61739bcd-9e26-4002-b6f4-5853858e9898", "comment": "Malware payload", "value": "07a2ef5ca6a6f064bb16a6193b7e61600f989c66c2373d610ab62caa320d1d20", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621608, "uuid": "ec78d4eb-2b6e-432d-bc87-b6fd4ae8bb11", "comment": "Malware payload", "value": "aaae80f8783d1d5abeb07285d8085c4165de1ad4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621608, "uuid": "da5ac651-ce10-4fbb-9c9e-2776c40bec46", "comment": "Malware payload", "value": "6589b9702e716eb0415794c5a855712c0fd2242c258785ed5f7bc48f8f897684f0c0e06f87d01e6d5b9c70d3fa98fea0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621608, "uuid": "acdaedbf-1bc3-4f1d-ae28-2212192a3db7", "value": "B683025043BD479EB8CE8E2968E31E8F3B9AB8F4181614E1795D04E1F2324665F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621608, "uuid": "8b4d6624-6eba-4399-aef7-bbad31d41947", "value": "1536:8DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdND2GV8BAYUwl:8DAysJADlV378P3RPVJLdNDp8BXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621608, "uuid": "2035d525-297f-4447-8983-4b75df7f3a36", "value": 86095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621608, "uuid": "e3043cd7-90cc-45e5-aa5a-9cde4d42df89", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621608, "uuid": "e56e6fe9-d965-48f6-8966-3504229a29ea", "value": "catalog-79130813.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce423bb2-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640641, "uuid": "e106f50e-2b09-4081-9e68-bb7a31172719", "comment": "Malware payload (Quakbot)", "value": "2b85138041370b7aa5862f7d6feeac76", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640641, "uuid": "38925658-493a-4448-87fc-1a7e5a0ac791", "comment": "Malware payload (Quakbot)", "value": "07abce62a89225fc72df6a18cb307ceab0dbe792630c8e3df74bd733f85e8d28", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640641, "uuid": "bb534c58-6039-4cc2-81c4-35fdabc81e88", "comment": "Malware payload (Quakbot)", "value": "b3035a887a828615b3d31da296d90b5118d3a59d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640641, "uuid": "5bf3fd55-74cd-4a4f-912e-0678191e8ae6", "comment": "Malware payload (Quakbot)", "value": "3a420a46e562f54670274abd05c4078eee8ba8171e581c9890f5ea904d7dc1317eefabbe76ea9530805985c2e2df5c23", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640641, "uuid": "01293b8a-988c-40fe-a5ab-2dbde8c086e9", "value": "C0947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640641, "uuid": "0452a508-09f4-457f-9af2-89a9a34fc186", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640641, "uuid": "d1a11d3b-4af8-4b69-9ea4-e51b2b420955", "value": "6144:xyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmJ:FTwr03pdf8vhhOKJET5ByJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640641, "uuid": "c435dfc0-86b7-458e-a4b4-56bf97466eb7", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640641, "uuid": "ce737350-cc57-49b2-8c5f-3cc6a45c758f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640641, "uuid": "25dd3879-5049-4b74-bd4a-2786f06fdddd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac37b13b-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622545, "uuid": "37db00f9-9de1-45dc-a987-788991b508db", "comment": "Malware payload", "value": "45a803a2d0a6df9351fe4813fb11ec14", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622545, "uuid": "1ee0d956-bd28-4349-95da-019c7bdb81a5", "comment": "Malware payload", "value": "07af13f3913be0164755e72bd60eb64f902bd459acbc97ecde38e6fc14496f61", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622545, "uuid": "ee48af5a-872b-40ca-814a-493a95b5ddad", "comment": "Malware payload", "value": "62477361a16e0e2a70aff02c3f1cc3ab34077314", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622545, "uuid": "5bdbe54d-c6ea-4866-ac5f-be62ad3ff519", "comment": "Malware payload", "value": "ae82ac960cdce66f6812fa9074cb58fa8160416299248da51519f69a44e6288a3c040d8a0d20623d793fffcbff385ee6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622545, "uuid": "b8dc3540-e3a3-4c16-a0f7-22f9f184bb1d", "value": "DE8301D9203DC5DF71786B0AB5AC893EBD4D6CB5210064AED4D8266FAD4DAFB9C93030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622545, "uuid": "ccfc09f6-a62f-4584-83fd-4da05292540b", "value": "1536:mG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttcI5EzJKE9LfFSp7mw9:mGEhrHJoEsBMG7qzkeI5AB5gpSw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622545, "uuid": "a0aecd0b-c32d-406c-9d0a-53b82cbdf900", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622545, "uuid": "53057a25-5631-4fbd-bcdb-4f641b7bfab4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622545, "uuid": "0d9b379e-4c40-4d89-8230-4b606df33bd8", "value": "diagram-1448332976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294c8212-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619318, "uuid": "2e5c5978-ee89-4c42-89da-d2cbfbdbdeb7", "comment": "Malware payload", "value": "4ab8d6772be488ff15ec0edfccb51efc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619318, "uuid": "fca94fd1-443d-4f6a-8dff-77f3fb929485", "comment": "Malware payload", "value": "07b91f985155d3f240d7ded718d90413f1bd16600934343e51d971aafb7617f9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619318, "uuid": "a83ca99a-9fda-42da-b307-ae70f9f75f20", "comment": "Malware payload", "value": "cee83a2f68f91bf042eb5cab0de34f9b31df55ad", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619318, "uuid": "24a78bd4-8f98-4fa4-b546-6f75dc1de3e8", "comment": "Malware payload", "value": "cc5f9440e534964628e04f81a548a23a97a4139256d286c67d66f4357c4016f459275685e12bef8a81edaf288fd591cc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619318, "uuid": "a0440c4b-67d2-494e-ba82-3bdfc8fa7d0a", "value": "1783027043FE4F5964CECE2A58F20C8F6F67F9B83D0C08F5665E08959622C566B2853E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619318, "uuid": "c53d9024-9f86-419e-8903-a166043c619e", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdA4h8VP0IsOzCyKBRgEnvF:PDAysJADlV378P3RPVJLdA4h8VnCyKBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619318, "uuid": "3a30c0b6-9d5c-40c6-a165-52ecab1c31cf", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619318, "uuid": "0bf17032-0695-4409-bc5a-492007d4dcfd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619318, "uuid": "40a4d219-afd4-4e18-b27c-3aa237043e68", "value": "catalog-1187969524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff478c53-a810-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619607652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619607652, "uuid": "c4571c1f-2adf-4281-b799-e703cb6b8a6f", "comment": "Malware payload (Dridex)", "value": "4b379875670bbb825d2ffb3056909b12", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619607652, "uuid": "de82c271-6842-4aea-bad3-4b4171ed97e4", "comment": "Malware payload (Dridex)", "value": "07bed606a459dfc0b0926940a9239984846d98dad5b36a2991df33d68fc434ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619607652, "uuid": "d6ace48b-45c2-4799-881d-c8264653ff13", "comment": "Malware payload (Dridex)", "value": "815e138fdd023e52debcd78dd59b4d68dfd98eb4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619607652, "uuid": "b7532d17-5a6c-423a-b65c-2a885b3bf0e3", "comment": "Malware payload (Dridex)", "value": "7ccc211b42824dd04fa579ccac841c4e9933a18b08f5de0594e3d0e4bbc58517a998891ab3ec5bd470b52c1edf4d9fd6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619607652, "uuid": "4c8458a4-ef4c-43a4-ace7-a81a5e8d7833", "value": "3DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619607652, "uuid": "6fc308cf-92e1-4a83-a322-4a038315623d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619607652, "uuid": "c955789e-2f72-42d1-a93f-4de478056d97", "value": "3072:Clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619607652, "uuid": "f5c4888a-bc09-49f4-8744-f86fed8f7fea", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619607652, "uuid": "d6fc024f-739c-4823-b016-0fea1b5925c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619607652, "uuid": "f83a8a8c-3f3d-43e2-9c65-2508213ed0c5", "value": "4b379875_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81924582-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620326, "uuid": "f51dbad3-e235-40ed-a002-2c718a78830e", "comment": "Malware payload", "value": "6ec787d3730bef2e4c272886fada47d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620326, "uuid": "dee81774-abc2-445f-8da9-8df9efa0a14c", "comment": "Malware payload", "value": "07d308cb5f16da5b1abc7846666aff18ae31078161d1644c5561db1d45eb2fdc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620326, "uuid": "11b0e724-8cdc-440a-99ea-52748a2c67fb", "comment": "Malware payload", "value": "9b7241c007528ea4c2a74148a256156cbd686300", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620326, "uuid": "e2975331-4100-4eb2-bf69-5d2508874f79", "comment": "Malware payload", "value": "f23545525f97a0516191d6b4fcc35a3a58edce102be1f6567648a6fafdb56b44b8436c3d143521823d1946cea55185a2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620326, "uuid": "a9730628-3578-4036-a3e9-3d5a434129a2", "value": "6983125413B94A5EB8CE8E296CE31E4F2BDAB8F4191A55D1794D04E1F2374660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620326, "uuid": "f67be0b6-d836-4b1a-bdeb-7f06e5743f5d", "value": "1536:fDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wH:fDAysJADlV378P3RPVJLdP8BXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620326, "uuid": "0cb240a5-9fca-4239-a801-99728cfc8d3c", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620326, "uuid": "1fa1b7ea-c7d4-48f9-99f6-45a774edab52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620326, "uuid": "c1ae5f28-a065-4090-b223-309b0ac0a866", "value": "catalog-1930345383.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbea20d2-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619672, "uuid": "60e9262b-84fb-41a8-b913-c80b68ff844a", "comment": "Malware payload", "value": "7d14c2ecad85d68448d3209b58e2a114", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619672, "uuid": "e188556f-4df0-493b-993f-6a17ac852ed1", "comment": "Malware payload", "value": "07d3f6f507fda329c83f0aac49feddaacf4ff997b3fc2c8913e4a33886eb3844", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619672, "uuid": "b978f074-aef9-4441-9480-3d7b780ae56b", "comment": "Malware payload", "value": "cabe5b5824fc69dc524a16e817cb556114485962", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619672, "uuid": "84ac08d0-94b1-405d-80cf-cfa2316f3de1", "comment": "Malware payload", "value": "287143260f9092b32abe3eafd896e353325a61cd5884be8db2ee265feeaf36a3ba4cce42baecacd419707373548f1ce5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619672, "uuid": "86596b7b-3e4a-4270-a798-fb4f03a086cd", "value": "E683125453B94A4EB8CE8A196CE31E8F279AB8F41A2B55D1795D00E1B2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619672, "uuid": "225033e8-bf5e-41c0-a279-14d728a48d38", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdeIkGV8BAY0wl:DDAysJADlV378P3RPVJLdz8BXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619672, "uuid": "f7ff687f-1382-4e32-bd7f-2a7f2363e3e3", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619672, "uuid": "ff502038-af14-4da1-9675-822a95e7fabe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619672, "uuid": "7e0b8fc4-0e38-406a-b498-cfbaf2e10a75", "value": "catalog-1422276229.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf8804b-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639293, "uuid": "a979f86e-a0fc-42d4-89fe-ca12f9d2150f", "comment": "Malware payload (Dridex)", "value": "f5e52378978b327198e21fd8d143fa7a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639293, "uuid": "14eb4e55-ba68-4536-ab48-ae6d5db84af9", "comment": "Malware payload (Dridex)", "value": "07dd0f430f11773bb0267ede40a074c9146e15aab7a1fc0f22032e2c666f1199", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639293, "uuid": "45f558c6-fcf8-44ee-a6ff-2f2ec4daabb0", "comment": "Malware payload (Dridex)", "value": "c3fd648471e29e2c1d09e9c7f6e3c3f3fe45673d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639293, "uuid": "6fe84a06-0b88-422d-98ab-abacc16d4b1c", "comment": "Malware payload (Dridex)", "value": "2cd1f0a2ed9cbb925dfb647a5bff849b227d37a25bc2173fc6106d2b3272513913162c8aa53c7b6cdfd4aa5d75d3cc77", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639293, "uuid": "b498d012-35dd-45ed-8157-b91066e31101", "value": "87F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639293, "uuid": "453ad096-c1a7-4031-9eaf-7b64818ccd20", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639293, "uuid": "61e86800-3585-4095-8bef-98ec1baa6752", "value": "3072:LoSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2aGkFY:knS62Fl+pkeJl3CvRStrFl+EYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639293, "uuid": "801597cb-fc2e-4c63-8d9c-251768e970b3", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639293, "uuid": "78b9f66b-f748-470f-a34a-f70919f11429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639293, "uuid": "11e93fde-d5d6-40ee-90f6-069435d2dac3", "value": "f5e52378_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ba8065-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620277, "uuid": "3a480de0-93f3-494d-be83-9880dfe57c34", "comment": "Malware payload", "value": "99ae0bf3f606e3871a9134a9186e007c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620277, "uuid": "7ece5848-07ec-49f3-9f1f-111c4c7dcf97", "comment": "Malware payload", "value": "07f71abd4c1443d35fc3dfdd5a2005081668bc1c40bdea5b9a853cfed076cf54", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620277, "uuid": "3cccee70-645e-4763-a266-ad679069ba3a", "comment": "Malware payload", "value": "fa58607e94f16c14612943a0225837d897f13ea0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620277, "uuid": "39aaa485-bfac-4c2f-8e86-0d48f1ff6b34", "comment": "Malware payload", "value": "dfe84a13246fec7b3e9f3ce9dbd7ac0f9bd952e877ee381263687217ef83b9ea971ecb8226768f1931936e7990567c80", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620277, "uuid": "99144e43-0850-4797-8d3a-fd88b6d5f598", "value": "6083021513BF464DB88DDB3D4CA30ECB2F57B9742919A8F2A45D04E8F6338521B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620277, "uuid": "95c4e413-bd09-4c8d-9dc6-0dcda78e82d3", "value": "1536:lDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdWRP6sCO0Py7:lDAysJADlV378P3RPVJLdY6s90Py7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620277, "uuid": "b6c0f1a0-b72f-4752-9c1b-d010b88a994c", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620277, "uuid": "18a57ee0-1187-4921-876b-b12d4d564b60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620277, "uuid": "6160e882-0b28-4b9e-b84a-4cb7f2d62d96", "value": "catalog-1888694483.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beee6d47-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621717, "uuid": "b11e6593-1979-47de-bf52-d7e48f51ec4f", "comment": "Malware payload", "value": "b6557ac489483f8bc2de59ea9d48d12f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621717, "uuid": "e218fcc4-8dc9-4713-a52e-a8babc7dd1db", "comment": "Malware payload", "value": "0814fe5f6a58b9ff2e50a014caf1b4a498b6795dd1fd11a9bda2bdd8e1d1067d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621717, "uuid": "5d64e11f-e99e-4e7f-a07a-e953d8be9f83", "comment": "Malware payload", "value": "3279cb7d83b803e40266a98be7f630b32d5cd5fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621717, "uuid": "08534818-0971-4808-b45e-bdc4173d7fc4", "comment": "Malware payload", "value": "45006bc81ff0292356b72ee57c1037f7b3f200ded8438706ff5023c8ee7e19f93ce1b476fbf9e45fc222ebc174af289a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621717, "uuid": "4abd7a60-7834-4520-9aa3-5326fff6fdc7", "value": "2683125453B90A4E78CE8A196CE31E8F379AB8F41E2B55E1795D00E1B2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621717, "uuid": "ee2e96b2-39dd-4d53-989c-e4ddf6ec043f", "value": "1536:RDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdeIkGV8BAY0wT:RDAysJADlV378P3RPVJLdz8BXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621717, "uuid": "b8d77f73-fd3f-4c14-8fc6-a277a7dd5b5a", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621717, "uuid": "a678c36f-ca80-4afe-9966-e868f35508f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621717, "uuid": "3a9e9b9c-d451-475b-9cae-47d3e08fa2fa", "value": "catalog-873915417.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1adeef9-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624782, "uuid": "704d1cad-2fc0-4a76-a269-66d15726cb5e", "comment": "Malware payload", "value": "fa590de2831bbc15263ea657392f959e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624782, "uuid": "0e6aa33d-8a6b-4619-b24e-866b8469ecf0", "comment": "Malware payload", "value": "081a07f619f9408221be6d609561f66fc78623ef79891e3739b517a2c8c5eb78", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624782, "uuid": "a5eb253b-b89f-4727-b7f2-4f153e2ac093", "comment": "Malware payload", "value": "dfb91dc2b5916cfe68da68cf6e8731314999d8b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624782, "uuid": "4f029159-e6a9-48cb-87c9-f6be815998c4", "comment": "Malware payload", "value": "1639dcb5e76b404d3d941dd560d124bbe159ddd64a80c161f3719560223c451cc14184592e5753635aa0482f30e43818", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624782, "uuid": "f3d17604-b6a8-458f-b9dd-8bf5096e4c90", "value": "178302A453BE0A5DB98D4E2DACB20D4F3F66B674390E58F1B91E0485A331C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624782, "uuid": "f60b746a-f293-4a36-9738-db76a3a46cdd", "value": "1536:/DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLddhsMnSEwJPTmw7tKd:/DAysJADlV378P3RPVJLdrxpExsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624782, "uuid": "e253f589-5dc7-459b-8e33-c779b834b205", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624782, "uuid": "dbe0b992-bd24-4f14-846f-11d51e03c4b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624782, "uuid": "8ddbbe81-7b27-464f-b9c3-add7c5b88f57", "value": "statistic-1003865613.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4eec9c9-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646289, "uuid": "61e95c10-a89a-45f4-ac78-2f9d2f7b218a", "comment": "Malware payload (Dridex)", "value": "c95a141cacb7b4beae8ec804c734cfe5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646289, "uuid": "4b4426d5-0608-42db-958b-50f8fb129906", "comment": "Malware payload (Dridex)", "value": "0820b145e4a065fee971e331e8b86f8b4271de0c2bf71712c68d17881cb4ab4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646289, "uuid": "455888d6-db61-4395-960f-882d595456ec", "comment": "Malware payload (Dridex)", "value": "c2f0e2fecd2bd44a02fce995b000b8afc0daadba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646289, "uuid": "ed8a2ce9-89c2-4332-908c-398389623079", "comment": "Malware payload (Dridex)", "value": "8bf8fb34a0f6b8ec6605981248bd8ee442ab438d26931dfc47101bb40439f74ed03b55e779b44b329a4934edc4e7e0f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646289, "uuid": "774fd87b-0873-40e9-917a-83317cb317ce", "value": "88F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646289, "uuid": "1e03230d-373f-4908-bddb-88fb779ddf45", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646289, "uuid": "e7b25aa1-f445-4930-8d49-cd8dd9f0b35b", "value": "3072:KnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:py5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646289, "uuid": "559bd2a6-4957-409b-9798-655c927a1d6e", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646289, "uuid": "3fba2fcc-c010-46a6-b8b9-b906cbf84c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646289, "uuid": "3731bda2-7330-433a-aa5c-68924480c771", "value": "c95a141c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26db2ad6-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621891, "uuid": "b28311e1-07d3-4c04-939d-ccb009982adf", "comment": "Malware payload", "value": "2f8afab55f041623c92937717b64afd9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621891, "uuid": "5efbf64d-a7ff-4c4b-8a30-ad7434957f05", "comment": "Malware payload", "value": "082b0cef45550b0135de38d5c9f9dbc210e61b966059bae1f30cc2b75d431939", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621891, "uuid": "4c4a7009-6adb-4523-9d6e-e2263a78b7d5", "comment": "Malware payload", "value": "6a7e9c8d41803d81b5b309a9ea707314c345112a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621891, "uuid": "4b6c0e6d-ae64-4203-8b5b-81b36fedec26", "comment": "Malware payload", "value": "e3aad28480d43dad348c8fbe3e40e788c60cb2fcf278ef3e4f6437ccab5762659f51ccb0410e41d0552088cd09434e7e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621891, "uuid": "0d05609c-12be-49d3-9a6d-7fd056394210", "value": "7A83122003FB5F4870CD893DA8A26ECF7B6AB9F42C2E99F1525D0456E027C961B2447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621891, "uuid": "7d18046f-11e8-4dba-9fca-db2c9b3dbf49", "value": "1536:nDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd8cZ8VzpIsOKwc:nDAysJADlV378P3RPVJLdnZ8Vwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621891, "uuid": "0411937d-d550-4f04-93a5-81c37a3e75db", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621891, "uuid": "c2450dcd-7ab0-40c2-bd1e-1ac611710e64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621891, "uuid": "ab1c779e-71f4-464f-9831-26c2c48b4d4a", "value": "catalog-995379235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a95000-a7eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619591360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619591360, "uuid": "683b1602-7f77-4b55-ba75-58fb2a6775ac", "comment": "Malware payload", "value": "2668bb898cd422ebf4c4dbf0c83eadef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619591360, "uuid": "53c8c669-4096-4af8-8c4d-0ae13f56e6d8", "comment": "Malware payload", "value": "08338237d153e10608bcd2b79c1cbe7ef399ccdfb8b1848cc3431fd94f1e698f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619591360, "uuid": "6fa3e3f4-9820-4ed7-ad89-1d22d885a096", "comment": "Malware payload", "value": "0f63f4921416b9e6937cc49aae77441a83bf2b6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619591360, "uuid": "ac39b931-949a-449d-8e4f-188ab091b175", "comment": "Malware payload", "value": "20f7d9f3f38e8e914cf6f0d2022b50cda1519267c19a5708a36e9a7b1e38eb400611221c728e0dc9b11e9703bb3a0aff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619591360, "uuid": "fb1f323c-580a-426e-a165-bc091d03d5af", "value": "E09428A83A80FC175A9D1D83FE52AFFD412299638699218BC7687FCC0DF8193C565CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619591360, "uuid": "7d5e07a9-945c-44e9-ba6a-dc5988558e07", "value": "12288:rOZXDZ1uh7AXQGfC4FZw2Cw5GfpRx6ojwsSfi:rOZXDZ1uh7AXWwsSfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619591360, "uuid": "f19579bc-3f26-4ed5-b085-e6f143d775be", "value": 422123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619591360, "uuid": "07aebff4-efd9-4ad9-b491-568f0dfd0b5b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619591360, "uuid": "be3230e6-e152-44c3-8014-51548bb648ac", "value": "D0CUMENT0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65d1bae-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623931, "uuid": "a9e06ca1-a2d9-4c6e-9086-de654f34f9df", "comment": "Malware payload", "value": "b1203e3361f80a261d092cb1e240ac0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623931, "uuid": "bc3e6a82-1bbd-49ba-9da6-8a216e98c5f7", "comment": "Malware payload", "value": "08491021716874e838be7e3c983e7996ac22d0af51a7ec9bcab38258a671f7d7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623931, "uuid": "d81cd142-9bc1-406e-b739-9902ae99771a", "comment": "Malware payload", "value": "cf4d277b657cc710deb164569919b409235361e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623931, "uuid": "82237fc9-6d5c-470c-8312-00ed09462454", "comment": "Malware payload", "value": "51bf5cb403902488cf032ca6ef9fb3c827d7e4f1f1321130e72f0f99517101cb36ea3fffc9c16c9d792de08e47edc2f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623931, "uuid": "812116a9-3023-4216-b6cf-f28b30e7da03", "value": "898302CC313DC5DF7ABA2E0951DC887E740EE8B42108154ED8C86A6F9E8BFE71866560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623931, "uuid": "d201099f-39ab-4801-b0ce-381b191a1403", "value": "1536:FG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttEKkApVr6wo+Rx2k7:FGEhrHJoEsBMG7qzkaxApxT2k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623931, "uuid": "43ce428e-81a5-4cb9-b1a5-bc400607446a", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623931, "uuid": "e3786d6d-dd02-4aad-9767-cbabfec27405", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623931, "uuid": "87fe273c-fe0d-4250-ac1a-7853f9eab135", "value": "diagram-512097500.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a21d74-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619336, "uuid": "8af37030-2fca-4400-9913-66cca617ad5a", "comment": "Malware payload", "value": "db9625cfefb75e9707bf96fc211fcc96", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619336, "uuid": "e79dbfdb-3721-4e9e-9aaf-f4537055400a", "comment": "Malware payload", "value": "084a7801a61d827d53794b8f59ed60cdbc6a5db822b20f1dd3f15809c371aa31", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619336, "uuid": "0d286ba4-66c0-4aa6-b21a-ed99eeecf878", "comment": "Malware payload", "value": "21b0f631c47ed598eccc92d87ad27886d4930db9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619336, "uuid": "512969b1-d8a5-4621-8346-916393be7f6c", "comment": "Malware payload", "value": "0879e855035e2fc738e95aa736822650ef9b409b24deec97b19eaed7128fcc4ffb30ba80db9bc1ad4dde61eb5f628e40", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619336, "uuid": "93abadba-578f-4684-b94a-9d1ed210204c", "value": "B783125023F6CF0CB48E5F2D98D21ECF3E57F8B9251DA9B5212904A9E616C460F2057F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619336, "uuid": "acf9c698-aa65-4319-977e-b97aa0e67d62", "value": "1536:1DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGDpEDP9+jAJu9:1DAysJADlV378P3RPVJLdGDps+jAJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619336, "uuid": "3510c96e-34dd-440a-97d9-29349bed747d", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619336, "uuid": "f208f62f-7609-4136-a737-e3f2a7c4efa1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619336, "uuid": "ea5595ac-eeac-45f3-a6ae-3db8deda0ad3", "value": "catalog-1204279589.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b89d99-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619871, "uuid": "c7de7fab-3a73-4da7-9ad5-aa572b4cc8a5", "comment": "Malware payload", "value": "863e38058a3e0901a1e45419aa23ce4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619871, "uuid": "a3079a96-5dad-4fc3-94ec-c9842a9cb6db", "comment": "Malware payload", "value": "085abeaec0227633455ee07d27a7cb5d2c7279730880abd87090d421945a1544", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619871, "uuid": "c08d66ad-ce1b-47fe-bb56-82db4cc30743", "comment": "Malware payload", "value": "04132aab0fa59099ac1143dd46cc72d9ee3f1034", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619871, "uuid": "c859bd24-43cc-4726-a388-887b505b5d7e", "comment": "Malware payload", "value": "3a144ec8744bd75f2eb1b4c85120fa7f6b9a03faedfb79bf1887f065caffb0d1c65e7dc3a4f912c6d92ff592616040b6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619871, "uuid": "1a0f072b-886e-41ae-94d0-21a46c138152", "value": "A883022523BF464DB88D9F3D9CA30DCB2F57B874251968F2A56D04D8F6338521B28D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619871, "uuid": "76ba6429-186a-4396-8a82-d457cd6c8da6", "value": "1536:/DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd+RP6sCO0PyE:/DAysJADlV378P3RPVJLdg6s90PyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619871, "uuid": "ea671c68-78cc-4b05-b9f8-a137f841a45b", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619871, "uuid": "ca6e0ecd-5d4c-4b9c-8a1f-3187db9b4b35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619871, "uuid": "6bcc7b0e-6b46-42ec-bfb5-9268929d7246", "value": "catalog-1591808591.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3b0067-a86e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619647618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647618, "uuid": "810f4ffa-c3b3-4228-9fd1-a466da43ed02", "comment": "Malware payload", "value": "19864df4165b89c0e25f02053e6feb95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647618, "uuid": "413a70ed-56fd-4d4f-8652-4ce8e6d7a96d", "comment": "Malware payload", "value": "08659f4e3fff51526ed785418d7da01ea83d79bd08dee641d6c339d2a50ddd48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647618, "uuid": "c0e1feb1-4b1e-480f-a7a9-98e3d8c8146f", "comment": "Malware payload", "value": "50f37ae1120d92cd56659f59435758f725a1cea6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647618, "uuid": "393fb383-f972-476c-a4d1-eea23a6bc5c2", "comment": "Malware payload", "value": "90ed7cdaf1631bbd5b58e7b35b6ddce4617ec4127fd94d1c1410f1e67f1772fabf62487f664b3568524c84524e8ae161", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647618, "uuid": "27824a94-ac04-4f89-be3f-5eeaee7b5256", "value": "3BF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647618, "uuid": "cd757bbe-2915-48bc-849e-1b7975fddc06", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647618, "uuid": "45ffe1be-75ee-47aa-84a9-136d589269b1", "value": "3072:QwT2d85tleLD51fC5AHYEoefukoTFMpGmjE8D:qy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647618, "uuid": "2b864ad7-acf2-4bd0-b565-78141a5a024a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647618, "uuid": "615aa7b8-d453-4681-b9d5-ea1ad8a46c07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647618, "uuid": "156ea53e-007b-4d3e-92a8-8f3b952eabe9", "value": "19864df4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c179a631-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626875, "uuid": "0a43c16a-d965-4d3a-9c96-5ee70c13b6f4", "comment": "Malware payload", "value": "0f53f17311ddfd294e08a8068d5714eb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626875, "uuid": "3cf98846-494c-4b28-aab6-b3f5ed2a8ec6", "comment": "Malware payload", "value": "0867e7071a4fcb7dfbd8061b36bbdc0f8117b049a0433d32c04a846e7bb6c0b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626875, "uuid": "3dc883e8-d754-45cc-8d12-087cec855ab5", "comment": "Malware payload", "value": "b37ba912e60c850c49f1f34e368806c1a40c9aaf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626875, "uuid": "17c702bb-b4ed-4cc4-8092-76491b748d49", "comment": "Malware payload", "value": "4e2a7a3d7ebafc412279a7e7f812ae25f526be8d5753267b29feb0c38ae4b336722e575a7f0a534c77f9c3a90e12b6d1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626875, "uuid": "ecf37e6e-8f7b-47a4-8bd7-9b6bc573cb70", "value": "B78302A443BE4A4DB98D4D2DACB20D4F3F66B6743D0E68F1B92D0485A231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626875, "uuid": "5d5996b5-9375-4206-8a21-3a37dea4a438", "value": "1536:yDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmpL:yDAysJADlV378P3RPVJLdBxpE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626875, "uuid": "773b91b2-0503-44b9-a112-fa40a6cd68a6", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626875, "uuid": "c63c5592-e647-450f-b0f1-7e3caf8c0312", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626875, "uuid": "1ae24028-9f17-4e80-ae41-63d09027cce3", "value": "statistic-557586619.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056cb81d-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624842, "uuid": "e887851e-24bb-4509-bd98-9cf05f0ce204", "comment": "Malware payload", "value": "2fca14af494d307c825646c04044b325", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624842, "uuid": "dfc3d560-38da-49c3-88e3-5d92285497af", "comment": "Malware payload", "value": "0868e78f1d6182e8b769048d35764c967cda9857d373d8cb9085a623a63fc625", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624842, "uuid": "75b8d22d-212c-4f04-bf4c-54ede4f004f4", "comment": "Malware payload", "value": "a7986da306d28b4c20493051a875d532a2d469e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624842, "uuid": "2abc2a4d-6188-477a-8fa5-48636d087073", "comment": "Malware payload", "value": "2aa26f6576dd564469437a9eb085114e86cabc8ab7fead911e5b7252b9a4cddd168796c463bd60686f005dfeff9e8c76", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624842, "uuid": "03d11cd3-3848-41fd-8edf-9500881b36c3", "value": "3F83021163BAD998F48DAE2D4CE30D8F3F52A5742C1ED9F262290199E327C964F3053B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624842, "uuid": "1e32be0a-2ebd-4a3f-959d-e7277d2e4b07", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2CJG:CDAysJADlV378P3RPVJLdCqXjqJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624842, "uuid": "b7b79060-c5d9-4644-aca0-0275ab99adac", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624842, "uuid": "10dff81b-9930-4aa0-8a4b-4aaa0112a71c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624842, "uuid": "ebd0c7e9-eca4-4e2c-a418-665b01b03b42", "value": "statistic-1049163105.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77fe77e-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624282, "uuid": "b7cf59fd-472c-4196-90af-075513fe7106", "comment": "Malware payload", "value": "fb3fd1adf5f6e47c62b0d42f4ca16473", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624282, "uuid": "a461a2f1-12a5-4314-831c-0061341e8738", "comment": "Malware payload", "value": "086dbae961c47e5623c9d5a1543f02cf61c6558e3415f7352efb8004a3196345", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624282, "uuid": "014fbe85-d48f-4c6d-ac8f-d8b6edec2b7a", "comment": "Malware payload", "value": "fa06ce915bf1a6d37aa357c7707053525c776694", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624282, "uuid": "017fcdcb-32a4-4462-96a5-007cd1220ea0", "comment": "Malware payload", "value": "5f69425f0bbeaae482049eaf5123c52542ffc600fc955b983f3169818b44efe76fdad39bab6884a705e6be275f9f666c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624282, "uuid": "e76923aa-0956-46d8-a372-7454fbe5aa36", "value": "798302CC6239C9DF717D3E4AA6D8C43A790E98B93040389DE5C066AF5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624282, "uuid": "9d8b2d4e-6b3a-4bc4-97d6-3ef234524434", "value": "1536:+G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGr4:+GEhrHJoEsBMG7qzkEEVerr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624282, "uuid": "9ba70e0c-b356-49bc-b133-55c08999ed04", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624282, "uuid": "9d0cdb1a-3537-4f38-893e-35926f26a5bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624282, "uuid": "a6a6b7d2-c503-4e14-9b4e-51f568ce2d65", "value": "diagram-657050686.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b94459e-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623134, "uuid": "7fdeb13d-e36a-4d04-9add-ebb9f587f582", "comment": "Malware payload", "value": "04542098afe8f79ffd2e946e28d13b3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623134, "uuid": "a07f3704-32f4-44ff-8c9b-67f5e9146621", "comment": "Malware payload", "value": "0875c7ed80a6c926f25b6c9173cb818bb22543627c75521f5f8a504e47b612a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623134, "uuid": "6f2f6f94-58d3-4406-9f56-5e96a3849f04", "comment": "Malware payload", "value": "a404062ab1054b3ec654c92ad40896c51996e9cb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623134, "uuid": "62c8f7ff-cd7a-4cf3-9ccf-99e8385d3b70", "comment": "Malware payload", "value": "dd41a4be2fdae9a19a7479aba14904699478e0aeacbd52d491098678eb62acb7a41fed68c7712c00721f7060005ab01e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623134, "uuid": "7ca2a993-bf99-4e9d-a3ce-8ca194213910", "value": "8E83128C653DC6EFB1AD2F09A3DEC47FB61EFC663044248DC4C866A65D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623134, "uuid": "ce114b69-6711-43a8-92f8-bb46458b4e4e", "value": "1536:LG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttie6n6475e0NEnP61N:LGEhrHJoEsBMG7qzkE4q/NEnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623134, "uuid": "396046cd-55b5-4149-9cf5-038cf4b149ec", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623134, "uuid": "9e8fbdda-b2b5-4e50-bec0-ec347146bf5d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623134, "uuid": "d4f0a750-5f3a-420d-9624-3c9ed961713d", "value": "diagram-1886011565.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359a2bd7-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622775, "uuid": "1aa8d0b7-2a85-46e9-8f91-78338f02b497", "comment": "Malware payload", "value": "1337f4ed80dd9cb9afcba2eb09abf062", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622775, "uuid": "66c54b41-43e0-44c7-9852-52974fb70aa6", "comment": "Malware payload", "value": "0876ba49060e6b30819be1933db660e5d39e94738456bdd0001184b2326c7478", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622775, "uuid": "a271baac-343d-4605-ae9a-ae926d9b9d40", "comment": "Malware payload", "value": "a032c09f75b0a4ea05c61b23e87f3b5497b74858", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622775, "uuid": "a8db956e-269f-44db-92fa-16fc349a6a48", "comment": "Malware payload", "value": "d0f42d9bf8e8b336b3c75dc8761ecb873265b88f6975e01dd2365092aa3d3372016336dccd67820aab9aeb8c746c70d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622775, "uuid": "906a4f38-d969-4c7e-88c3-1d098ad606bd", "value": "E983028C653DC9DF7ABE2E0991CC887E740EE8B43148154ED8C8666B9E8BFE71857460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622775, "uuid": "e0504a4c-daed-478c-9e35-af9f59529ae3", "value": "1536:HG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt4KkApVr6wo+RxM:HGEhrHJoEsBMG7qzkCxApxTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622775, "uuid": "bcdf93cf-64ff-446d-b6a1-8499e92b3219", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622775, "uuid": "1c526b0b-0faa-4717-a68c-8d0116218eb8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622775, "uuid": "39016f96-5b9a-4201-b470-daf29e1c1105", "value": "diagram-1638362977.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4ad760-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627239, "uuid": "86647256-2cef-47d8-86d3-7023743b8570", "comment": "Malware payload", "value": "5aa8fe17b00da1c4ed5b79dfa77719e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627239, "uuid": "683c208a-14f1-4ef4-adb9-098967db270c", "comment": "Malware payload", "value": "087807aa6db444986c0c8b7b9524522a1139817dd524dd20a89f880f2834f113", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627239, "uuid": "a036e390-732d-48d6-bc4a-7fb79db08d29", "comment": "Malware payload", "value": "f0049fbf9d6a6adaa52ca8a84cfb0f92677f3a78", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627239, "uuid": "aa0e3f60-0afa-476c-a592-728fd31144e4", "comment": "Malware payload", "value": "5e33d56d7753393be6d59f624fa06477c76cc2cf93e3179dca3f2c73f3e8e4f9c643e8d0f4298b6a3b4cebdaa7e33f5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627239, "uuid": "2e42bb41-3fd5-4321-bc70-bd692b284474", "value": "8383020813BA4909B5CECA2D8CC31FCF3F57F8B815194862A55D0199F627C6B9F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627239, "uuid": "f9efb15d-5552-4380-a86a-e46936468481", "value": "1536:cDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n1vH:cDAysJADlV378P3RPVJLdcKu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627239, "uuid": "719ca014-b9dd-4397-bd29-cf94894cabfa", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627239, "uuid": "67bc2674-4b02-4dfd-9319-2831644a6186", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627239, "uuid": "ada11540-6050-4f85-a36d-a9bf385c92d3", "value": "statistic-793814166.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25e0bb0-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626018, "uuid": "e73bbbe2-0a4f-4474-a595-202f0071f216", "comment": "Malware payload", "value": "751a4d19571c2216d6abd1ff61f23a68", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626018, "uuid": "7e05be7b-304c-4f98-9f0d-a63ed167b2d4", "comment": "Malware payload", "value": "0881cf13ab3367e3cac761ceee23a1182aeb2e5e81206c8e01933804cd693f8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626018, "uuid": "741c87f2-3360-498f-9945-632075a3eb38", "comment": "Malware payload", "value": "5bad0d3fcc41cef284b8c5af3aef4de15a69acbe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626018, "uuid": "dc7fc2c7-c2f5-4aee-bf73-442e4b3ade05", "comment": "Malware payload", "value": "3a3eab83c2b21dab573c9c75d9fdd417db613350e4a046fb2e8ef3cf7963d7734756efc14a88fd6da9fae066d842e581", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626018, "uuid": "b40c8026-c0c5-4f1b-89c9-cc20a96a05f1", "value": "72831260037A864D74CE9D3D8CA31DCF3F66BAB4352E5DA271690498B626C510F38A7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626018, "uuid": "ce4adc23-dada-4f3b-8210-364ad04563f0", "value": "1536:IDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd8Np7Ctdn77/ctKx:IDAysJADlV378P3RPVJLd2p7mdnn/csx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626018, "uuid": "14b6ea91-f8a3-4e8d-adb5-62f6ce117f55", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626018, "uuid": "29a659ab-18cc-4982-b619-82ba9679273c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626018, "uuid": "d456d87e-63cc-40fa-b39d-af8585402735", "value": "statistic-190415255.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709f1a17-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645208, "uuid": "3ce24078-afe0-437f-8c27-d923a2e8ddbe", "comment": "Malware payload (Dridex)", "value": "c19228e6ce5f47cbc7b23a0d4c7db1e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645208, "uuid": "e6cd3c9a-0971-4df0-8be1-52915f95485f", "comment": "Malware payload (Dridex)", "value": "0891c3a1b6905901a0009381711deaa315741c49bc69e7ce98761a5b3559d686", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645208, "uuid": "073b352d-70be-4c50-b137-ac61986be8a8", "comment": "Malware payload (Dridex)", "value": "3dcf69c9d4e0a661a98d4af089f1713bff8ecb2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645208, "uuid": "1f5f462f-4423-4515-b9a3-3c5cec370bbb", "comment": "Malware payload (Dridex)", "value": "ea0a1c20280e82b444b27569cef322fd3210690953b5971b9106a8794124d6fcd0055ae7a003c7d502a7ef74f2916aa0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645208, "uuid": "9612ab6b-d295-466f-b29e-3e3ba0a38c15", "value": "BCF3E0D2EA8BD390F5DFBC7E385B367063B999498603C45F85A94DCE9173248B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645208, "uuid": "1b59d357-0f14-4789-9c4e-7173e8fd67c3", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645208, "uuid": "0ac1467c-3f8c-4ca1-82dd-ea8ef20e73a0", "value": "3072:B1Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2HGkFY:7nS62Fl+pkeJl3CvRStrFl+EYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645208, "uuid": "8f7156a5-9b54-450b-b236-afb9f359d90f", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645208, "uuid": "e6ba0735-7714-48ae-b351-3578ab2b47b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645208, "uuid": "cbfb293e-4666-456a-b7d5-52528d2acfd4", "value": "c19228e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1281b5c-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640645, "uuid": "cca1400f-1881-4945-8506-c19b41bedd4f", "comment": "Malware payload", "value": "e0298b61919dc2c7c822f7f2300b8e88", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640645, "uuid": "c565b005-18c0-41c4-a72c-5f15ec470a4f", "comment": "Malware payload", "value": "08a2007380527771715328725a1f544e16eadd7897b7add1af91507373cc9334", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640645, "uuid": "00bed10d-9579-49c5-a29a-d3e5a0302d76", "comment": "Malware payload", "value": "8ef5eecce3d249cedb7e477cb9cd6bb285807764", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640645, "uuid": "7694286e-f606-407b-b783-3f8c177d36c1", "comment": "Malware payload", "value": "0101507d73e3387bdc1dfed9a5b1bc4861485c2a214acfb3374d5f4c0aa855cbd908dd569aee59f48ae009747c941c88", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640645, "uuid": "5f39434c-61af-44b6-8648-e07f8ba36a38", "value": "BA948D396A26E063D27C27B183C3EF541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640645, "uuid": "5bcd0fd8-fd4f-4925-8084-a3e229d8e897", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640645, "uuid": "d1224c2a-783c-410e-a923-e525f8651367", "value": "6144:3WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmVZ:3WrsTwr03pdf8vhhOKJETlByv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640645, "uuid": "1ffab411-5275-43b1-8f5a-fe9987f5fa08", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640645, "uuid": "3dd59f43-2528-447c-93f0-5a718ca5710b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640645, "uuid": "1a75a63c-4621-441d-a2d8-f5816d8c9486", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7589defb-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619876, "uuid": "aa31d812-686f-4311-bfa0-7c54b0dd4212", "comment": "Malware payload", "value": "e9e62d0c2173ed269f2e7434cb39500b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619876, "uuid": "ba55aa21-ec54-453e-ae21-4117e8bf129b", "comment": "Malware payload", "value": "08a228a4d91e703478d13c52e2d439970a89a2f12a8b41b5f4216d1526174f29", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619876, "uuid": "3085df03-753f-4921-9df0-37f1c31de2c1", "comment": "Malware payload", "value": "b724a2b2ec15d4b4922d0d40c6cfe15b20ee6dbe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619876, "uuid": "f7630be9-2ae2-467e-bb52-0ddf34ddd7b4", "comment": "Malware payload", "value": "6205668e8c457239c64abe402d9307178038a13590d0fe546100ef9bff95eec4b1367ce48aad86f722abbaa2484ecfcb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619876, "uuid": "61dd872f-2818-4304-817f-0f5b79647fe8", "value": "A483025053B9469D7CCE8E2868E31F4F3BDAB8F41D2618E1794D04A1E23646A5F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619876, "uuid": "6c54ce2b-344f-401b-85ec-a44b5cbf3f3f", "value": "1536:MDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdND2GV8BAYUw3:MDAysJADlV378P3RPVJLdNDp8BXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619876, "uuid": "4a01aa00-0432-47c5-8b99-cf1b26e6f9dd", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619876, "uuid": "d1ac31e9-8d90-4d9f-adb9-e9412870f8cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619876, "uuid": "43f43f78-2b4e-43e3-8b98-e962173c6ba8", "value": "catalog-1592398462.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c5ad96-a84d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1619633454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633454, "uuid": "5b23bdb8-36ec-4032-a516-6683132576c4", "comment": "Malware payload (Sodinokibi)", "value": "46a40ec6d39b7530830f3047cdebaa1b", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633454, "uuid": "003b7ed8-8366-4961-bdc2-8af879182965", "comment": "Malware payload (Sodinokibi)", "value": "08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633454, "uuid": "cb377359-13d7-4a24-934b-74ababca57dd", "comment": "Malware payload (Sodinokibi)", "value": "a1540914b5ceb9e772ee5898e777f48e3cd57010", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633454, "uuid": "75dc6f53-f567-4e19-bc22-d6d3af0936e3", "comment": "Malware payload (Sodinokibi)", "value": "5d49db1355c2207a6c7d0311c24d9e40721ebf46da868c47435a91afa797c251ed15201f5241b0621f1058b942dbd5a8", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633454, "uuid": "68ce8e70-234b-4736-b1e9-5cd2f09d080f", "value": "08C3D013EDA142B2D94381F3132F7E1BA8BEFE32292114AAD3748C844EA15D1B71A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633454, "uuid": "7ba23208-e6a2-4f51-b75d-9876ddd2e613", "value": "1773b678052e6f869c847b76b50752a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633454, "uuid": "62535d59-4cd5-4b23-8bfb-bc8170e5b7d8", "value": "1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZskecjrzgPujd:J1MZwlLk9Bm3uWqgu6M1njIXi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619633454, "uuid": "6e9965e4-e106-4446-8b8c-ec3284ecfaa4", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619633454, "uuid": "384aba8b-a3a3-438a-b609-e0f6bcd459b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633454, "uuid": "15abf133-4818-4dc5-b427-3de14bb20578", "value": "46a40ec6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb10347-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619163, "uuid": "c2ce9772-4443-480c-b3a1-7801a4d214cd", "comment": "Malware payload", "value": "6b63464575214ef2e7e65826cda2b1cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619163, "uuid": "41ae6bb1-b01f-42fc-804c-77d8a7d4579e", "comment": "Malware payload", "value": "08cda3bfc018def5529d877c43351ed0ef856d2b2ba96c8db7748432a11f3c7f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619163, "uuid": "2bdbd552-77e2-4adc-b827-b6031d00f8e3", "comment": "Malware payload", "value": "f40e17c39670e13eb2ae5c1214b855934e1c2bdd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619163, "uuid": "fdec4c70-5a27-43ca-aea6-bc078c898846", "comment": "Malware payload", "value": "a6c1859a0da5f60beca028180eafea8a7be1afa78ada28b09e6cf041f9fb2d06dd9b7b27ffc5f294f00bfd039d7653b4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619163, "uuid": "38d54432-7538-4623-9af0-677f68d70dd7", "value": "84830250237A074CB4DD9F2A5C731DCB6F57BCB82509A8F3905D0498F6238526B2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619163, "uuid": "6551e442-251a-47c5-837e-0e6c73808a6e", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsR1EPCO0W:XDAysJADlV378P3RPVJLd8EP90W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619163, "uuid": "1f1cf776-e511-4909-b8b5-7b3a50139601", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619163, "uuid": "2fd5f052-55bf-4436-8e21-f6733e5e93c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619163, "uuid": "e8cb3dff-ce13-4f81-b141-b4e60cf7277d", "value": "catalog-1083985399.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2ce5cc-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639345, "uuid": "e74b812a-4237-42ea-a19d-e75c0fe88262", "comment": "Malware payload (Dridex)", "value": "ea692797b967ad5ff78b2c2ca633b05f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639345, "uuid": "5bce9224-2559-47dc-b93a-98ee4753bc41", "comment": "Malware payload (Dridex)", "value": "08d7086cf3fac4dacdab3be87c803748df66e7c90c35bb320abe75a65af453fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639345, "uuid": "f6bac090-0465-45db-8810-150cfa20d34d", "comment": "Malware payload (Dridex)", "value": "269ac46095d565a5b8700dd4de122698dda057e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639345, "uuid": "761f0fb3-6569-4831-8f19-8bf5fca0bcab", "comment": "Malware payload (Dridex)", "value": "895943a72cff090193c33fbadadb58d4834cb691a32d5d5efadc8dde745a551b197a28b859b2834467682714d4463012", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639345, "uuid": "1cd9997d-3d94-4688-9985-7dea0ead941f", "value": "CEF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639345, "uuid": "337a1812-71b1-435e-bfcd-795393e32b42", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639345, "uuid": "3f2e7ae0-f2e4-49d3-b209-0bfd5e95975d", "value": "3072:zoSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2aGkFY:snS62Fl+pkeJl3CvRStrFl+EYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639345, "uuid": "624bc6b2-6d73-4e53-a367-559f5449204f", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639345, "uuid": "9c99a0f5-c628-4205-bb3c-74174951501e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639345, "uuid": "daf38ff7-b5aa-4242-af85-c126895f15e1", "value": "ea692797_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8c1e05-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621715, "uuid": "9c064e42-c78e-4187-8ac5-63aa5c28d984", "comment": "Malware payload", "value": "9460a3cd38de5a1bc046fb7bdfe16d33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621715, "uuid": "91b7d999-627f-426d-9db9-c99afc3a8dcb", "comment": "Malware payload", "value": "08e2df2e73c00ebb877cd0fc2ec4946aad6abe80309b212a04e6ad14729de084", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621715, "uuid": "23c7e5b4-e5e1-4c1c-a934-3bad071456d6", "comment": "Malware payload", "value": "a4520c6bbb4cd528e3b705c39f63cf7ecb6de162", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621715, "uuid": "2529b974-f709-419c-9888-2af427ffe2d2", "comment": "Malware payload", "value": "531faaae0c471c1c8884efe825d8a7cbef20dab20e3b089ff5903cbc0e60e6319cdbbfd29206ce22ed38f05d1ca5c060", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621715, "uuid": "eb064c0d-bb90-44c7-ab26-bd1385f4f05e", "value": "8E830250036B894DF58E5E3888A31ECF3F95F9341909F8F1753E19B4E32E46A0A2497D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621715, "uuid": "e7d6f927-e038-4f93-8e59-8065aa6f724b", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGneL4XqG2DbLXDK:DDAysJADlV378P3RPVJLdg36GYnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621715, "uuid": "1200df7c-5875-4db9-93a1-dc0c922985fc", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621715, "uuid": "3d60cb05-be80-469d-a195-822e0c9c615c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621715, "uuid": "8d94ddd3-c016-44db-9eb7-1aed8c198afc", "value": "catalog-873246121.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763e75c5-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626320, "uuid": "188f12ab-1a97-4ae6-aa19-0c64bd1e1786", "comment": "Malware payload", "value": "1e6d7dae265cb793fc9e197699e6b3f3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626320, "uuid": "f64f4597-8246-47fd-afab-9f103288a13e", "comment": "Malware payload", "value": "08e54e940435991853ffb8a98127bd7a6902cb06b9e2d5fcb21e778c92161ef7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626320, "uuid": "f13ee0a3-7b77-458e-bd1e-90d4aff1753b", "comment": "Malware payload", "value": "426faa086610652559c59110b9c007db5d08fd61", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626320, "uuid": "f58a5ab8-ac30-4cf8-8448-86e8dda3749d", "comment": "Malware payload", "value": "cfd2d6b407530153c348594c0ed019c37ed571fe1513f40d8525c6f4784f9d2ee3ce208960e96c1ca6e9e8f73776417d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626320, "uuid": "f722a454-d722-460e-89f5-bfaca29909ae", "value": "3C8302A053BE4A5CB88D4E29ACA20D4F3FA7B6743D1E58F1B52D0485A335C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626320, "uuid": "a44e93aa-3881-4d6b-bfb9-cfbe7e116701", "value": "1536:IDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9hsMnSEwJPTm43U:IDAysJADlV378P3RPVJLdLxpEpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626320, "uuid": "dc66de8f-24db-4d3a-9303-62d4e3acbf83", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626320, "uuid": "f03270d0-63f9-4916-8d79-ea78d8963376", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626320, "uuid": "5871fec6-5670-4e15-a1c8-a348b5006894", "value": "statistic-2133105533.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df2122f-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626735, "uuid": "bc190b75-f3ab-442c-add6-f4e01b8cf151", "comment": "Malware payload", "value": "ee38bdf649a239410143a38006ca3074", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626735, "uuid": "d7f0113e-b7c2-48ea-9686-6fc026d247af", "comment": "Malware payload", "value": "08e55c49118e2944effb7955bb66c0ad83290f7f68b175f40b06095df940131d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626735, "uuid": "179516d4-9a32-468d-b3ac-2698956eaed5", "comment": "Malware payload", "value": "b50f0fd4664a1a61009dce0d6cf74f9735059ed5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626735, "uuid": "518edb5d-9b86-4d4c-8964-973149f82c0d", "comment": "Malware payload", "value": "10d922e5cd3acf1f5e879c58f5f3326267b1783a6d533531fa40db712a74be36006b6b80bcb009cf3bfcabc31b14bca9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626735, "uuid": "6efa8d92-c902-4fb2-a56e-fe91a598d43c", "value": "C083021123B9C998F58DAE2D4CE30D8F3F42B9741D1ED5F26229019AA327C960F2497F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626735, "uuid": "915b9e4e-8894-4c77-bec5-a7bf20f71bb2", "value": "1536:TDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYPqXT/WkO0B19M2mR:TDAysJADlV378P3RPVJLd8qXj+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626735, "uuid": "ba33af3e-daa5-4ff8-a270-2b0f2412e043", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626735, "uuid": "94b056d4-abcd-4e1a-baa0-519c97bc18d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626735, "uuid": "2392624e-2813-4629-a440-3bfd814d120b", "value": "statistic-464703470.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c3dd29-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620009, "uuid": "0b8d9518-6529-4511-9d62-05112e2eb4d4", "comment": "Malware payload", "value": "31204be13dd4286e62fa0189c0babee2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620009, "uuid": "ac6b042e-6b7e-497b-a3d6-63dc3de08938", "comment": "Malware payload", "value": "08fc9c0e320ee5f6a2c8a65d682032d2cca24736f2df90c4647eb03d853697c3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620009, "uuid": "7bfdef9e-1204-4803-9fb8-64b84114911b", "comment": "Malware payload", "value": "85cfce46623b01d484db13be2d49dd650409ab4e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620009, "uuid": "c42fdb7a-3222-4cf7-a00c-52c0dded58aa", "comment": "Malware payload", "value": "b3bb87dd41220d188e641ce537127d8cd377fe5bb8f94258e5c5dc770db039f02173ea17cf7a0c619746049435638b83", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620009, "uuid": "139c22d3-622e-4dee-8c6d-59ba5cfad3e5", "value": "5783023103AE8B1D74CE5A3958D21E8F3F96F4B42D555993542604E4E327C629F38C7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620009, "uuid": "cf546cfa-4bb9-49a7-b43c-263c590e78a4", "value": "1536:GDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVR7:GDAysJADlV378P3RPVJLdcDsMU0dR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620009, "uuid": "aa67e0b0-1ba3-4642-8483-0e22e2c1963a", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620009, "uuid": "37e490ae-841b-41b4-b36c-1f5caf7e6473", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620009, "uuid": "62419ecf-9ac5-42ae-80cf-35a28abb646e", "value": "catalog-1686377073.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cba62a-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640648, "uuid": "0ac620cb-4339-49b3-8394-26d724966975", "comment": "Malware payload (Quakbot)", "value": "eede6d3ea291f2cc632a1bd06c617211", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640648, "uuid": "e53b2183-80c8-4f22-a7cb-193adc3edeb9", "comment": "Malware payload (Quakbot)", "value": "09049eec8204250657cf7773bc8fcd4bf36ff2cbedeea738cac713dcb169c1b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640648, "uuid": "1db90ffe-adf2-43e8-b456-a5847e925ca1", "comment": "Malware payload (Quakbot)", "value": "cf5126b8f3b7bb6b8f60f187c0b4976a0331d9b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640648, "uuid": "7cefba79-be2c-4011-9b1a-b995d01745dc", "comment": "Malware payload (Quakbot)", "value": "1f563b34bae7ab779ee542098cd5d272d783a6b460a07e3d3dc03fe71533ed22628d8ff41e08884239247486a101ea0a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640648, "uuid": "6c09e094-2538-4bcb-abe4-76997cef97a0", "value": "E3948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640648, "uuid": "8f6d8d6f-dba8-42f4-90b1-5a4116ee31e9", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640648, "uuid": "48a60abd-7f8b-4c12-984a-0054565d2ec9", "value": "6144:qVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraN:DFNmLKSVpJbPT+4xrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640648, "uuid": "85242f2f-eacf-4c02-96db-27f7774929cf", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640648, "uuid": "862f9c1d-f3ec-4cec-906b-0b0b706c180c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640648, "uuid": "0636d51c-5522-4cf5-acfe-d0d0ebb276fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8009be-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624342, "uuid": "e36aeaeb-2b16-442e-82d4-06712f1f090c", "comment": "Malware payload", "value": "bad169da401033992648aa2fccb13e0d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624342, "uuid": "832195c4-097f-41fd-83fc-fd7ce0e5152b", "comment": "Malware payload", "value": "0917742aa22fc715c2326d5b0133bdb7a8b219c196a2a27b9ffaa933fbf4c68a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624342, "uuid": "8277299b-221a-4b7b-b10e-84d1a0d79566", "comment": "Malware payload", "value": "5637500fdfc4dc875e42868f6530ac20e5d9d8da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624342, "uuid": "52404467-07b4-45fd-9aa8-c8b63eceb117", "comment": "Malware payload", "value": "0b22c5c8e6384784ef6574c7eeb34027c1bf376eb4fc5ba33bf10b495be9c6337a604f026436021b7ab209741c59ec26", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624342, "uuid": "5117d19a-e197-4df1-ad9b-f622b83affae", "value": "A183029D653DCAEFB1AD3F09A3CDC43F661EEC612004248ED8C466A69D49AE30C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624342, "uuid": "53b03ad9-8c06-448f-9e26-8f84fc265036", "value": "1536:/G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOe6n6475e0NEnP6p:/GEhrHJoEsBMG7qzkQ4q/NEny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624342, "uuid": "a627944d-82d9-4043-ae92-74a6dfcfdbc3", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624342, "uuid": "a4cad986-949e-410a-b977-3a542441fe26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624342, "uuid": "19539388-2950-44cf-a413-d796ea79c690", "value": "diagram-701764297.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1df332b-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619199, "uuid": "9fdfc219-2db5-455d-88dd-e2746777cca3", "comment": "Malware payload", "value": "a3944c3a0c078fb67a9c650505fc8f0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619199, "uuid": "2323a74f-970c-4c6e-8810-634f7d048aab", "comment": "Malware payload", "value": "091d889164bde034bf6b65af559d9437751c7f19bf7c41032c564e73defbbe97", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619199, "uuid": "8e2dccc6-2d1e-4f84-892b-9ac74db2017b", "comment": "Malware payload", "value": "133ac6c8c9d922dd6eee33340566f3ce06e67398", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619199, "uuid": "b45f990d-64af-4078-adfb-507f5e63ff13", "comment": "Malware payload", "value": "0b404304597ac313c346522f07312e88cf5a761cf1c7bbe42ca24af64ec1dda3e5d1dd398f6a1c39af15071c4f1df218", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619199, "uuid": "19ce36c0-b172-4d2d-9578-571a9c17d864", "value": "6583127103AE4B1D74CE9A3968E11E8F3F86F8B42D095992551A00E4E32BC559F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619199, "uuid": "9d583e45-5d65-4499-a6e4-dbdf0fb3f6a7", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMDsMrbsTmHvVR+:zDAysJADlV378P3RPVJLdMDsMU0dR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619199, "uuid": "c9a40650-dd96-4165-a76f-646ac238866f", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619199, "uuid": "dc438ae0-0bf8-4fe0-b46a-945448ddd4f7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619199, "uuid": "6d4c16e3-78fd-4a4c-9fbb-c0f9cb93fcec", "value": "catalog-1100944869.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ba81ac-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620925, "uuid": "751889d6-f713-4850-998a-2f19d514ac4c", "comment": "Malware payload", "value": "4a3d930e025fd2f774c13988d95e3203", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620925, "uuid": "23f801d7-c19f-4dc1-bdf7-66071dc3b23d", "comment": "Malware payload", "value": "0920356d5af397206eb4dc2c9266de7797164c9bfdb81f856373d8d3c17713d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620925, "uuid": "746a6158-5f68-4d7e-830e-49859f059187", "comment": "Malware payload", "value": "39dfb6e3adca8553215f5e8cc44b92e713a585d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620925, "uuid": "87941a23-65d6-42ee-8e5d-1f7d3c4b8160", "comment": "Malware payload", "value": "2db00880a6ed28b7638ea8fdff29b3df6b010446ff2436ff2e118b627098ff3b71b8b6a3032327cde0ee70b9f596a7b3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620925, "uuid": "1d469411-43c5-4035-9e61-8f6184face20", "value": "2083021513BF464CB88DDF3D5CA30DCB2F5AB974291968F2A16D00E8F6338521B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620925, "uuid": "84f6b9d6-01d8-4de7-8f8a-84c8d497a2d3", "value": "1536:LDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdRRP6sCO0Pyc3F:LDAysJADlV378P3RPVJLdL6s90PyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620925, "uuid": "96426e5c-f239-4e12-8092-5344f51a483b", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620925, "uuid": "ef96336d-06d9-4d8b-835e-8571d3fd63c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620925, "uuid": "f57f1578-8aaf-4743-be16-c783b95c85d4", "value": "catalog-28852510.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe5badb-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625121, "uuid": "04085bd7-be32-4229-9e71-a94094397d34", "comment": "Malware payload", "value": "5d17a870fa8598a546d3a56afe0f39f6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625121, "uuid": "3cb114ff-08e4-487e-9c5d-7e177a2b3eb4", "comment": "Malware payload", "value": "0924ac462f303330cb1a3a308276ee30f48c17a4ddac047c84c06f9502c4e843", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625121, "uuid": "1741103a-34ed-4e28-93a5-83b3d6804306", "comment": "Malware payload", "value": "1edd16c390a4ead2b56cae401e05954dd7f36f9f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625121, "uuid": "3a95cad4-1bb8-4af6-84e0-d6399ffea0f6", "comment": "Malware payload", "value": "2da5818fdcf7d10303364e10510fdd8b414f0db4d29325e1343c67fcd7dd71ff21ac52b3bc3bde479963d9ac62b7a846", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625121, "uuid": "8294a10a-458a-451d-b824-a4b36971310d", "value": "E48302A453BE0A5DB84D4D2DACA20D4F3FA6B6743D0E5CF1B92E0485A235C561724A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625121, "uuid": "73da2002-194e-486b-b800-d9de5c5076ba", "value": "1536:tDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdihsMnSEwJPTm2tKI:tDAysJADlV378P3RPVJLdUxpEnsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625121, "uuid": "cf2ff46a-85fd-46b5-9510-3b218e0d08f8", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625121, "uuid": "48c24e1b-d878-44d7-85e9-aa5a6648bb31", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625121, "uuid": "bec613fd-e3eb-49ba-a522-c24cb53ccb00", "value": "statistic-1242096080.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3779977-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625993, "uuid": "6fb78243-4d99-48d8-a396-1f3f62afa92a", "comment": "Malware payload", "value": "d06f4f0d8683bd16eeb538f0dd1e6dca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625993, "uuid": "43d6f93e-4576-4d08-bdac-4b99fb09d0d4", "comment": "Malware payload", "value": "09454140a5edce4757d0c870ed80ec1029e33a5d08114e8d145ce6df388d07d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625993, "uuid": "195216da-4acd-474f-aff8-45a56cbf2ea6", "comment": "Malware payload", "value": "790ff67f060c7632b40f5caf84a0aa0b8a4d8a9d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625993, "uuid": "81345f49-f1c9-474b-af67-66a513e40f39", "comment": "Malware payload", "value": "13734841775c6feb5fd6bede9bd8f258ae3fbb9dc53aba13801cef24fbdf7a182ff4364a7d73d1c2fc14c1431ddb8b4e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625993, "uuid": "26eb4066-d36a-499c-83a1-c20adce9c861", "value": "288302A443BE4A5DB98D4D2DACB20D4F3F66B6743D0A68F1B92D0485E231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625993, "uuid": "ffd97be4-a9ed-4d99-a518-061ae95d56d2", "value": "1536:ODXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmDE:ODAysJADlV378P3RPVJLdBxpEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625993, "uuid": "ec0a745d-13f6-41f2-a3db-faa1a02e2e97", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625993, "uuid": "08953d7e-8931-412b-a4bc-993118218e3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625993, "uuid": "a04d8787-6f54-4af8-b3e8-c406be23e09e", "value": "statistic-1888109301.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85f35ee-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619622565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622565, "uuid": "34cb841a-f54c-47bf-a2db-75dfcddf67e6", "comment": "Malware payload (Dridex)", "value": "48fa4db8939987d008fd9ac84672a049", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622565, "uuid": "eb9e1c47-f41a-46e9-9f79-0f14b61bcda5", "comment": "Malware payload (Dridex)", "value": "094c964df66fb988e6e46ac1c0bb945dca2143beb670924bd7653c861693b84c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622565, "uuid": "a7e484b2-f16c-4b83-a0eb-997d56c78eff", "comment": "Malware payload (Dridex)", "value": "6c2f0918a40d053af40cf46f7c10afead133019a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622565, "uuid": "bf3987e6-fef0-41cf-9dd6-741552394f9d", "comment": "Malware payload (Dridex)", "value": "57e20a50f066501cb2d7d8e4bdedba4f44dd6559e0918d7bf0a403479f6862219bf0359d9009a06603680e39cbc4cbe7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622565, "uuid": "bd2a5eb5-d975-4760-9a11-c23fdc2208e6", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622565, "uuid": "59610757-5c38-490a-8d79-dc33a90ce12b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622565, "uuid": "c200cc99-e5a3-4245-a275-d55c430e6509", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622565, "uuid": "b6c68440-7dac-4850-8fc8-275c5dd3722b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622565, "uuid": "6e863927-dde4-4298-b194-31ab9cb33023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622565, "uuid": "ef683338-7d8b-444c-a135-ba0ad461ef0a", "value": "48fa4db8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e122a4-a869-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645755, "uuid": "30b2b289-d952-47dc-8ba4-e6dcbcf24b01", "comment": "Malware payload (Dridex)", "value": "4acaab6bcdd76c7ee4862b81c6343faf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645755, "uuid": "4339e659-a2f6-4de1-b2bf-1e3df95db130", "comment": "Malware payload (Dridex)", "value": "094cf6d31a4e1f4d2c8e15617f19de150fe4c2cb7a8c03f43195a308cd29e982", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645755, "uuid": "58856d49-55af-429d-acc5-c20bc6a42781", "comment": "Malware payload (Dridex)", "value": "7898742da8f0305dd08733dbb0695d10466dcf0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645755, "uuid": "5f8117dd-62e1-4799-a337-4281228aeae5", "comment": "Malware payload (Dridex)", "value": "092a85f29218fea5641252321ae6830df591da0e0ef75bd086b683b06d798aaff371d404ac33221c9342832194f35108", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645755, "uuid": "08f0adfa-35b4-4204-b6a7-580ec60afc27", "value": "8BF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645755, "uuid": "6b645fa5-7cc3-4f1d-8c08-029342de58f4", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645755, "uuid": "e6fc855a-871c-4fa3-9a89-8c12a5213a79", "value": "3072:vU8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYgZwd:7nClX8WZ7/HrRCADTR0VlaZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645755, "uuid": "739ee281-e07a-4557-b014-d7cfe4258604", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645755, "uuid": "1bf1a211-62cf-49d6-815d-06a10753e21d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645755, "uuid": "0252ab0b-5c37-4f04-8eeb-a8c3ee3bc415", "value": "4acaab6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c00d69-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621858, "uuid": "ac3f8475-86e2-4d43-b0f0-02c2ce7fa17c", "comment": "Malware payload", "value": "b32d106f9e032a81a67999838c6236a1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621858, "uuid": "14cfd5c1-9fc0-413d-89a1-68dba772ac2e", "comment": "Malware payload", "value": "095a286fb7e502a27fb66bb7fdc50e4d03a8d5e42cdf50fea6182fc367b2b29e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621858, "uuid": "6a59395c-8e66-4d58-8277-00b6819d1bd7", "comment": "Malware payload", "value": "4688b6ec275317b530e76b778cd8e9989b0c9900", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621858, "uuid": "aae46087-eb15-4f70-af33-ff8885db6c0e", "comment": "Malware payload", "value": "87c66d7ea19d98ecb264524bb97c64d4ef38b88901333f2f7df68a30c2f5189489c277259b819ef7133d7ce4b7fbb3c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621858, "uuid": "5b662788-b125-4d57-ac59-37e180f8a8ad", "value": "7783121013F68F4C748E8F2D9CE20ECF3F57F9B9291DA6B5612904A9E626C560B2057F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621858, "uuid": "043698ea-380b-4c50-9b82-11f556632392", "value": "1536:NwDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdVDpEDP9+jAJuPU:NwDAysJADlV378P3RPVJLdVDps+jAJqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621858, "uuid": "1424a471-cf9b-444b-b55e-e8ce52fbd571", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621858, "uuid": "21d1e1e9-0a4c-4348-986c-115b49c9ef08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621858, "uuid": "86a65319-fc7b-42ce-8a59-60c8fbb20efa", "value": "catalog-976882002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781ffc58-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621598, "uuid": "18b1cbfe-ec68-42ed-911d-b9d1fc391199", "comment": "Malware payload", "value": "2837d69705043ab5465709a9585482c6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621598, "uuid": "9a1b7115-5833-441c-9531-aa92bb4f6c72", "comment": "Malware payload", "value": "095bb39f6ccf3d82fac81b890906a7e4d97d9e663c596d351c31541f48db049e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621598, "uuid": "e32a845b-e763-4670-8d29-19e221806556", "comment": "Malware payload", "value": "3e4d04225ae22d82f80c9b8ccb6f275022338332", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621598, "uuid": "683ce8f5-8a70-48c8-885f-1b4bbb688c0b", "comment": "Malware payload", "value": "d01f7b513d8b5a8e267d77486253e434cb8839fb2f911d8a076dc920ea610d6a9e6ef4d6167216c99c93c7b4d8052abd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621598, "uuid": "c8d55370-a362-4540-90d8-270fa3868267", "value": "1B83121023F6CF0CB48E5E2D98D21ECF3F97F8B9251DB9B5212904A9E626C460B2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621598, "uuid": "a62c18a0-65b8-45fe-b3b0-c2eb4906b303", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGDpEDP9+jAJuc:XDAysJADlV378P3RPVJLdGDps+jAJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621598, "uuid": "1fabbdd0-9b4a-4524-a3e1-62789f080044", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621598, "uuid": "4737c826-7e02-459c-8617-97ae9352c682", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621598, "uuid": "bf4c594a-90aa-4d85-8e86-69fabd7d488c", "value": "catalog-788719633.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b195f015-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626849, "uuid": "7df49c56-7475-47e5-8fbe-1d731251ef86", "comment": "Malware payload", "value": "34340642c7fdfee2b2f6f8dd9cc1cfd9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626849, "uuid": "1f5a7be0-6a10-4f3b-8582-e1d95419e070", "comment": "Malware payload", "value": "0966c48635afcc3c1f7870429fbbd6c9d4d75d92aac57a3d1eb7e0ee92aec1be", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626849, "uuid": "68abc52c-4a6b-4fad-a4e7-03ea8dee373f", "comment": "Malware payload", "value": "7c5fbc29a6f7fffc95e41d6ffa4789698671b43d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626849, "uuid": "fa48a806-6502-4a55-b7e9-605866282eb9", "comment": "Malware payload", "value": "08c08b7bdcb4a6c8c035002903b7c35648301b92d762fefda0d6ffe8dfb122fa6563ae514c68779d9196ab62365486ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626849, "uuid": "5e15e1fd-bda2-4bff-81cd-3c8866d766c9", "value": "A283020813BA5919B5CECA2D8CC31FCF3F57F8B815094962A55D0099F627C6B5F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626849, "uuid": "c52a73b3-f129-4446-b6e1-f463f601c69e", "value": "1536:sDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdM8ZTrIKrVAN3n1+:sDAysJADlV378P3RPVJLdkKua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626849, "uuid": "2ad93981-303e-4ad8-b45e-4ef464f0b19b", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626849, "uuid": "c9d0e227-f0dd-4a15-8801-96cb3f51769d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626849, "uuid": "9295704f-305c-4dea-a28e-1b01b90d3cb5", "value": "statistic-542669712.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb2c0bb-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622951, "uuid": "ef592181-389c-40be-bf79-c869e6fd7067", "comment": "Malware payload", "value": "3bb37919304e4a72eadfd7b52e1e9707", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622951, "uuid": "d75bfafa-9422-4980-87b7-ba57dc16c8da", "comment": "Malware payload", "value": "096989c70ad6ff6541aa8869311665e8b9ed52b31c8e0bcc396a27b2f441a87c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622951, "uuid": "04c67a67-fbc4-4938-a0a8-955ee40cbc4e", "comment": "Malware payload", "value": "4aab033b753255f675d41c80378bce3fce094336", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622951, "uuid": "c7f95dfc-770c-496c-b202-4df3c37ec03d", "comment": "Malware payload", "value": "5964330b0339e2ac3515b46bab0557c53a27089c0b3245f6b8d8781d35a7daa297771109d8d8b54280b0855221cfc4b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622951, "uuid": "7adacc77-c5dc-451b-9d0f-c4ba385c9ede", "value": "F38302CC653DC6DFB1AD2F0962DDC57FB50EEC623048248ED4C866A69D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622951, "uuid": "993b1a6a-207b-441f-8eea-c24ac22c2511", "value": "1536:9G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttle6n6475e0NEnP6I9:9GEhrHJoEsBMG7qzkj4q/NEnT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622951, "uuid": "3b281451-078a-4b77-8cd8-882dc0165e05", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622951, "uuid": "4a2f0d25-a2c1-44d4-8be6-a986f99e3730", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622951, "uuid": "ddde13ff-b3cf-4c57-bfe6-6404a179bddf", "value": "diagram-1758384986.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3c6717-a7c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619575278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575278, "uuid": "2278a3e7-0b8b-4d5c-9797-c64eab42bbd1", "comment": "Malware payload (Dridex)", "value": "1a73142764b8c745e003dd0b3d22388d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575278, "uuid": "2583632c-8597-4ec3-ab99-b5a6bfe5b254", "comment": "Malware payload (Dridex)", "value": "098140ffb5cac8ab6cb1342d3de24a53febcd23689b28b47f2606c1d82947ff9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575278, "uuid": "5e2c1b40-a9f6-461f-b96c-ccd2f7b84ce4", "comment": "Malware payload (Dridex)", "value": "520064a0d8f527ca6043ef4df81db1fb7958a426", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575278, "uuid": "adafbe08-9cc1-4b8d-b80d-e280abd9245a", "comment": "Malware payload (Dridex)", "value": "dac2021dd2b398f566364118ed5db8fd4186ae9b7717b1078d1c6b96040639e3e35969aecfc368920a376defe9cbca1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575278, "uuid": "3ff46679-2b88-412b-a378-f48f11138a8e", "value": "94F3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575278, "uuid": "4ae52af6-ed96-40c2-8e33-00d91c6221b6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575278, "uuid": "5f793e0b-e6e4-415e-a632-2a6b4db4c7ae", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619575278, "uuid": "ca1a105f-5b35-4529-b08b-a05c1c38078b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619575278, "uuid": "4b9159fc-f811-4df4-8f6f-4656d3c399ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575278, "uuid": "5ec1e78a-7d88-42e7-a75c-8f0cf781041b", "value": "1a731427_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4821301-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640651, "uuid": "a0ee71f0-1edd-41f8-a21e-43f35b82665a", "comment": "Malware payload (Quakbot)", "value": "1813e840e6d0fb20e9b8d1f4dc2da759", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640651, "uuid": "e6b32916-9d66-4349-8c8a-aa6f5472e462", "comment": "Malware payload (Quakbot)", "value": "09888906e56db566c619d940bad875d75ce687152c41bc45fd749e03af7f787f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640651, "uuid": "e71e9626-8e2b-4254-906b-7baecbca77a7", "comment": "Malware payload (Quakbot)", "value": "cdce45afb422d7f49cea0908e845d76eb7cdebf8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640651, "uuid": "41519e8f-344e-4e14-9eb5-eba1ef0dd8f7", "comment": "Malware payload (Quakbot)", "value": "a3e858f133badb1619eacbc62dd596effa756f867f098378ac1d902fa430e4a911f66d43b2d134f02910ac4b237076e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640651, "uuid": "ba7c8464-9a2a-457e-9837-7be12fbed878", "value": "1B947D396A26D063D2BC27B143C3EF580E67EAD57234540612A2DF183EB6395BE36F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640651, "uuid": "4b1b1c5a-2fb1-450e-9ba1-44fa41fba191", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640651, "uuid": "11d66b47-d136-418f-b873-099526617fe3", "value": "6144:QyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmQ:4Twr03pdf8vhhOKJET5ByQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640651, "uuid": "80721a7b-87e1-4402-be75-27060885f0ac", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640651, "uuid": "a6f1459c-db69-4cbf-9e58-234130d0946c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640651, "uuid": "4bf7cc12-8d85-44c4-8085-bc9396c5f46c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719f208a-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623735, "uuid": "74cd5977-5294-4ad1-bfe1-31442bd726a0", "comment": "Malware payload", "value": "4c64de7e8637743630964fabbd0ef8be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623735, "uuid": "1fa069f8-f248-4776-a5bb-5e5c1bc0befe", "comment": "Malware payload", "value": "099b9531d9c6c6ad740804d6b10c94a8f2b1828f4a648b5fe2170edaec56d3c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623735, "uuid": "3cd806fe-4cf4-4ecf-b488-9dbbb2115795", "comment": "Malware payload", "value": "e7175334c0a214436d7bcdb8964244f7aad294e9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623735, "uuid": "82636e47-3c2f-457a-9161-65657c2d438f", "comment": "Malware payload", "value": "44e739ab0be6e69f77688ea8c5d9ac420a0fd8e801a5f300cefe1a6a596709bd50feef03d8d811e915d5748bd44aec0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623735, "uuid": "68c1a90a-cd53-42e2-907a-1ed20780125b", "value": "438302CC653DC5DF7ABE2A0992CC887E740ED8B43144154ED8C8666F9E8BFE71857460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623735, "uuid": "2beb41f4-04fe-4e18-a00d-40fd8b199a4e", "value": "1536:yG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt4KkApVr6wo+RxD:yGEhrHJoEsBMG7qzkCxApxTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623735, "uuid": "e4915569-61d9-4859-8d16-3cba2aff4a0b", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623735, "uuid": "3764ff7d-63b2-4493-b33c-af4daec97d7d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623735, "uuid": "4f99df4c-66ee-4190-9b09-251247b9ac97", "value": "diagram-388040168.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee44b023-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622655, "uuid": "c45de3c7-3e9e-4463-811b-a398b953ef9f", "comment": "Malware payload", "value": "f145c237ae9d12019ef2f86810e92356", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622655, "uuid": "4e3efbd3-9d1d-4b4a-b88a-05cb471a6b15", "comment": "Malware payload", "value": "09de9ead43add784a31ee1ef0c128d0c5e732d8482867f3b8e03ad51d3f16510", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622655, "uuid": "baa542d0-1d4f-48bb-9c04-381fea04a4ed", "comment": "Malware payload", "value": "04464ad721548ebb7b992032619dcb8b25a24143", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622655, "uuid": "80d835b4-4848-48d8-95c1-ad85e7bc6bc0", "comment": "Malware payload", "value": "1bda6c0be4ad253d22bfed0597e64384e63c41dc52c1baf41cb554f42655148ebed11cf5c9f8188fa9bbce13b841579f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622655, "uuid": "55d75639-5e1e-4935-99d5-998927bc88e5", "value": "D083028C3538C1DF37BE6A08A2DC887BBD19D5B93504385EC089655FAD8AFAA4C5F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622655, "uuid": "0896b50f-c262-4e1e-80f1-c035187f1721", "value": "1536:aG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+pO:aGEhrHJoEsBMG7qzkZQxOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622655, "uuid": "d24148a7-13c4-4c00-8437-6dd2a05a0ae4", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622655, "uuid": "4fb64868-2237-4306-b1f0-c2830b8d464b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622655, "uuid": "fc73f85d-a438-4d4e-8161-395562f708ad", "value": "diagram-1548636611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61ae258-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640654, "uuid": "4fbc9a68-18ad-4a16-bddd-8ef3729873d9", "comment": "Malware payload (Quakbot)", "value": "144333dcd919380726715c25a0378e94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640654, "uuid": "0db61f18-f4c7-4091-b994-b30811b4d194", "comment": "Malware payload (Quakbot)", "value": "09e239b1a6684ca74702e17aea5b6ccc168fa449f5b3b6b99d06abdff1e24a81", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640654, "uuid": "b0f22dc3-9b3f-46b9-8062-acb38b9bc896", "comment": "Malware payload (Quakbot)", "value": "40d86d9835d3e19a9edbb93299bece3cb62ca189", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640654, "uuid": "d22b92d9-508e-4539-876d-a539e6036ae5", "comment": "Malware payload (Quakbot)", "value": "a9633f471bc42fbcf6d3e3747f28d8598da225b7949611d3aec50e55e939d2d6702a86f058ee990958a74b9aeafa94f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640654, "uuid": "0cbbe48e-e18f-4d84-be5b-a5aedaa772d6", "value": "E4948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640654, "uuid": "c5a3e732-eebf-4452-afb5-6079178792ea", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640654, "uuid": "d1be2888-3e55-4f64-bd02-09d586422aba", "value": "6144:fWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAm4:fWrsTwr03pdf8vhhOKJETlBy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640654, "uuid": "85b7dab2-8d05-4608-8d1e-7de5356df9cc", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640654, "uuid": "683e97ad-6994-4cc6-93a4-246a51266a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640654, "uuid": "ee634b38-d782-4a26-ae6d-1a398cd78302", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa6f6b0-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625173, "uuid": "e573fc63-c985-4649-b9e7-260379da1047", "comment": "Malware payload", "value": "e487ccac1f3b1ed25ca5fd3e59b0e821", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625173, "uuid": "065ccbe0-03aa-4567-a05d-4084ffbd7c4c", "comment": "Malware payload", "value": "09eb6ccdc8aec9a1f717959bcf9afaf1b28691a722edea17da40fae67476deb9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625173, "uuid": "80cf59ed-9de4-433f-9ece-2a99ffec43ea", "comment": "Malware payload", "value": "f86991d02b88cc4598c7869dc856abf3bbaecc0c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625173, "uuid": "b198bda1-b0a4-4571-aa08-c4f1c0f6c54b", "comment": "Malware payload", "value": "ad4ce60f74dc6694f8f08e85caa0c6697eec4285690fb16a6ba46ad39cb6523ce0f9edf2d11a94bdc6e411a7393a8bf4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625173, "uuid": "c2f73e0e-4722-4912-aa8a-80b0b60db20d", "value": "B883020423AE5958F8CD9A2988D30ECF3B56F5B8291E58A2B55E00D9B223C565B34D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625173, "uuid": "38a41ffc-b919-4e0f-a1c3-1ec6c4b69238", "value": "1536:+DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdK8eTrIarVAN3/B1eM2Rl:+DAysJADlV378P3RPVJLd9au85l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625173, "uuid": "661e7368-749f-4110-93e9-56c6927613fa", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625173, "uuid": "5d1e683d-81b8-49b7-8636-e3b55ee70213", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625173, "uuid": "31d2dbad-14ae-41a9-8530-1df3b65539c0", "value": "statistic-1284992104.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bed527-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640656, "uuid": "879a65cb-2aeb-4551-be09-9dfb6374e065", "comment": "Malware payload (Quakbot)", "value": "564a2caebfafd724520e9aec5c58bb37", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640656, "uuid": "7ebaa88b-3354-4df7-823d-d2a396b1c7f0", "comment": "Malware payload (Quakbot)", "value": "09f1619bd81d172164ae3026d07f82c5aad50b293aa0e4c01c045eb88309dec0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640656, "uuid": "cca4bc5e-2136-4cd0-a3fa-25be40c4072c", "comment": "Malware payload (Quakbot)", "value": "69b239693393eba5f519cb98b2050a2e865cf385", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640656, "uuid": "f772f41b-8ec4-4b69-a1e1-c0b82543855d", "comment": "Malware payload (Quakbot)", "value": "c3f7293f710c676255fa37c341bb6d44f04126195b2d6c0d33b7a5baddbe3d341c9fba7c9997203ff21a2e22a0b0cbb6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640656, "uuid": "956b05d3-5497-4ac5-b38a-9157aad69e54", "value": "AF948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640656, "uuid": "2d65a52a-227e-4727-b62f-31d73e33ecb3", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640656, "uuid": "3360aa2f-4438-49ff-8a91-2c641d9cdea9", "value": "6144:XWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmd:XWrsTwr03pdf8vhhOKJETlByd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640656, "uuid": "6074ebaf-fe5e-4a4a-9bcf-18cdd3c64579", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640656, "uuid": "3202cc6a-0307-461f-9028-c4e869a7869a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640656, "uuid": "f201c7a8-df77-4292-94e4-8d48c5af7a87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6d36e6-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620018, "uuid": "d79e308e-747f-4595-913e-dff18350e08e", "comment": "Malware payload", "value": "fa03a15895176a33140802f39bc4046d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620018, "uuid": "800b6509-a5c3-4be3-a6de-6faa94acb850", "comment": "Malware payload", "value": "0a0d515345b4f5114dc1b5fe1c46871bcc9be04b1f39253e388a57ce3a338f18", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620018, "uuid": "084e633e-c0cb-4399-8f6a-512165fb6ec2", "comment": "Malware payload", "value": "9a8081d95b1acf474ddf1a6aa11d990668f7eec8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620018, "uuid": "c65bc92f-8fd3-4c2a-9065-e705b89a3a68", "comment": "Malware payload", "value": "801d41f0811914bf3a118020b0371fca2c5f290e969b990f4b53e1cdc4885e174eaae05bc4a3ac2d3e4c884045f6f019", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620018, "uuid": "22394734-91e7-45e8-8b5e-50ab19e95bf9", "value": "D583021413B94A5EB8CE4E2D6CE31E4F2B9AB8F4191A54D1794D04E1F2374660F28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620018, "uuid": "c7c121c4-cd61-4810-921d-d87f1cf486c3", "value": "1536:sDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0w+:sDAysJADlV378P3RPVJLdP8BXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620018, "uuid": "c766a009-c69e-41c4-a725-df3875342f8d", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620018, "uuid": "696e1c53-d471-4dc0-b013-cb70774dcd03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620018, "uuid": "7b110c69-0079-4f60-a96e-12d7b6d9dee1", "value": "catalog-1693227270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9787932-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640659, "uuid": "9decc1e7-bf09-46eb-922a-c5916753a973", "comment": "Malware payload", "value": "9edafc563116fd98eb828f2694c7873a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640659, "uuid": "f825f268-99d0-4481-a872-780a586170a5", "comment": "Malware payload", "value": "0a0fd2c0b2fd131945b8da25ee76e8b497ac49ec7fa180d5bfa500f274928474", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640659, "uuid": "da289525-f20a-4ecb-b471-fd99c2ee8c46", "comment": "Malware payload", "value": "9349a8e679621fa02608bf5a18cca65e0a8c6d25", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640659, "uuid": "c20d92c0-6144-4151-8829-099c59c54e77", "comment": "Malware payload", "value": "b413d4325b66a0923c337597448be2ba3c88fba6c2f335f96607bc8adb7ef1161193f3d12db83dbe246e2144ca730565", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640659, "uuid": "b02baf8b-79f2-46bb-b253-c229b1b6e022", "value": "49948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640659, "uuid": "6215b8df-3448-4215-8e7b-577fa9ff5b0b", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640659, "uuid": "73a0478a-fce7-4c77-8aa3-d350de85c522", "value": "6144:8WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAm7:8WrsTwr03pdf8vhhOKJETlBy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640659, "uuid": "01993c7a-d0c6-4fbd-b1a6-8d7422d92612", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640659, "uuid": "20dd5e47-36ba-45fc-8cfa-3edcaa76ac80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640659, "uuid": "be28d447-cdaf-4328-890d-52136afe980a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80372494-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619894, "uuid": "b23a0fc2-fe9b-439f-913b-b686d0d79390", "comment": "Malware payload", "value": "8a2da2e7bd69ce0a98f80e7a5f72b2f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619894, "uuid": "bc9e22ad-7bdf-44ec-a846-6bf8bf3fdb85", "comment": "Malware payload", "value": "0a137905ed612237a04b5575c5279143bd7a70b4f26c77a587216b8e8cdfaefb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619894, "uuid": "3b8f1d25-061c-43cb-b79d-518b10abee25", "comment": "Malware payload", "value": "650eede1030ddbae9ed0613874707be4d5283ec9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619894, "uuid": "96b3845a-cdbf-4d0f-bbcc-c084ec05ab78", "comment": "Malware payload", "value": "dea8a38474f95c5391796485858b637b4a979790cdb587d6e4091d6fcf3f3154bf09a9270db0635e9a2bc42cd16cb7ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619894, "uuid": "f92946b6-eca1-402c-8b77-2e913bbd7e92", "value": "7183027043EA0F4D34CE8A3A5CF21DCF6B6AF5B43A1D48B0566E0451D627C962B2853F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619894, "uuid": "77c91c42-11ad-46d2-9f28-63888457d565", "value": "1536:hDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiE58VP0IsOzCy2BXcEnvAn:hDAysJADlV378P3RPVJLdd58VnCy2BXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619894, "uuid": "2246aff5-0971-46be-bebe-98cdbd8be35b", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619894, "uuid": "94b64962-e7b1-4d63-a7a2-e83947e826a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619894, "uuid": "e226d5db-8b5c-4c1e-a2f8-38d518d5f518", "value": "catalog-1608006118.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bb72c9-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624755, "uuid": "ec03fe11-62a1-42ea-91ed-2bec9cf40cb3", "comment": "Malware payload", "value": "255e4251a47cc4208b80ec98be0139a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624755, "uuid": "4be3708f-1504-4bd9-8da4-a2d0abb38a4a", "comment": "Malware payload", "value": "0a30e3f12c0a4e9a5272b2f858984fc9e9eb914e25648b641fedc7fb6e0bcf5f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624755, "uuid": "f0df7f56-fd74-41c8-8821-fde2e05a0f52", "comment": "Malware payload", "value": "57be81dd9a6dc0d141ce3a6b8bdc71ee79fab8fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624755, "uuid": "93fdb065-71bb-43c7-a2b6-f6d6a95633ca", "comment": "Malware payload", "value": "889a3707a86e9584d8802d6251406d44e5cb1f435cdc1bdb30243809e69f116514f48657c196c7c314653a890610299a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624755, "uuid": "bf2b3180-39ed-4afd-90ad-f09f9256e248", "value": "4583014D213EC6DFB56D3E09A5E8C97EA50EDDB4204028CC94C477679E4E9AB4CDA470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624755, "uuid": "7bd31156-826b-4e8a-8f55-7dac7bf72999", "value": "1536:LG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttiKKmo3zuUkbE:LGEhrHJoEsBMG7qzkK7KRbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624755, "uuid": "8b2cc4dd-b295-4d24-af28-4f12ed4b68dc", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624755, "uuid": "d41a80ae-bac2-4c7d-8e17-eacce547867c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624755, "uuid": "56ced585-f8ec-425c-86bf-8a8c83a9b2de", "value": "diagram-98383866.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f4971e-a859-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619638939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638939, "uuid": "50e7af2b-7a62-48b9-bc09-0d051c25c3b7", "comment": "Malware payload (Dridex)", "value": "54491643b89bae5b73a261d150f834db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638939, "uuid": "324383ef-eccb-4709-94de-1d7678195a9d", "comment": "Malware payload (Dridex)", "value": "0a3193d6f09053eae15f55e5a02bf26980b553fc68861df113d3f5393ac3b588", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638939, "uuid": "852aac61-5642-4b5f-b3cf-741fcb9652b4", "comment": "Malware payload (Dridex)", "value": "e0f74dbabd1c9d3a85b287e5b3d083f783a762b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638939, "uuid": "a3b39249-adda-44f7-93b5-4376ff82c435", "comment": "Malware payload (Dridex)", "value": "cacdfc56a8ff2fa3b3fa7d12292fdb8b3229a1918d52795880a5787424d0dfd53c2d04063c95c6a29985f16776dbde5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638939, "uuid": "4f11c312-9b48-428b-9a94-fd438a777727", "value": "3CF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638939, "uuid": "b1b56038-43bc-4e2d-85d6-bd4b29ecd671", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638939, "uuid": "db010da0-c397-4ffc-b768-2c86f08a5f33", "value": "3072:EZSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd21GkFY:WnS62Fl+pkeJl3CvRStrFl+EY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619638939, "uuid": "9de19d96-d986-4ef8-b643-cf91aa8a5ec5", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619638939, "uuid": "515f224f-d9ec-4c1a-9713-c0529b9d4b29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638939, "uuid": "84c9908d-0762-44e5-8fa4-55a9f1e18351", "value": "54491643_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0668251e-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626132, "uuid": "5d489355-6a72-4e66-9135-68677a2372d1", "comment": "Malware payload", "value": "337ae47ca71f765d148050026bc69468", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626132, "uuid": "db859229-d51a-4025-aac0-a10351b56afc", "comment": "Malware payload", "value": "0a4e97e3c1b03bc28c0eca5dda8a4200c8bc25719a6265e7f7545b78673bca6f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626132, "uuid": "da7353b9-f736-4c9b-9a89-1b067d005dbd", "comment": "Malware payload", "value": "08a321fafe8a9bbe73a49add810f25daa2f70609", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626132, "uuid": "ef074bed-182a-49aa-9622-26710846f872", "comment": "Malware payload", "value": "f46b14550068d97305c463adfe086c92f6b89648ff19ad9dcae112a38823d5f0ae30ccdc0b329110092d0adcc4462a45", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626132, "uuid": "99ec32b9-989e-4dca-a576-32c71016b0d5", "value": "8983020423AE5958F9CD9E2D88930ECF3B56F4B8291E58A2B55E00D9F223C565F34D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626132, "uuid": "dd0e0166-d8de-4163-b82a-9e4f2ccda513", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdK8eTrIarVAN3/B1eM2P7:CDAysJADlV378P3RPVJLd9au8n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626132, "uuid": "88af18a1-18fc-4625-baa5-a02a0bef7590", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626132, "uuid": "874c0ff1-0d16-411a-aca7-8827cdcea366", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626132, "uuid": "6d3e8799-32f2-42d9-b852-89c442efec63", "value": "statistic-197923567.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bbaf61-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622525, "uuid": "352f17ab-3b85-4726-adf7-6f9d4ff14d3d", "comment": "Malware payload", "value": "3e4984ff7c4e1cd4549fcad87a9773df", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622525, "uuid": "7f6f12ee-bcf5-454e-8949-05b3b707dd9c", "comment": "Malware payload", "value": "0a64fe369d905d5ebdb92f8a73230469a7f4c34898a958fec1a58e9cfe8c7f4d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622525, "uuid": "5552c9f2-3ec5-4149-90cb-fa299bd37c6b", "comment": "Malware payload", "value": "4cb30cef905be089ab089a5b037eeff67f6fe2c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622525, "uuid": "7d6fedb3-9e2e-4524-9abd-4276cf0ca8bb", "comment": "Malware payload", "value": "d7bef6215b5d3ee6dc6df67f54093c22b724549dbc16f7429cc50a0e7847e781ca191fa47001731b97da2028b778751e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622525, "uuid": "afedbf33-576c-4158-8961-3ede6fbe23a7", "value": "A18302CC6238C9DF717D3E4AA6D8C43A790ED8B93044389DE5C066AF5E899E71C97470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622525, "uuid": "d8261185-f5dc-49f9-9933-02069a515da8", "value": "1536:+G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGr6:+GEhrHJoEsBMG7qzkEEVerr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622525, "uuid": "cc7b9725-5a51-4db9-8242-665551f021d7", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622525, "uuid": "6b7e3345-0671-4c74-87e1-285ec0edc672", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622525, "uuid": "6952b74c-fd3d-4091-8578-d98a0b476112", "value": "diagram-143519705.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d234edab-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623467, "uuid": "d8410e64-85df-4712-8eaf-43319f77cbdd", "comment": "Malware payload", "value": "0b318f59b0e19e820c533bcac544ccae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623467, "uuid": "c7945d2f-f868-458b-be46-d6c6d9219c5c", "comment": "Malware payload", "value": "0a660967ae6e18e82c647df43b23f891fa47847821c212bf68fe6be54dbf6544", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623467, "uuid": "cfaba764-fcaa-4a0e-99ef-a23ad09405f3", "comment": "Malware payload", "value": "b6783c86ee278159db0f21203bc620e29eebfadf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623467, "uuid": "5d892d79-003c-4ec6-a8fe-5d836a5bccc7", "comment": "Malware payload", "value": "8e4438755d652b0ac6140c744fac50afd815393f589fce418c0be44020e85c96404dd1533a30d31d4e3444387c4188a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623467, "uuid": "3f7eb3ea-3167-4b66-907b-facba31b080e", "value": "0483029D653DCADFB1AD2F09A3CDC53F761EEC623048248ED8C466A65D49AD30C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623467, "uuid": "698b0ff7-0955-4a2a-8af4-f02fa3d0973f", "value": "1536:JG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5de6n6475e0NEnP6d:JGEhrHJoEsBMG7qzkZ4q/NEnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623467, "uuid": "33832b1b-21ef-470e-ac27-075234ba39de", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623467, "uuid": "5d337820-ebd0-4dcb-b456-821f32c4da71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623467, "uuid": "a5c18ff8-df8e-4e2e-b8fb-f5923a86ab6d", "value": "diagram-2116239583.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52b641d-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619177, "uuid": "164d0847-3e17-4634-a10f-fae446106021", "comment": "Malware payload", "value": "7b44c4f04e12eada7b0b43a8c5d10b97", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619177, "uuid": "aa2ce4b5-6255-467a-b28a-a2b133f1c81a", "comment": "Malware payload", "value": "0a6bca80cd41dcbb7f20ec9f7f1122dd55068f4612436b64a1e2480306660aaf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619177, "uuid": "093e3609-855d-40d1-bebd-e8730949085d", "comment": "Malware payload", "value": "94ab5cfe3de3fdc37c55605f16f9f18fa3944fa2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619177, "uuid": "8effd1be-068b-449a-8cff-bca400011436", "comment": "Malware payload", "value": "e48e339950940faf9d6ebb7bf6a93d93133c4c454834bae6ab18a5226a88b9d8c745cfd12b6f64d4506db6b6ecef52f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619177, "uuid": "d7f92aa1-bb4d-47cf-ab85-02b2b11a14c1", "value": "AE83129073FE4E6DB4CD9E2859E20DCB1E5EF574290CACE265AE04A492358412F3497F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619177, "uuid": "d5878e52-95bc-479a-9859-14c8f04d919a", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1HJPk:PDAysJADlV378P3RPVJLdIeJLOnleJpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619177, "uuid": "cbb58b1d-e397-4618-9dbe-f7d03a553e7f", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619177, "uuid": "7a96786b-ef02-48de-bd49-d21ccdb8d521", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619177, "uuid": "7dcbb2f8-2865-4bf6-8eb2-7426880b6b6f", "value": "catalog-109144832.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a93c208-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620206, "uuid": "13319525-1fa7-4ee9-8c09-9aade7eed741", "comment": "Malware payload", "value": "c09dce45eb5fa6f91fb1e44fd6b88bf0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620206, "uuid": "d85e6363-e642-4065-b8f3-bef712470a13", "comment": "Malware payload", "value": "0a6d2f18721a2a2c6dbd00ea94cb08dd00583d78c73c0a7ea2480355334fb0dd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620206, "uuid": "9bcb086b-3c28-4603-837b-69a18ad73196", "comment": "Malware payload", "value": "ad1f091d4f8f75fa24e9e303392193ccb7671c88", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620206, "uuid": "ae17f823-eb73-46e4-8f23-8005e0e9f4e9", "comment": "Malware payload", "value": "f7be398f2184388f9a72d310cadfcbb447e8a6e62ee1ab8d4c670f740ad25e99c8af675d341975150715adf672ba8402", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620206, "uuid": "39887d87-46d6-424f-b084-aeb8c45a585e", "value": "1A83025413B94A4E78CE8E2D6CE31D4F2B9EB8F41A2B55E1795D04E1A2374660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620206, "uuid": "f81d803a-a628-40c5-9f33-f308f42c2868", "value": "1536:TDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIIkGV8BAY0wxH:TDAysJADlV378P3RPVJLd98BX7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620206, "uuid": "7acd92c6-8daa-4884-ae96-d88db418af10", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620206, "uuid": "1407939e-3eae-477f-9af1-8eff63d82979", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620206, "uuid": "244c6d07-f0f7-4c7c-84f3-eec44b604a61", "value": "catalog-183378728.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69def185-a829-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619618138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618138, "uuid": "00cd783d-6e18-4c96-b413-9e0a35b30e08", "comment": "Malware payload (AgentTesla)", "value": "af38ddb08f6234319d9ba351900234e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618138, "uuid": "da024ade-ddf8-4dce-9154-433d221277ae", "comment": "Malware payload (AgentTesla)", "value": "0a704fefc76e6ffc17e65f30ee849aac5a6d58429689d992952a0101656e44aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618138, "uuid": "9e5f3544-2432-47ba-9ed0-d17cc1f7bd0b", "comment": "Malware payload (AgentTesla)", "value": "b0449e51fe00c86ef3303c633dc76db8b72f5aa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618138, "uuid": "44b7c78e-a2b4-40d1-b53a-cac4e892ecb1", "comment": "Malware payload (AgentTesla)", "value": "fa480ab8e3ed06672c624bb4ff71150d1074c1ea562eaeb48914e673af498ee1fc3fa5948cb34270cc57ae788127f48c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618138, "uuid": "21bbb3cb-effc-4ef3-a93a-afcebceaa93e", "value": "34158DAC765465E0E35B5D22A3CF0C0643652274793BEA0E8F6013FD1A67F173E3998A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618138, "uuid": "88ff8425-4ba1-434b-a101-2ada02b3f290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618138, "uuid": "2a3085b7-7590-462b-80d7-ae7df03486c4", "value": "12288:NBKmRoLt/YFSSk2U44X/KzlcvWLrb826F1WaqOYmm5aHNzhddmoLLoS60/K7yh0:NBKLta4X/Kpz4bqOYYHNhmoLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619618138, "uuid": "64032a1a-c932-4b35-a8b0-a69a27a54fa6", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619618138, "uuid": "64ec8a38-9ccd-4966-bb40-7c6021d593b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618138, "uuid": "02ae1c62-d56a-4711-9ec4-a09501578c8c", "value": "SecuriteInfo.com.Trojan.PackedNET.686.5407.22804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f535f41a-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621808, "uuid": "73e810b9-4bdd-4c71-ad0a-dd48e5cb3edb", "comment": "Malware payload", "value": "6f92829b9287f81664861a1c36be418a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621808, "uuid": "21b4bb7c-c454-4652-b848-1186b9f49819", "comment": "Malware payload", "value": "0a79daca16ef2f5c5912a62d9081a44b7dfb3c54c0619cc44cf91982b92f83a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621808, "uuid": "717daca5-74ea-4006-9cba-ec45d361d018", "comment": "Malware payload", "value": "0654541b33b0363a46ec1b21e80350fbbb6ade8e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621808, "uuid": "8cf472a5-e318-4d3a-9115-699cf62b7352", "comment": "Malware payload", "value": "3e7311f9a58ba20b5a002ec8e121eb672be8b8270f3d2e5a58cca683d99e13a93ecdd80681d7ac873e30472ecc4dec42", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621808, "uuid": "5bd5e790-d984-4788-85cc-45dbe61c1427", "value": "0C83025413B94A5EB8CE8E296CE31E4F2BDAB8F4192A55D1794D04A1F2374660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621808, "uuid": "3a110b5f-b504-4619-9480-e78242fc849d", "value": "1536:YDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdPIkGV8BAY0wU:YDAysJADlV378P3RPVJLdi8BXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621808, "uuid": "6e0794fd-bec9-47d9-9017-5c0c6a72d17b", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621808, "uuid": "e247b32c-1328-4388-9b8b-2bf5d6a1e7d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621808, "uuid": "d1b6f363-f359-40e6-b7cf-ec1851be6dfb", "value": "catalog-938244638.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c388595b-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626449, "uuid": "075d8d48-ec78-4bf7-aac3-367d8cf76755", "comment": "Malware payload", "value": "73850a65802c0cdb92fc547fd4309486", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626449, "uuid": "2c1d8a67-34c4-482f-9ee1-137368edc7e5", "comment": "Malware payload", "value": "0a7ff05944bfc81a9dbe9205a0d578ef8f9795010fb6f88e774ceacaff656564", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626449, "uuid": "64fb32da-aab6-4332-9e47-1cff2e30c7f7", "comment": "Malware payload", "value": "7162ac2896c0c7ec06dc3f05c968d06176452a0c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626449, "uuid": "788cbbd0-7c74-44dc-973b-48ae232a9126", "comment": "Malware payload", "value": "132894f077a031ba16098133daa9cfcb9f899f55b4ac29325c0e8babc58fade9152f73f10feec4e5c49f6577416ed724", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626449, "uuid": "b6eae5cf-3bcb-4c81-9145-39b31c8df645", "value": "58830250537ACB19B5CECE3D8CD319CB7E9BF9B42A0E5CF1A12900B5B3668051B14B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626449, "uuid": "5a57e1cc-8a8b-4282-91dd-e8db0885f0c8", "value": "1536:cDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd2/8oZePFOLVEr0xkvUhHy:cDAysJADlV378P3RPVJLd2/8oZeUM0e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626449, "uuid": "23264be2-93e1-4354-a49e-52dbcfab04c6", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626449, "uuid": "f08592e3-521d-45d8-ada5-ccfe49bcdf72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626449, "uuid": "8d971bad-d945-457a-bc7d-98a4e6e0925d", "value": "statistic-284381735.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc6a620-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621418, "uuid": "c85fe7f5-c6c9-42ed-93ae-63d5ad89bbdd", "comment": "Malware payload", "value": "2881d76c209981f6c20e3a73c96077ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621418, "uuid": "7724facb-b92e-4c98-b84e-e6b77c02b72d", "comment": "Malware payload", "value": "0a89841b33b2879c30851b36204fa4ed964288ef706cc278de63599ea233aba9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621418, "uuid": "b40100b2-50bf-43cf-8fb8-6c2278e93afb", "comment": "Malware payload", "value": "b3c4dc3ac0ffbbcce66ee83ddf9ed6789010b85d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621418, "uuid": "730f2ac7-b0dd-4b01-a416-68b552c698bb", "comment": "Malware payload", "value": "3fdadb1985a4016607f891f4afcbfe6446e10d5f0bb8fad6fb0564025a8697b0cf257f9a6ec0c50cf6388a76490b6788", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621418, "uuid": "9b1aab01-d9dd-4aa3-85c4-61a732f99504", "value": "DA83021013B58E4CB9CE9F2958E20ACF2FA7F9B4160D69F575290894E722C074B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621418, "uuid": "4f6154d8-9cf0-4157-9b61-bd04ac087433", "value": "1536:BDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJn0:BDAysJADlV378P3RPVJLdYDpH+jAJn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621418, "uuid": "c5ee9621-50af-4742-8de1-9ba2362323d1", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621418, "uuid": "74efc417-2a89-47b6-96b7-0050f2c09059", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621418, "uuid": "efcee317-ebd8-4b91-85cd-65b812527ab3", "value": "catalog-650588821.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe02166-a869-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645744, "uuid": "2b71c63a-28f3-4034-8217-06b76c03a0c7", "comment": "Malware payload (Dridex)", "value": "d1bfa30a9b020f98111a4a618ec9d03f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645744, "uuid": "c2b142d1-8445-4c4f-b25e-61e5f7397fce", "comment": "Malware payload (Dridex)", "value": "0aa6f064a5356d2a26819fff5fc694d468ac9f4227c08f4d53ef1a71a994e42b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645744, "uuid": "a1906fb2-8b54-440b-8691-81baa8ed3321", "comment": "Malware payload (Dridex)", "value": "af5ad37e7f0cc617d8390579c2accc537ac1478c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645744, "uuid": "b60756b4-717e-4248-b252-5826162f4675", "comment": "Malware payload (Dridex)", "value": "133b3e54d929d9fe6c4064b4491ec4a50f6a43c00e42eeb546bc56eba380ac0e55d5ab70ac8f9d57b1b45fbd4f3899c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645744, "uuid": "d9cc21df-d6f4-4591-b7f4-d41fdb8ff16b", "value": "14F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645744, "uuid": "327c0726-fe64-4dc0-a2ff-4f305a2386fc", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645744, "uuid": "e63c2506-abd2-4064-9aed-4f492aba460c", "value": "3072:ck8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY+Zwd:UnClX8WZ7/HrRCADTR0VloZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645744, "uuid": "ff325a60-be30-4fb5-b2a3-f29d2a728a95", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645744, "uuid": "a439a2c1-36ed-4562-9468-3262d194e102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645744, "uuid": "cc14fa38-2071-4413-a4ed-ec46a3501fe7", "value": "d1bfa30a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449a1f66-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623230, "uuid": "54dc275b-4c23-47ef-b832-9a0e0ab640bb", "comment": "Malware payload", "value": "cadfe18720649b167fa977591d2f0982", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623230, "uuid": "52a30d85-2eef-46c2-81e1-58cdb06face2", "comment": "Malware payload", "value": "0aaeac8d313e6d576586b539e37f875fd1919cd9c71f80ba651e236fd74afe82", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623230, "uuid": "662a3a79-27af-4771-8c96-45042ae66131", "comment": "Malware payload", "value": "ce4866b9c54448a79fbeb1f17066c4e800dc37ac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623230, "uuid": "f940ba66-5492-4342-b2e5-d8bbd146dc1a", "comment": "Malware payload", "value": "0fee42ee5c2c2c5537affd03fdec673fd7222296c5f57880a7c642c2bd9854002ca42a6a9533bfda90244f7f11d489a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623230, "uuid": "64267785-f0f5-4673-87e5-6e7aa7a3258c", "value": "CD830299203DC5DF71BC6B06B5AC893EBD4D6CB5210064ADD4D8266FAC4DAF79C63030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623230, "uuid": "ee7d7c72-0fed-4d86-b84d-50e6326858f3", "value": "1536:dG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttcI5EzJKE9LfFSp7m9v:dGEhrHJoEsBMG7qzkeI5AB5gpS9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623230, "uuid": "1210047f-a828-4545-a84d-7b0d1b124f6b", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623230, "uuid": "bff6d351-dd76-4c31-8e77-f05b117d4401", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623230, "uuid": "01472300-a288-4bf7-928b-e2bade7c3b07", "value": "diagram-1947463506.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d582a7b1-a86b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646666, "uuid": "39b95296-bc27-465a-bd08-a3a75eb0431d", "comment": "Malware payload (Dridex)", "value": "72fe684fa3484d26503b368c528b0251", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646666, "uuid": "05e9f653-04be-488d-a74e-66f853fa1e3d", "comment": "Malware payload (Dridex)", "value": "0ab8a8b3247b0d351548049a1cc7cd8a9751d89ecfa0cf4ad5ea475ca1601e43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646666, "uuid": "14a1e5c7-d586-4ea3-8ada-7fe297368a93", "comment": "Malware payload (Dridex)", "value": "857552d3906ee651a25644d80d436b9a41d911e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646666, "uuid": "62669a50-5b4e-4c32-a648-89148fc8aa7c", "comment": "Malware payload (Dridex)", "value": "be88f5b1cae84deaedd997321ba393591279a5dbb97cea992faeba87095af880f4c8ad44732d4a0797320fe30e1f7440", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646666, "uuid": "b05e6251-005a-41eb-9e76-d8fcf892c86e", "value": "1DF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646666, "uuid": "abf410b9-b79a-4803-95bb-b0f057b4a2e0", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646666, "uuid": "99f7bd07-a699-4633-aeb0-92c40fbba558", "value": "3072:wnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:7y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646666, "uuid": "dee1bf3a-7794-4c74-a967-e81c54cb008d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646666, "uuid": "a6cfbd37-df0d-4eb3-a03d-9c8930861251", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646666, "uuid": "9198587c-a0e4-4e58-a2d3-2ed1b9a154c6", "value": "72fe684f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed99aa2e-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623513, "uuid": "2195e794-6256-4845-ae1e-c9ba28d3faaf", "comment": "Malware payload", "value": "6568f55decbf9b587c7bcd2f59ee5fd5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623513, "uuid": "bb79c611-9afb-4035-9492-4ce81c093049", "comment": "Malware payload", "value": "0ac625269450973ae3a013f9f6d0439475524ab475a353ef6069ab507acdc938", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623513, "uuid": "694e9913-4302-4cf9-87e5-f628646ff539", "comment": "Malware payload", "value": "ac3b84ebd36c4f1085b6363fb3471ad8f6eedeef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623513, "uuid": "b60519a7-5eda-40e3-903c-db7597c35183", "comment": "Malware payload", "value": "4e92e707586b6bf86b329bbe42a91337825b423e4dcc9dd2f12d53da1094a0a5e7330dbcb94e279da2e396a0a0050a50", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623513, "uuid": "73dbd120-2260-4d4c-a264-3356ba543fdf", "value": "5A830289203DC5DF71BC6B06B5AC893EBD4D6CB5210064AED4D8266FAD4DAFB9C97030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623513, "uuid": "c1ba7f54-aee9-4ebf-a2e4-2513dd21e2be", "value": "1536:vG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttkI5EzJKE9LfFSp7m63:vGEhrHJoEsBMG7qzkWI5AB5gpS63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623513, "uuid": "ad4ba482-db53-422c-ae56-d8a6b561fe91", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623513, "uuid": "3b93939c-c7a5-45f2-ad97-4e93b8eebcfc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623513, "uuid": "7031b6ab-6011-435b-a503-e5842162c42d", "value": "diagram-221861607.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388cd21e-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1619620633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620633, "uuid": "ab532b34-6d63-4cd3-9b9c-532af22c8857", "comment": "Malware payload (RaccoonStealer)", "value": "5662f5f1fa30bbe40df06ea99a157331", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620633, "uuid": "ca1c22e7-8fe7-4d77-9546-dcab2adc77bc", "comment": "Malware payload (RaccoonStealer)", "value": "0aee07b7eb4a939f64a5111735af484d94c8286df1123288bf11f4603817bf8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620633, "uuid": "b16b4a43-4221-4a67-afe9-fc70a87fdd38", "comment": "Malware payload (RaccoonStealer)", "value": "04ba7df072f3b168be7ea989ae6440a52ab81b67", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620633, "uuid": "b848c394-e82e-4947-a722-6eacb920d851", "comment": "Malware payload (RaccoonStealer)", "value": "7e4e3c779a50495a949bf3dcab599fca410adeb644f9e340643da97bcf3db6a25c7508fc9d53a7899e47f3675ce69ea5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620633, "uuid": "455746d2-a5fd-43ba-861d-6f4a39dbe3e8", "value": "6F639011BBD594FF1A26E7E3DE44F8F2E2263A44996C2B8789487C442E1D035DC819FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620633, "uuid": "8e0f8c01-9b87-4818-8e0e-28df5195625e", "value": "1536:JTN0fqr33bwOz1fgGXPFF0F6TocKOINh9S5uGw:pN0Sr3rzfvsEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620633, "uuid": "edb219e3-960c-4b33-af52-20c49e7cc002", "value": 73012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620633, "uuid": "7c61b7f1-9c6b-46a9-93e8-a4eeef1ff824", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620633, "uuid": "c30f5fac-c294-4714-9698-18b945ddff61", "value": "5662f5f1fa30bbe40df06ea99a157331.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570eba4e-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626697, "uuid": "3ded3dfb-0bac-4b78-bb78-4cb1a0328775", "comment": "Malware payload", "value": "c75e7fdb35e618ada88eac8a48f3d5a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626697, "uuid": "4435b0b0-1d83-489b-93d7-7a474e46f337", "comment": "Malware payload", "value": "0af1bdf382d00f4207d776d79e714ae75122eb4f1ba253835983d08cc1050c0b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626697, "uuid": "dd0b0729-2e03-40b0-ab51-398061ed6568", "comment": "Malware payload", "value": "ac168db80fdcbfd7f2f5b359af342686bdc33ae0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626697, "uuid": "ee2f5524-36c7-4f9f-8e41-04bbf7fd7427", "comment": "Malware payload", "value": "583673413c3a4551b168d88153fb7730ad05702c4a44483a55f5ebcb7ec4b9d448f44f4b57ffea09d8a580a2c7adbf70", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626697, "uuid": "766d809a-09f8-41a6-9a9f-39fe321243c9", "value": "60831360037A854D74CE9D3C9CA31DCF3F66BAB4352E1DA2716A0498B627C510F38A3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626697, "uuid": "e7d5a25a-0923-42c7-842a-424a42422e5c", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd8Np7Ctdn77/MtKR:XDAysJADlV378P3RPVJLd2p7mdnn/MsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626697, "uuid": "c1bb1782-a021-4548-9347-d66d175081eb", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626697, "uuid": "b95d4604-3736-42ad-a12d-ba5f5bb1dd59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626697, "uuid": "3fe3f971-09e5-463e-ab77-9f959c0fcbfb", "value": "statistic-433134607.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fc91ed-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627098, "uuid": "4f204e19-5671-4711-98e9-8e21aabd25ef", "comment": "Malware payload", "value": "82dd366f743123788be9ca510bdbbde7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627098, "uuid": "ec133a5d-2078-4a08-a6bb-11f7b70477f7", "comment": "Malware payload", "value": "0af85f058c4e3eb900094948831f80b2c2b52e5e3613f012b52477343a0780a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627098, "uuid": "df68ba85-81b5-41a9-8275-e951eb6ee2e3", "comment": "Malware payload", "value": "4ef839da4af975787e54ace161c392464995e2e8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627098, "uuid": "5f695191-1764-453c-9336-39ead1f7d8ea", "comment": "Malware payload", "value": "542fa17ded6896f7bb0e4c2183610f9944461f6367e1da17a8f50d7344ee859042bc0567851d5348ec55881ba1aa628c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627098, "uuid": "0f6215ce-aa01-4a6b-b65f-58595d904b99", "value": "0483025163BACA48E8CE8A3D5CE30ECF3E12F9752E0DC8F1612D0556966AC621F2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627098, "uuid": "3e85e370-d127-43c4-bbd9-c68d02c37a71", "value": "1536:tDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdl6q0T/2kOsMmf:tDAysJADlV378P3RPVJLdIq0DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627098, "uuid": "fb894316-b780-45f4-b962-cea53d2c4284", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627098, "uuid": "8acced65-dc29-41d6-9f22-ecb624967aa2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627098, "uuid": "58e3263c-8d3b-477b-ab24-442823c51ff0", "value": "statistic-708991857.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3914af-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623001, "uuid": "e3d3270e-1141-4a53-9bb0-f8365c96cadb", "comment": "Malware payload", "value": "1227ce18b8790c176339748b407689b8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623001, "uuid": "76c90e71-95af-47d6-95a2-e38edeadaf18", "comment": "Malware payload", "value": "0afb701647c14c0dba8efd99e9d22ccfdc20f10b3c58c30529656528a8963304", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623001, "uuid": "a6b5812e-2a78-4fd9-ac39-78463851c27e", "comment": "Malware payload", "value": "b953e690d68ac0f6791b177c18082caeda95f4a4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623001, "uuid": "c92c8642-8a64-42fa-b1bd-fae757a81696", "comment": "Malware payload", "value": "7c164ada3e0d7196655b22bd1144f626845fd675ccafc06ac65a9ec0f7278a3d9b71365522263cd02659a93180efef31", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623001, "uuid": "c781f535-f31e-43b0-a04a-8d0c1d51171b", "value": "408302CC653DE2DF763D6D08A2D8883E780DECB4614434CEE4C81A6B5D8EEE758A7460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623001, "uuid": "0f562f24-bac9-4319-9b6b-0dadc3dfa7ec", "value": "1536:BG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSV:BGEhrHJoEsBMG7qzk6h12xGwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623001, "uuid": "fcff6074-836c-4065-817c-85ab7724867a", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623001, "uuid": "7a7e21c4-67ea-40f5-9174-3908b2c6dd6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623001, "uuid": "0eb74eae-e9a0-4fee-9c1f-169aa3501099", "value": "diagram-1784197600.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e18a4d-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625858, "uuid": "2fe80727-9908-42c0-83e0-602052889ad8", "comment": "Malware payload", "value": "3451bd8feffcce145243c9872517f37d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625858, "uuid": "1ed55019-15dc-4969-874c-dc6fcedf6e8c", "comment": "Malware payload", "value": "0b093fa6e882169d395469cb5baf419832d91adec2a57be9277a0abfa3c64125", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625858, "uuid": "ab1354da-cb9a-46da-b854-1a86a8319c03", "comment": "Malware payload", "value": "5619ef4dcb07dacaa723380e5ea0d3ff910d4ef3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625858, "uuid": "026c0884-00c0-4754-96c5-283edf02d05c", "comment": "Malware payload", "value": "a49a0db411209a77d11e8aa3ab2086fe8c458ea8392d59eb1521837b6606a39237f43843b51b1cf43dc8d7f3dae8436f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625858, "uuid": "535b80ca-a085-4a92-8c1d-726c8e0e9e13", "value": "4D83026443BE4A5DB84D4E29ACB20D4F3F66B6743D0A68F1B92D0485A331C561B24E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625858, "uuid": "e2ae80de-d7bc-49f2-b90a-0a764f316371", "value": "1536:gDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdihsMnSEwJPTmwqT:gDAysJADlV378P3RPVJLdUxpEP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625858, "uuid": "470022eb-9f19-4373-9203-18ecf8b98a1b", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625858, "uuid": "9b35d9ec-9d16-4871-baaf-97dfc3247984", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625858, "uuid": "63244d84-0d26-427d-8655-865936ad81a9", "value": "statistic-1807087786.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3526989b-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625351, "uuid": "2b50c2d6-2a5d-4fe2-b3df-417a195fb10f", "comment": "Malware payload", "value": "565267dbf67582b26d54db2d66f75c30", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625351, "uuid": "d4567504-095c-4200-b7a3-78946d0e1333", "comment": "Malware payload", "value": "0b09e2fcd7ac797d1c32df33c2afea14ce4cce3dad899d565b64abb403bc1241", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625351, "uuid": "c17682b1-8669-4f2c-996d-5ccde4de377e", "comment": "Malware payload", "value": "33996cfc4c70e38e1377ad12df82b53111b7540e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625351, "uuid": "976ea5f3-16e6-40c2-b256-6f2beade79b7", "comment": "Malware payload", "value": "b8382731d028bac6248c02cdb9322a37b09ef836b5fddfffb3842f1db627e0166e42b82f96ad354a2aca49b7b67fdb7a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625351, "uuid": "2d0cb155-9016-4182-a9d1-efacf51119d3", "value": "B183129013BB8E9DB58DCA3948D20D8F2F56B5742D1B6CF2B13D0494F1378961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625351, "uuid": "d736e936-53dd-4541-bcf8-24b804ec3a94", "value": "1536:IDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7eG:IDAysJADlV378P3RPVJLd47r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625351, "uuid": "0ad0f983-baeb-415a-8f8d-68808792ee01", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625351, "uuid": "6416b176-22d7-46d8-aa2f-323e635ce4b1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625351, "uuid": "3376860d-6ceb-4864-8da5-c3cc97c76e98", "value": "statistic-142567767.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded0215c-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623918, "uuid": "7e7f3f98-d28b-499d-9f7b-b5bcf8c6931f", "comment": "Malware payload", "value": "b951eaf683604a51012272942718ad26", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623918, "uuid": "c81baf75-b7ca-40ce-95ac-f4b16ad90888", "comment": "Malware payload", "value": "0b0b3de137f070feb172a4f546f3f802f399fdf80c90fbc3d002d1cc5ea226c9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623918, "uuid": "8d12fd1e-33e5-4f3a-b3b0-9815282cc3bc", "comment": "Malware payload", "value": "949d9d0731fcb549f7ed0216186362e9b4977456", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623918, "uuid": "105f1ca4-40ee-4b06-bca0-03aeb1925493", "comment": "Malware payload", "value": "8081d8f2c1f86c2539777707f7020121b6eb9e3d47963b9f55cb00787a96e7f7a4425f6c8e54bbfa6d32b7c96d9cf52c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623918, "uuid": "8f730cdc-2ffc-4bad-ac92-a76b3ba4f942", "value": "8883028C613DC6EFB1AD2F09A3DEC47F761EFC623044248DC8C866A65D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623918, "uuid": "1edf700c-31bf-4ea0-9296-54447f513534", "value": "1536:hG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttie6n6475e0NEnP6A:hGEhrHJoEsBMG7qzkE4q/NEnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623918, "uuid": "37bf3430-733f-4b15-a80d-4190abf5e5db", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623918, "uuid": "b2e3c4f6-c7f8-450b-86e5-34d164ac8919", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623918, "uuid": "1d18ad59-7bad-4505-b65a-dbe26f6328be", "value": "diagram-498154962.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1efeca2-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626527, "uuid": "8bba9635-b545-4df4-92ae-6dcdf127e1a1", "comment": "Malware payload", "value": "64442a73c6259874391ff71dd0993099", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626527, "uuid": "202f1d79-5c66-415d-b282-ab83d8d54724", "comment": "Malware payload", "value": "0b0b455b364761ffc694ddc084d54f629833fc1900cfe669f9331a766b0df434", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626527, "uuid": "c92f1637-2a73-4e46-bdbc-66799052a9b7", "comment": "Malware payload", "value": "d93c7d2f0ec3c5a3fddbe9fa88b6c2992572026d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626527, "uuid": "2cd1c75d-3722-4109-aafa-1325262ff986", "comment": "Malware payload", "value": "913ffdd625da79061a8f127dc49dbe5f2067afd8ed7c84f06059aacae5890fc0ee9feaba302fe70c984645e9f4c4ca44", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626527, "uuid": "789b492b-e54d-4765-a3ff-a7ce7dd50efd", "value": "04830260437ACB1DB58E9F2D9CE31D8F3E5AB6B02A1D9CF1753D0494F166C110A2463E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626527, "uuid": "13e59adf-aaa1-4bb0-bd48-fb2d13ab6864", "value": "1536:iDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdn8rZctFOLVVrCvI7s6O:iDAysJADlV378P3RPVJLdn8rZc2xCvm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626527, "uuid": "38645afe-ea1e-447a-a5b8-56699623e0d4", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626527, "uuid": "34756b1d-ff15-4bc9-b177-541fe4918a3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626527, "uuid": "20c5639e-49aa-42c4-b3bc-5a9b390fa41c", "value": "statistic-333148488.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f071b38-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625019, "uuid": "742f0a2a-3763-4765-8537-30711473f0ce", "comment": "Malware payload", "value": "9ba8973c225c7574add3eee508123b83", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625019, "uuid": "daa69957-9c89-470f-91e3-1c6787b203c7", "comment": "Malware payload", "value": "0b0f14857e2be8c22eb1b5c19859527ceddf7fe01d96aa7f1fb84af834cbecae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625019, "uuid": "ebae4eb0-3ccd-492f-9a4d-8c5d976cd225", "comment": "Malware payload", "value": "54a93eec064519f34a17c92cbded9920b0503c1c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625019, "uuid": "73934ddf-e676-4104-a062-815952ee5091", "comment": "Malware payload", "value": "ac0752de75b4d06dd607fccee5c5d43e79df0c5a6b8b70c6c3a387ebfb6a43c0d5c8ba00de51bb451abb1486c9652eec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625019, "uuid": "e6b480cd-dc68-4963-afac-a5b721d94662", "value": "9883021523B9C998F58D9E2C4CE30D8F3F42B9742D1ED5F26229019AA227C664F2493E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625019, "uuid": "39b8d8f4-449f-4948-8ad5-3b0a3254fe3b", "value": "1536:vDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdpPqXT/WkO0B19M294:vDAysJADlV378P3RPVJLdVqXjV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625019, "uuid": "708a4f78-1320-408d-9063-b2a5ab29b61b", "value": 86117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625019, "uuid": "dbbfb434-c49e-489d-8743-6e1c4661aed5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625019, "uuid": "61e4342d-4235-42d6-b68f-63d9548fb059", "value": "statistic-1167138969.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63e12dc-a854-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619636815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636815, "uuid": "3e45d514-a363-4ff4-8ba7-f1f991314e18", "comment": "Malware payload (AgentTesla)", "value": "9644a199c0d74c2f223b042b93899333", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636815, "uuid": "8084312c-0a76-49fd-806d-1eb92b754e36", "comment": "Malware payload (AgentTesla)", "value": "0b10841226c0d6fb59f308c09309e79d214ca6799ac162c1addd5455d7ef3fd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636815, "uuid": "6f6bc2a9-97e5-4c1c-be99-f101bf657998", "comment": "Malware payload (AgentTesla)", "value": "00a0778246cd4e4df046ea7c3ccdb5d04f056a19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619636815, "uuid": "d14a1743-466c-433d-8ae8-79c7d2e8f0dc", "comment": "Malware payload (AgentTesla)", "value": "b142383d24156456ae0fd01c022bf994be73989257daf4cd35790f216ddeab78dc659e31f2ab4047526ca952cc36b9dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636815, "uuid": "529e3458-581a-4826-bbc3-27e401aa7cab", "value": "EEC40121A3E8CF29E6BE63B96571000057F2B957E733E35D6DE9004E0EB6B404666B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636815, "uuid": "54c11b12-58d5-44dd-ba49-26d8bc2eb048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636815, "uuid": "fc0d4115-7a6d-42c9-9132-4149d34f7469", "value": "12288:MGJdCTsSv66GiBR2BGKFivWvNvFvklc1Kl/h3xBNbGNdYn/mw:XCQSXV2BoaNvFvklL/7B98dTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619636815, "uuid": "9580b446-0dd5-4d1b-bd23-40bbfded6c90", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619636815, "uuid": "7c2da6ea-98ac-4cc5-b84a-b410e993c500", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619636815, "uuid": "a0693af4-eaf7-4bce-830c-1e506739c0e7", "value": "9644a199_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db184ef5-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640662, "uuid": "3c6c0105-4c41-4bb7-bcf2-e3886dc48ae9", "comment": "Malware payload (Quakbot)", "value": "7b3330877a56e4855fc3eafbafd944bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640662, "uuid": "a886a55e-48b9-46fb-943e-8a5a051e9881", "comment": "Malware payload (Quakbot)", "value": "0b16120908d194feb299e913cd6b1f25cdc015288eb592970118679a07ca2447", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640662, "uuid": "352ccdd9-9d58-4762-a7f2-3963a3ea5955", "comment": "Malware payload (Quakbot)", "value": "3d76b5b75b7f1205c77ddd13219ec5eec2fe87bd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640662, "uuid": "e9d18137-ab18-46f8-a06d-7255c43be9a3", "comment": "Malware payload (Quakbot)", "value": "c8e8dc2f81ae2b021439a5f71a7185faa62ee9fbed7a1af207c1c4ba21fc7765573fb84a0db536a01666066df0f080af", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640662, "uuid": "c464047c-860f-453d-9873-bd7be23cc45e", "value": "82948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640662, "uuid": "83c9d139-ffa4-44c9-98ad-12a056913efe", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640662, "uuid": "5060c3b1-a04a-4fc5-a6f0-3b1b183d1b60", "value": "6144:XVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWrah:gFNmLKSVpJbPT+4xrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640662, "uuid": "15a6c25f-7d2b-45ec-a5f2-0d09117868f4", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640662, "uuid": "be415c84-060c-4d0c-bee6-2ffbb7cd0331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640662, "uuid": "39340eb7-cc3d-48e6-90fc-a395ebc2c789", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2635ed42-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622320, "uuid": "03187fb5-c854-4587-8a1e-dd79de7f912d", "comment": "Malware payload", "value": "a8caa3ca5cc3115d7719c73c9fe73c14", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622320, "uuid": "780abada-974c-4ea1-bae2-8cba0c0e5173", "comment": "Malware payload", "value": "0b1d030e3976588a20dd73d319843edaede965a45284be6be623121d468b5c48", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622320, "uuid": "20a80c46-1739-4735-a198-f3293c0a149f", "comment": "Malware payload", "value": "fdf8e2eaf260ac357f4fddc4450c0623f28f6e89", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622320, "uuid": "7c29fefa-9750-4a51-9f35-e2918e26d298", "comment": "Malware payload", "value": "7a866285063feb8c1f470e59b420d0120eb724c7d305ccf0cb2e71f00edefdf2c6b9cd69d3a3a98cf2cd46620aa63ea5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622320, "uuid": "05521fdd-e875-47dd-9b53-1e3d2e5cb3d3", "value": "9D83028C313DC5DF7ABE2E4952DC887E740ED8B43144154ED8C86A6B9E8BFEB1857460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622320, "uuid": "dac46a3b-b135-40aa-a5ed-a692023e3522", "value": "1536:/G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttEKkApVr6wo+Rx9wc:/GEhrHJoEsBMG7qzkaxApxTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622320, "uuid": "2ebe5172-0f7b-494a-aa1c-967f3cc157bf", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622320, "uuid": "21f6170e-a4fa-4fb4-a52d-6805a27a256f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622320, "uuid": "e8a457e1-0759-4fea-90ad-c440a42c7d51", "value": "diagram-1301447093.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1e0068-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624529, "uuid": "2b1dae16-86f8-4f91-990a-98ca7c3a499b", "comment": "Malware payload", "value": "a48b3c53deae4c69c8b844e1f99c1403", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624529, "uuid": "cd884485-333c-4417-9365-069856a40424", "comment": "Malware payload", "value": "0b36d5dbfbc1a941a0ceda441a9d1b1b61b7e3249e0124505d492b867c419c0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624529, "uuid": "d0293f2c-3471-49e2-a9d8-728bc1b0bb4d", "comment": "Malware payload", "value": "229f371a1956a49adb319ac3517157cf37ca42e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624529, "uuid": "f0e256b8-756e-4691-b62d-7dcd0ade7c00", "comment": "Malware payload", "value": "935eb1d6f8c91456eefd41614e52fa81ca8eee5c611c4b20de37224c4fabda2d04818b22b498ca7f3a259c2f3ffcaef7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624529, "uuid": "9b4bb218-83ec-4aa6-88dd-2289cbef4666", "value": "BE83028C253DC5DF7AFE7A0962DC887E740EE8B43144144EE8C8566B9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624529, "uuid": "d6c9bf65-f618-4f98-b0cf-cdd81be2e382", "value": "1536:kG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt9KkApVr6wo+Rx7:kGEhrHJoEsBMG7qzkDxApxT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624529, "uuid": "d557ce00-b65f-43a2-bed6-bd412853f7c0", "value": 86092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624529, "uuid": "3e118b9c-6f95-4317-a64b-7804ff0a5909", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624529, "uuid": "9eb51a3c-689c-4252-a6b3-8d62cdd1ec90", "value": "diagram-81760734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81aacc7b-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621185, "uuid": "02c7718a-5e28-439c-b30f-380af4acf9e3", "comment": "Malware payload", "value": "f3495bbc005b481320009a6af05fc97b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621185, "uuid": "4cf875cb-0f9e-445f-a4c8-c7d84b22c7a8", "comment": "Malware payload", "value": "0b384d262256357948fb2fe94d73e1c4a0bf39754b322849a1f241c73ee91d67", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621185, "uuid": "e1be8203-0c37-4a2a-8e08-884e6628d449", "comment": "Malware payload", "value": "0326fd8ba46dfdec113e0d3a3937ba59ec77c2bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621185, "uuid": "8884a3f5-5dc2-4e3e-b3f8-015a018a0dce", "comment": "Malware payload", "value": "f1d3a02091feb9e36f3d5887392950a44a91983cec20841917b68beb32a27d878f1908d1694d5b8c53f936e8b6ccf759", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621185, "uuid": "c93a0c25-6a1f-40d3-af60-18a265fe775e", "value": "E583021013B54A4CB9CE9F295CE21ACF2FA7F9B4260D69F565280894E721C174B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621185, "uuid": "c8161dc5-23aa-4df7-b0c3-eee6b44e8536", "value": "1536:8DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJ8W:8DAysJADlV378P3RPVJLdlDpH+jAJ8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621185, "uuid": "7fd6be11-2002-409d-949a-b63ed23df308", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621185, "uuid": "7601ca4e-114a-4464-bcd0-99cd3bf46b46", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621185, "uuid": "c102e4e4-bdf6-4035-9b00-ebc2fabcd9ca", "value": "catalog-448742446.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ebb2ce-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622621, "uuid": "b29bc0b8-5b9e-4e84-8230-49a8a295b586", "comment": "Malware payload", "value": "05bb6bc2b3e7c748473d17a79cf63e32", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622621, "uuid": "698c90de-98ca-454b-bcb0-fe571247b18b", "comment": "Malware payload", "value": "0b3f3a2a3e4e6d926072adbe6636e1e32a69abc73f911d206a44fa149a2937d2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622621, "uuid": "00816ca4-ef6f-4a9d-a3a1-e59f60e90b98", "comment": "Malware payload", "value": "3302208e244a05ce73e08d43c7b402c7a98ca926", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622621, "uuid": "9d997f68-72fa-4738-b0f6-c63efa49971e", "comment": "Malware payload", "value": "930f6f7401591658967c71fd0cd06bdef0c0b9f3e9e9632fc05d5c161763a19858a1e90cc150a93c3c3a7ec6fb26f631", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622621, "uuid": "11f8fed6-68c4-4a7d-a5bf-d06cef50cd42", "value": "8283028C213DC5DF7AFE7A0951DC887E780EE8B43108154EE8C95A6B9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622621, "uuid": "17a91b60-ccaa-46d2-ba92-ad7006adf7ed", "value": "1536:bG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZKkApVr6wo+Rxs:bGEhrHJoEsBMG7qzk3xApxTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622621, "uuid": "39b709e0-ac63-4b78-a3a6-054a5fff3a86", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622621, "uuid": "eeabb7ca-d3ff-44a9-8cb6-23515e0cb1bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622621, "uuid": "fd6a5d0b-ee92-4dc6-a41c-73b3bb200b58", "value": "diagram-1513949076.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4059a840-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626659, "uuid": "7346baa4-183b-4614-8229-b2170ced186f", "comment": "Malware payload", "value": "e6086b26388018d13ffee008b95eb207", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626659, "uuid": "2677c710-8709-4272-bddf-0e8d958c2412", "comment": "Malware payload", "value": "0b580dce03e2de80f9ab50a70794ef19f272b0a044e0f61f9324a1778badecf4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626659, "uuid": "45b38b89-96a3-47a2-a1ab-ea29ab6c8b5a", "comment": "Malware payload", "value": "0ef980c60c3ac096370a3a9c09bce4557349c0e5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626659, "uuid": "9cb60540-336f-46f3-a8e3-535139c6eb9f", "comment": "Malware payload", "value": "a59133315c9c19fefff745f36ce32a4ea9abe5fb8db79e388d3563e1d2a4e0be9bfa4b693e8d6c49d81f35ddad39210e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626659, "uuid": "d8993792-a3d1-4d2a-a0ff-1abab543bc22", "value": "5B83015013BA5EACB45D8E2DAD92098F2F97B6642D1B48F1A52D04C4B33285B1B3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626659, "uuid": "c87cb73c-e64f-4e0a-8c83-e10229f67fde", "value": "1536:pDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYMnSEwJA75h:pDAysJADlV378P3RPVJLdVpf75h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626659, "uuid": "5ca6efde-103b-40c2-83c6-899b00fb7fd7", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626659, "uuid": "bfa499e7-9750-4bd5-ae03-c6275dd82aaf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626659, "uuid": "20c42b23-70aa-4555-a64b-a9fb6753eb3f", "value": "statistic-407207269.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e03617-a7cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619578829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578829, "uuid": "61e4df63-8db8-4bfc-a407-7015adb36313", "comment": "Malware payload (Dridex)", "value": "0a2fc097fc2ba7b2af8f0fb019d2a296", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578829, "uuid": "d9d339e4-5054-4e54-91e3-5b222c2839f9", "comment": "Malware payload (Dridex)", "value": "0b5cae1277d5f1cc0c1a4d7fcaae15336be1d3ba17974834349989a347d7730f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578829, "uuid": "ae1e4b26-9896-4375-b502-36dd1fdc0581", "comment": "Malware payload (Dridex)", "value": "522f69f0ccea29f33e5412b71a8ba0a1d3313d43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619578829, "uuid": "2e45ece3-5a7b-49ba-81c8-adf6b217b250", "comment": "Malware payload (Dridex)", "value": "ff6d0535ddfabde2f0ba87d826d4f613a5e28a7785969d86c221cda641317418de91cfc5df55fc298ef4998c6451beb7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578829, "uuid": "a81f9fb6-4c1f-4cb5-b6ae-54905f9dc729", "value": "1AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578829, "uuid": "b8bdf43d-563c-4d1f-9ee6-99fc7218519b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578829, "uuid": "55e05024-123a-4a87-8721-d23afe9d4c9c", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619578829, "uuid": "54423864-7720-4ff3-875c-6be209e2d44c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619578829, "uuid": "c77057f0-f53f-407e-a00e-eef33c74a24d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619578829, "uuid": "c0c1a545-f295-47fd-ae2e-a2a48f299313", "value": "0a2fc097_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fff336-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621833, "uuid": "b2f4153c-d537-4cdd-a3e9-aef81d7d8b5f", "comment": "Malware payload", "value": "193eeb14c5d0dd8e1012ab272637fe3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621833, "uuid": "2cd9f132-7d32-48c8-b169-4a19d89f26db", "comment": "Malware payload", "value": "0b5dfc4b236e90cd5ecd3506e0050b13129a031a417c7e3755fcbd578415aab9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621833, "uuid": "84bc42c8-62f0-41c3-9e9a-257ef75e3b22", "comment": "Malware payload", "value": "d50d9ff65253c1fd9190f6615757aadbe3d7c29a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621833, "uuid": "5cdc37a5-050d-4d87-a19f-2f39ded6ea3a", "comment": "Malware payload", "value": "58f213d9b18e57a33780e43a9a1e889d4c16fce6b40c0660f1cc9145a203b2f99318e5c6719f9c33b8c53743a46efeb1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621833, "uuid": "c6136640-6b94-4306-81d5-b34adeb97e73", "value": "9F83122023B55B0DB9CDDE295CB31ECB2F87F9B4250969F166290491EB13C174B28A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621833, "uuid": "0c52be91-22a8-4086-afee-7ce7d18dcfd3", "value": "1536:oDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdnaP9+jAJS7i:oDAysJADlV378P3RPVJLde+jAJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621833, "uuid": "b51c87d1-b607-4e9f-a90b-f40c9d41c55b", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621833, "uuid": "360e858e-d854-446a-a56c-77a890a70018", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621833, "uuid": "18923666-31a6-48f3-afee-7d09ed3a1a97", "value": "catalog-95796401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bb13c1-a86d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647366, "uuid": "062855fd-d3e0-4cdf-a11e-027643c8e473", "comment": "Malware payload (Dridex)", "value": "815d7c5c4079be2b57c7d5ed5c14418a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647366, "uuid": "adc64573-6bd0-45ab-b328-6516184c7dc5", "comment": "Malware payload (Dridex)", "value": "0b668d7365572f56bd61cd2a460bf2b95e111d10df2fe7ab4ddcccc4a599bde7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647366, "uuid": "5420978f-f9df-48f0-ac1c-e1a433c64b2e", "comment": "Malware payload (Dridex)", "value": "734c1d2ee1a782ceb4c4670926113763e83904f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647366, "uuid": "6ecd2a81-d460-4d1e-8657-816cdb3fe369", "comment": "Malware payload (Dridex)", "value": "ca84e47ef4cf4b7b83bb7b7fadb5996aa7d877df890a72479af2bd6c6c667134391b81714b62ce26bc6c365d3d8a5598", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647366, "uuid": "d34ecbab-2083-4954-801a-3dcb48cd123a", "value": "0BF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647366, "uuid": "b6723c18-c226-46e1-b98d-a6d844be3af5", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647366, "uuid": "fff289d6-ab77-46a2-b78a-901c56cbe789", "value": "3072:SUT2d85tleLD51fC5AHYEoefukoTFMpGmj48D:cy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647366, "uuid": "c2128723-16ed-4fdf-a9e8-f634675dc9c8", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647366, "uuid": "0269ed1e-4074-4c80-9217-c345a006c992", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647366, "uuid": "97a0288d-d9d9-4928-a091-f290b7256c7b", "value": "815d7c5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12098acb-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622286, "uuid": "7ab64507-4de7-409b-b4c4-8c59c5ca9d58", "comment": "Malware payload", "value": "8872b1138d31280bc14053ef8aab2264", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622286, "uuid": "c30bd341-9805-46c7-80ba-d1a29cd38dce", "comment": "Malware payload", "value": "0b768f3f6fc7b19987b8468d9a14009362d72d692d869c78d0843b6a0f773a37", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622286, "uuid": "7c9cedd3-116a-4017-80a7-9e7c779b66bd", "comment": "Malware payload", "value": "49f0829e2b882aef60cfd77d7ef90da55b6acdba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622286, "uuid": "81d86b26-1445-4610-8e65-b287b0f6d269", "comment": "Malware payload", "value": "72518be89f1bdd6d6a81ce49f78344755fc232cb4c9a77fcdbcdec7ad77e769b72e5c9b411a528036c1aaab29e4bfb08", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622286, "uuid": "3a7e7548-e118-4800-8245-6e72142af724", "value": "B383028DA53DCAEFB1AD2F09A3CDC53F761EED613044248DD8C466A65D49AE30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622286, "uuid": "1155e1c2-d679-425a-a0a1-e2638aeca992", "value": "1536:YG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOe6n6475e0NEnP6d:YGEhrHJoEsBMG7qzkQ4q/NEno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622286, "uuid": "9e0c8fc2-0766-4ebe-9f4b-4accd6889dbb", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622286, "uuid": "f2cc3e2a-2b70-4ecc-9f47-001d3b24e149", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622286, "uuid": "ef932f24-739c-4a22-9e8d-386beb4079ae", "value": "diagram-1279685389.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed52f7f3-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619218, "uuid": "43229738-a2b8-4872-b4cb-b78359365465", "comment": "Malware payload", "value": "9bc9fedf7b376dbf24ecceddaeffcbfb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619218, "uuid": "3203ef3c-a3f0-43da-b11b-c6168a146a42", "comment": "Malware payload", "value": "0b77edc8bca57b5500f894b1501b9f0d1074d2e0a2a66f4d571719b64b656a4e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619218, "uuid": "cb24dc89-87b7-409f-8e5c-5b7308c4eef7", "comment": "Malware payload", "value": "8e6f3aecdd7ff1668f966cfb2e923add9617308e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619218, "uuid": "316a1365-a0a1-455a-bc2e-ace4aba97355", "comment": "Malware payload", "value": "0ea56f65f735e9fcd5facaba7ea19d029b5018f1d33d9f787316d9de840e19a984488aa9c0a38be73be0183e664728c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619218, "uuid": "b1fcb9d3-4d4c-4ae3-b2e5-2504b31a356f", "value": "0B83022403AE4B1DB48D8A3A59E22DCF3F42F8B4195999A2552904E8F327C619F34D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619218, "uuid": "d2f4d805-520f-4cf1-a8e9-72f46e11e2bd", "value": "1536:2DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdXRPYMrbsTjHvVR9p4:2DAysJADlV378P3RPVJLdVYMUvdRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619218, "uuid": "a076f137-dbcc-48ad-a906-9d2f4481ba43", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619218, "uuid": "06b669be-d77e-4890-87da-842bd833f0d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619218, "uuid": "0d5847c4-c2d7-4aed-9bab-b16cf212c91b", "value": "catalog-1118791029.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def8cc90-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626066, "uuid": "e75d35be-c48f-4e25-a2c0-11ab4ff22a8f", "comment": "Malware payload", "value": "b889af3f2590c979e85a08bcb76d7ed8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626066, "uuid": "a48a94a3-f8c6-431f-a3fb-78ed91eb6d5f", "comment": "Malware payload", "value": "0b7a475a88f7fb95248c6197d1a6166ff2e126e4200a2f7d2d9b201e3ed1def1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626066, "uuid": "34e3cf95-ca90-4e86-afce-e2a30200a30e", "comment": "Malware payload", "value": "0982659464541bd103c9c376d0bb248135b0cdf2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626066, "uuid": "de495f0a-03a8-457e-be74-ac81512c0785", "comment": "Malware payload", "value": "f7aa22962391954719d6c4cbbf0ca93e21d4de86c22af83eb0774088535045989e9db9c039584264768affe67accaa9e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626066, "uuid": "ac0f9a14-5185-4031-8740-738a926a8d01", "value": "8A83125013BB8EADB58DC93948E20DCF2F56B6B02D5B5CF2B12D0494F1338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626066, "uuid": "ca4e3457-1562-47fa-a3a0-7e8ae35a5edb", "value": "1536:EDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7o7:EDAysJADlV378P3RPVJLd47o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626066, "uuid": "c4ade3ae-44c6-4890-a27c-1364f0012715", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626066, "uuid": "9846306d-4a98-4d23-ac44-672c747fafef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626066, "uuid": "096154db-5104-4357-a646-ac562e4e1f1c", "value": "statistic-1940418450.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6440d85f-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624571, "uuid": "8b1c8b73-e85c-419e-9632-a94a86a1e52e", "comment": "Malware payload", "value": "b9c7d0a94af9d78cfdc7c21453528e9b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624571, "uuid": "2ee0fac0-177c-4fd7-98a8-5f02f8ff2723", "comment": "Malware payload", "value": "0b8057bb6ccc06198cf23f9236c43ccd247bff27f457ce10bb8be6c7a148d77a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624571, "uuid": "029d0294-2391-440b-b517-5f387a73a60a", "comment": "Malware payload", "value": "a9a298adf3472976efbe3115b6fd72576f2e2255", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624571, "uuid": "180f2faa-e0fc-41b9-bd4f-ee58553d58f0", "comment": "Malware payload", "value": "52ff158be921723b65cf3b382e088a0b124b47005357f14700e2774639391800f38043cd0d26925ea4ca941f7a19a132", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624571, "uuid": "fb8b34e2-2eaa-44e3-9e37-8c27e9f67481", "value": "DD83014D213EC6DFB56D3E09A59CC87EA50EDDB4204028CC98C477679E4EDAB4CAB4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624571, "uuid": "f02a8c2d-e449-4cfb-a10c-14a74ff0767e", "value": "1536:EG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttQKKmo3zuUkbw:EGEhrHJoEsBMG7qzkw7KRbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624571, "uuid": "3602065e-3328-4d10-bf59-8ac9ad10af74", "value": 86095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624571, "uuid": "fc58314a-fff3-4657-ae90-eb9876cd9189", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624571, "uuid": "ddf758f7-2198-4c82-8fae-ea3817a997e4", "value": "diagram-854280052.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4ebb29-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621823, "uuid": "71e5ffcf-8f2e-4903-abe4-14509d1cad95", "comment": "Malware payload", "value": "f0c0b2a8119e7660964b19690b7f0ea5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621823, "uuid": "680f45a7-108b-4d65-9ab0-e58cc74b5b4d", "comment": "Malware payload", "value": "0bb19670fb18f155f6f7728432f97cc22d4614093649d41f9bb9cb6262fe7539", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621823, "uuid": "63fdda92-9f49-4b22-a144-c5ba021d44ca", "comment": "Malware payload", "value": "0b8ac4be99934560eb4cf71b255dad6ef0e9e242", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621823, "uuid": "05f08b05-0704-449d-abd5-4bd43c2a5bda", "comment": "Malware payload", "value": "601ed5e4d41e66718c09511543f791c8df78a5c1f2892e92e9a653a409a443fed1c9feee8dd1d34d440f78a415d1d575", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621823, "uuid": "2cee3b46-7b0d-4095-bfb7-acf0ec9fa81c", "value": "5783023103AE8B5DB4CE9A3954D22D8F3F97E4B82D195993511604E4E32BC629F38C7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621823, "uuid": "70486188-15c1-40e4-8e5c-e38263a54c1a", "value": "1536:dDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRW:dDAysJADlV378P3RPVJLdcDsMU0dRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621823, "uuid": "c1a23c98-3157-4838-94e8-962cc33941b5", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621823, "uuid": "466b59a1-304e-492f-a5ec-5d208207410d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621823, "uuid": "456afa87-7ebc-4d05-af7a-4150974fb382", "value": "catalog-947755686.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc3302b-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640665, "uuid": "8e4a505e-08f0-4b82-bffb-03e2ea6521c8", "comment": "Malware payload (Quakbot)", "value": "2319224164c0d475a323c9db3fab5a5a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640665, "uuid": "0748671d-2b3e-4aad-8387-d82afce137b8", "comment": "Malware payload (Quakbot)", "value": "0bb9ad73d411a1bb750c712b1678c174f34b1bf942bed327dcf913e7927f6612", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640665, "uuid": "7ad14a20-28f7-4a3f-841e-8410f96ec301", "comment": "Malware payload (Quakbot)", "value": "7643267860919d083215401638ad268ce2486cf9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640665, "uuid": "1826c693-1242-415c-b75e-16b2fe8abd21", "comment": "Malware payload (Quakbot)", "value": "a35fd97a73b08b6001d25a929ad8454b0a27fd4ec32a78756566335a39759b114a17d2562c4e4cc0172ba3d75cabe178", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640665, "uuid": "c01273f7-6011-4f4b-b35c-267f015dbc1f", "value": "4A948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640665, "uuid": "bcc5e7ff-f55d-4a56-9e7f-85adf4beac1d", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640665, "uuid": "271e0d68-e796-493f-8347-ecaf85c29982", "value": "6144:ZWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmX:ZWrsTwr03pdf8vhhOKJETlByX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640665, "uuid": "4950af40-e3df-4286-8b1b-ccc6f80b22df", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640665, "uuid": "c4c5454f-bf40-4052-985b-0ff5e98fd6cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640665, "uuid": "f6ddb455-dc7d-4064-9483-9367ef34ca39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de61c51d-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640668, "uuid": "563cfbd4-bcc9-4e09-9f64-ff6fa80b2d6b", "comment": "Malware payload (Quakbot)", "value": "aee3209a69ebb8649e39f743dd6e513f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640668, "uuid": "24565e7d-1f1a-4b73-bea1-4be0439dfaac", "comment": "Malware payload (Quakbot)", "value": "0bc6057d9bdb1470cb73e91516e473eb16b401a00537b077e7fc9863cb11d7ac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640668, "uuid": "ca414eb5-4799-45cf-9103-0090a17db7d3", "comment": "Malware payload (Quakbot)", "value": "37026afaf49c7d856d1f85e39cf9a418d6d05220", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640668, "uuid": "071c3197-1d79-4eab-997c-15dabe69f4ce", "comment": "Malware payload (Quakbot)", "value": "3fea99b97d06e1aef9adbf318602e40f534a71489a8d2d8cf3ec7f469ee34c041efd3e413075b9322301a1eca618b0b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640668, "uuid": "a35fc394-7faa-4862-a934-09c644303f6c", "value": "EC947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640668, "uuid": "2e6c1b09-5125-4657-92f8-5c0399c95863", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640668, "uuid": "1da0fb69-b932-4736-b70e-5417658e6b18", "value": "6144:iyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm4:2Twr03pdf8vhhOKJET5By4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640668, "uuid": "c5dde658-bda7-4fce-97fc-0635dc417da2", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640668, "uuid": "5b6adab7-9a48-44b1-93ca-823c1cc74e7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640668, "uuid": "c2a499bb-3a02-4a72-9326-57e1398714c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347b911f-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621914, "uuid": "a97e1b4d-ac95-4957-ace5-5fe8a6b06c2f", "comment": "Malware payload", "value": "70e4679b146731ba3a97623710851a04", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621914, "uuid": "49e88e7e-177a-4f04-8763-3e2c37d72775", "comment": "Malware payload", "value": "0bc7f294992f7941aede83baa1d76a7cd579acbe2f83f8b7489b17c27dbbefdb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621914, "uuid": "5cd3a3c1-92ca-4dd6-b44a-748b73b61f6d", "comment": "Malware payload", "value": "12b8040a206d49b8e1d2ec1ae37dc710b6c80aca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621914, "uuid": "27f85e66-be1a-42cb-8e52-220c7521b215", "comment": "Malware payload", "value": "7dfafea97cb02e0b2d5f0275e3274a78ef93a72e1dd716e10fd01805e4f37a56373d2c516976cacdb47957ee2e053587", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621914, "uuid": "b25ae52c-9787-4a15-a83c-79e805e4c7df", "value": "8883028C653DC6EF71AD2F09A3DDC47F761EFC663044248EC8C866A69D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621914, "uuid": "ca8b968a-d954-42dd-b64c-5db0bb9e3579", "value": "1536:QG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttie6n6475e0NEnP6c:QGEhrHJoEsBMG7qzkE4q/NEnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621914, "uuid": "b695f7f3-2b8c-4f12-9368-ca9efbc0340f", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621914, "uuid": "1b62ea4b-012c-4af5-af4b-bcac04c2c8e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621914, "uuid": "a0889e70-f86f-4cf4-9674-fcd8bd81b321", "value": "diagram-1004935894.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d092664c-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619599, "uuid": "0b8eda3e-698d-4d72-b78a-feffdf8fffec", "comment": "Malware payload", "value": "a81b4f81a36c5bd9e20e3a1be25944aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619599, "uuid": "7ae5e477-69fe-4b55-8fc9-e73524f004bf", "comment": "Malware payload", "value": "0bd0b05b7fba1fca805c57c734d4c2e6739736f9072ab8ec690b2b725d1558f0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619599, "uuid": "6d8faf3b-4fab-4f0d-a06d-470657566eac", "comment": "Malware payload", "value": "448af55a2058b40cdfbe91b8130764bc4ff882e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619599, "uuid": "ca0a978b-8fca-4ae9-9c0b-cec44d3545a7", "comment": "Malware payload", "value": "61ec876c235af99c0cf0ab148dfe2ab611f6a1967e59edcdbe26494c71b702f7094570762ce2d5de08c8758537c088de", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619599, "uuid": "576b0bf8-2c71-4f51-87ac-076db691ef69", "value": "6983027043EA4F5D74CE8A395CF21DCFAB6AF9B43A1D48B0566E0451D223C962B2853F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619599, "uuid": "a78cfed4-914f-448b-9267-6225ed57e907", "value": "1536:ADXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiE58VP0IsOzCy2BXcEnvII:ADAysJADlV378P3RPVJLdd58VnCy2BXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619599, "uuid": "a631c562-5efd-444e-aca4-be34edf025a7", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619599, "uuid": "b1c85ae0-841d-475a-8246-6480bb7baa90", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619599, "uuid": "fc25cdc2-8e7c-4de9-bc89-0701b72b3d61", "value": "catalog-1371889371.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329e77d8-a83f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627495, "uuid": "2047337f-74d0-4063-acab-8ec12c61288b", "comment": "Malware payload", "value": "51c205d2bbf4b2a51d98af9141df539b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627495, "uuid": "b5023bfd-ae66-45bf-af29-262626e39b5e", "comment": "Malware payload", "value": "0bd9ab4d026b9f3474f42142882088667af5ef5f50a06f1053415dee22b041ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627495, "uuid": "f5f5e334-c25f-43e0-8b41-c85f39bb3732", "comment": "Malware payload", "value": "256189e9924d6371e96cb234807c55823ad7e80d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627495, "uuid": "d153c6fb-659b-4cf3-bea0-624c01f24066", "comment": "Malware payload", "value": "16ba56a95d2ef6d6e1d3c0ca2c549139705e920e2e1155a3121bf5b1b71b3620c536de04c570dfb77c71f3921ec7bb68", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627495, "uuid": "d812987a-e318-440d-acc5-4d19586652cf", "value": "DA83129013BB8E9DB58DC93A48D20D8F2F56B6B02D1B5CF2B13D0495F1338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627495, "uuid": "a9fd64dd-9434-42f9-9326-dadbf99b7fd7", "value": "1536:ZDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn76Y:ZDAysJADlV378P3RPVJLd475", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627495, "uuid": "c6139fff-b3d9-437a-a03c-480f41897d4a", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627495, "uuid": "3546de52-84a8-4fb6-877b-ef66dd6c7dda", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627495, "uuid": "cac4f546-c5fa-4257-a02d-316b93d3f120", "value": "statistic-994342869.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3164d8-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625175, "uuid": "eea038f1-6fe0-403e-ade0-b55e613bb021", "comment": "Malware payload", "value": "08af7429c8c76ab993ea29e97b849f8c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625175, "uuid": "7fe46aeb-8509-4289-b952-3e087c3b8940", "comment": "Malware payload", "value": "0bda04ba4ddd5a181023edefcc48d5eed2485623b792887cd5aa647daf400e55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625175, "uuid": "96191ad9-a22d-4620-b8a8-2b66e229f6b1", "comment": "Malware payload", "value": "bb889c944a26d943a6c58fa55eb729d520fad15d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625175, "uuid": "e33ee26f-7dc1-4c10-b4bb-b80033d083be", "comment": "Malware payload", "value": "da120f5feb6e01bd2a2860d7e171318a65b7d9477e97a9e7c52970d9c129a28abac158d1ff21cfc92489495c556c666d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625175, "uuid": "330826df-1c96-479a-b05d-17752a59a693", "value": "2783021163BAC998F4CDAE2D4CE30D8F7F42A9742D1AD9F662290199E327C560F3053B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625175, "uuid": "5f198999-9c25-42b0-9941-167a0c38b872", "value": "1536:uDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2gKk:uDAysJADlV378P3RPVJLdCqXjoKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625175, "uuid": "46542837-2f7d-48ea-b3c9-fccf66df8cd5", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625175, "uuid": "e9fa52c4-9df4-4edd-b177-c31237c23810", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625175, "uuid": "c19a9b7b-f30c-4760-bd64-9295a7a561d4", "value": "statistic-1285476142.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7ad8f3-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623620, "uuid": "2241ae9f-3070-4fb4-9581-e82b1c2dd180", "comment": "Malware payload", "value": "448ab4bf37d403a2e33ae8d6a8a56b5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623620, "uuid": "ea3df006-0aaf-487d-8eb5-e9900d3c090e", "comment": "Malware payload", "value": "0bdb80515bf3229e12124fc14395053432c5b968dc9c395490fea926dc91d5f3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623620, "uuid": "3ecd8f81-c10d-47c1-9dee-0b342fd22734", "comment": "Malware payload", "value": "f2b72f45d1ba29631d25eec53807f23ca025f534", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623620, "uuid": "47092b09-1717-4bac-8ec5-eb40450d5c04", "comment": "Malware payload", "value": "7c59efcea7d4a99f77bf914b89fd72e92ffb96305007b27081b47d6489090c035e815b3598f1e37a18b3bc0893c95f5d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623620, "uuid": "13e65973-cbec-4fc7-9e89-2a065ab0da23", "value": "AC83028C653DD2DF767D2D08A2D8883F780DECB4614434DEE4C81A6B5D8EEE758A7460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623620, "uuid": "42726df3-5810-4d72-b176-1695f1965b18", "value": "1536:BG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aS6:BGEhrHJoEsBMG7qzk6h12xGw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623620, "uuid": "06e3ea94-3fa0-4a59-b28f-d5e45045ded5", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623620, "uuid": "0a0c60b8-3277-40cc-abb6-114783c884d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623620, "uuid": "0ccf5fd7-5f34-442a-bba3-70ce991dfabe", "value": "diagram-291010550.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df28ac87-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621342, "uuid": "a9eebef2-8c37-4222-8f94-e1a9cf08218b", "comment": "Malware payload", "value": "1c5c61541a0fa61cb963113ad246f728", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621342, "uuid": "8457dd52-c0f0-49a1-ae9b-75cb040ec07e", "comment": "Malware payload", "value": "0be3d103c5e9e820d74e24b203d26dbb387d52ded42d4360a8d9fbbb5ab5ca33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621342, "uuid": "9e721bfa-67e7-4b05-bc0a-1d7bef2c629d", "comment": "Malware payload", "value": "02d94e7284940134181e8079c0aa499781225d4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621342, "uuid": "bfc7c093-5649-4c7b-a6d2-1cf2ae30542f", "comment": "Malware payload", "value": "46599e99875ef5472326f272680d06af444d17d67d04fce40d684a4078822c3b030f26467a31df8c6c920378903ead0f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621342, "uuid": "d0f33ec2-19bb-4e27-99c5-f0f03ec55f6a", "value": "0783027103AE8B5DB4CE5A3954E21E8F2F47F8B829095892542604E4E32BC569F38D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621342, "uuid": "6dfcd040-fd2c-4097-8561-5973a27307a1", "value": "1536:yzDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd1DsMrbsTmHvVRrX:8DAysJADlV378P3RPVJLd1DsMU0dRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621342, "uuid": "a0cd443e-8b1c-4819-82e3-06c7cd53401e", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621342, "uuid": "78088212-3e10-4e3c-94c2-3db5c33296a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621342, "uuid": "08e0603e-0b32-40d0-8a4c-c900f4719fdb", "value": "catalog-585031261.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a037ba1-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621977, "uuid": "225006b4-da53-4de9-b1b9-29a396e3b1bb", "comment": "Malware payload", "value": "88817e2de7a805b04d699c980a0afee3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621977, "uuid": "7ddfef30-cad1-4b07-a2e2-6e7f53e8ba34", "comment": "Malware payload", "value": "0be4effb5aced7c0c53f9997c075f97b35f308139e9ab7ac57b7875a690d0e7c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621977, "uuid": "e9655fb1-4ca2-4f15-a941-20f94b269a8a", "comment": "Malware payload", "value": "7e9327e629c7b50ccdfb97173ac89c8bcc44cb40", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621977, "uuid": "c679d4e6-aed4-4395-805b-16a44f336bf7", "comment": "Malware payload", "value": "a040fc8ab17775dd2a670e461420c13cbee7286b0cd6566e357aba553240b0d405ecd98269bb89b90f166ecf530b41a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621977, "uuid": "ad238579-bf4e-42a7-96f5-31d091cc9dee", "value": "CD83028C203E91DFB27D2E0572EC887B790EB9B13004689DD4D8766BD889EF75CA7421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621977, "uuid": "7edc644e-b411-4772-8f49-c9d4768845c7", "value": "1536:yG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttrI5kGHrOG0EzJDo:yGEhrHJoEsBMG7qzk9I5vUwJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621977, "uuid": "e8d53a0a-f00f-4e21-9338-9bf9f7e1c485", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621977, "uuid": "c5652291-f45e-4d63-a27a-936cc1601840", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621977, "uuid": "a8e9fb12-b8d8-4f2d-9763-4a56ca795462", "value": "diagram-1051220720.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3f5dd9-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622489, "uuid": "60383d7c-f882-4470-97d7-c0eebca6893e", "comment": "Malware payload", "value": "a872e383408f21fee73a581ca55f4fa1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622489, "uuid": "593decb5-04c2-4c1b-97dd-123c55eb5e64", "comment": "Malware payload", "value": "0bfa12dbde91db85a406ad419c763988c8a26d4c4a4588722ddfcd1cee58d03f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622489, "uuid": "a54175ac-17aa-434d-a07d-a8330e478d64", "comment": "Malware payload", "value": "8ce5a7c9302b72ca456217845bbda2799d80e1b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622489, "uuid": "cac4dfd4-d841-44e8-aeca-cb482bbe0aea", "comment": "Malware payload", "value": "7a547b984a28c8296e81a7a2366324d44bca85837932cee4c9a1a7c71442b45ec4d8f9b0510d9eb9b595e4cd852c5070", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622489, "uuid": "c37ea6b9-2978-49c6-9185-074357fb863c", "value": "F083028C3138C1DF37BE6A04A2DC887BBD09D9B53514395EC489655FAD8AEAB0C9B160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622489, "uuid": "25c6e0e4-d39d-41d7-ae87-fc5c5e4cbf9e", "value": "1536:GG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+pk:GGEhrHJoEsBMG7qzkZQxOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622489, "uuid": "bf32d034-7436-48d0-a752-5083d9939464", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622489, "uuid": "f33e3d83-3f74-4f0b-b90b-ad70aba17a36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622489, "uuid": "a4271fff-bdb0-4cf0-8d22-e806877ef947", "value": "diagram-1406768749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f26a67-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621945, "uuid": "43c70da7-e206-4d9e-b199-e0d11adc18fe", "comment": "Malware payload", "value": "d9d049772c08e70f0d9cb1e2d3a382fb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621945, "uuid": "cc461309-e0af-4536-b76b-164484167017", "comment": "Malware payload", "value": "0bfb1b8ca4e32a55222ea4c28a8d87a018a6bbbc3f24c141550a23fcc652fee9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621945, "uuid": "87c09cbf-6ffb-40e4-976a-36c96e20c19f", "comment": "Malware payload", "value": "307ada8610c49f34aaf6ad60caba50e7a16f1358", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621945, "uuid": "50ea1d17-7e7a-4a28-8752-bf28f894cc0a", "comment": "Malware payload", "value": "c93415c9e89794c0769680b4020ad060babbd712971f41ecd8c2c85b5ebbffd03ecd9c051b6634318a7843a91fcdcf64", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621945, "uuid": "a0a60abc-127d-424a-8b77-99e3e4b0f5a3", "value": "D98302CC6239C9DF717D3E4AA6D8C83A790E98BD3040349DE5C0669F5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621945, "uuid": "0658c77e-fe96-49e8-a695-460fe4696b2c", "value": "1536:FG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGrW:FGEhrHJoEsBMG7qzkEEVerrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621945, "uuid": "dd07a7ef-d23c-42c2-8b2e-de908d2b30d7", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621945, "uuid": "b331cc18-afba-43b3-bdbe-c74fac95babb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621945, "uuid": "8e936cd1-3691-4111-bd87-1d946d661e0f", "value": "diagram-1026935397.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01c052f-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640671, "uuid": "2a414a8b-ce05-4d3e-a312-d28c6424cf3d", "comment": "Malware payload (Quakbot)", "value": "0e1ebca67132837799d391fd71367039", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640671, "uuid": "a047d9dc-b7c6-46d2-b782-6696fe87c220", "comment": "Malware payload (Quakbot)", "value": "0c0d56a6d6491d5b906eb71240911db9e5630b79d5eca3ddecce5aab8ac9e0ee", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640671, "uuid": "f2142778-b906-4cdc-9af4-a366ad55918a", "comment": "Malware payload (Quakbot)", "value": "7c7b02d8ae57e806e75bf375d2ddc28038fac6f7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640671, "uuid": "005d02b2-ae85-4839-b2c2-b2ef5d1fa818", "comment": "Malware payload (Quakbot)", "value": "82ace6a34b45f59550d874312c6734eb3f27f52cfa169acc51e636092b24bcb3c4e142f3fa82c1764fd467ee621cb7ae", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640671, "uuid": "86edc8cb-ab70-4af2-9159-f935cca206ed", "value": "DF948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640671, "uuid": "6a0be9b5-0439-4201-8533-d0a220b2f8ba", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640671, "uuid": "5db85149-fdd7-4ffd-896e-4724602d18a5", "value": "6144:nVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraI:wFNmLKSVpJbPT+4xrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640671, "uuid": "a1164bf1-5897-4397-b360-3855db0b228f", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640671, "uuid": "803b14d6-74cd-4ffb-b600-ba27132dd047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640671, "uuid": "9f6ef2a9-d2f6-4a18-bf9e-1c4389d4ed29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc5789d-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627168, "uuid": "c9d9fdd9-dc26-4548-9a51-c4627598d999", "comment": "Malware payload", "value": "2f1dcfe4221e586054f3183a56e23023", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627168, "uuid": "e4e5fc7c-8901-4852-be0d-8894b127c7d3", "comment": "Malware payload", "value": "0c1c341c9979130b10284634f1c5a64c8c02c1808c11f55aa5ac30fe182b778d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627168, "uuid": "b2616301-67cf-45b8-b974-a493d5d2d299", "comment": "Malware payload", "value": "3e63de1fde346139310739120b2c7d4bcfd8cbd3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627168, "uuid": "208fe21c-2db9-421b-8a92-320494566707", "comment": "Malware payload", "value": "cc600633d25566de3aa03cd27debf9a93493c37e057b46317219c46eb2b4a515b4c878b41d01fe19a67fa1b9ac20b411", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627168, "uuid": "6564dd23-3f28-4026-b50f-bf0b58cb2868", "value": "0B83020403FB9959F48E9E38ACE20D8F3F86F6B53D0A58E1976D0455B73A8910B2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627168, "uuid": "e4749d01-15ff-4396-93a4-bbf954282820", "value": "1536:cDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBSt:cDAysJADlV378P3RPVJLd/eh8wBSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627168, "uuid": "ff6d576c-c6b4-4e57-b330-6eb0fbb51e1a", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627168, "uuid": "9096c908-72b5-40b6-adf9-562ea646aaff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627168, "uuid": "1a0370f2-bb98-4a3e-91c2-a573cc577e70", "value": "statistic-753329255.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4758a6a-a86b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646583, "uuid": "8011b3e5-6426-4dbb-a6f6-ad1c1cde27b2", "comment": "Malware payload (Dridex)", "value": "ebfcbe6da5df451d19ce334b109083c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646583, "uuid": "3604368b-f21d-4fa4-874d-7d1a86ec1081", "comment": "Malware payload (Dridex)", "value": "0c205d489869a118648130748ff0122f537bd8739c0127c405a670ff35b7ddb2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646583, "uuid": "733179d9-2348-49fb-a9d0-8d053848eda9", "comment": "Malware payload (Dridex)", "value": "06ca6bada80cfe65cb082f895d1afb70dc64fcf6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646583, "uuid": "fe7f8089-a8eb-45c9-84dd-a15bed104063", "comment": "Malware payload (Dridex)", "value": "493f1b63fa725240e42ca95441fc73128539c3d99382d07055f383e3d9b074688cac838f582bd9171dcbe3598dd1fc2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646583, "uuid": "528428c7-e5bc-4969-a812-bd060ace70bd", "value": "C0F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646583, "uuid": "10dac265-7151-4798-a0a4-2f4638981d18", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646583, "uuid": "6f401b3f-64a5-4b49-8893-5e5b117d604d", "value": "3072:fnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:Sy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646583, "uuid": "170dfcb9-242c-40f7-91fe-7973722e9794", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646583, "uuid": "0c472762-6811-4e85-bf7b-b3bd8b708604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646583, "uuid": "ad81ce6d-0dd1-4622-8e20-64d69e74d0c9", "value": "ebfcbe6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dd8d21-a819-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619611255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611255, "uuid": "ca2c996f-7004-4ef2-8568-05c4e4079cbc", "comment": "Malware payload", "value": "1f4dc395fd3356d3acfacc312d927dad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611255, "uuid": "64e1a139-408e-4664-b798-591a62032bcf", "comment": "Malware payload", "value": "0c228b72e4b9d34409d89f1b2e144291f59cbbb24a107f0878b5bc57a1cf45c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611255, "uuid": "f1e95ea4-78cf-48ae-a799-91586a0d2ada", "comment": "Malware payload", "value": "c409311d77dbf9768cb2a343f6749394b360b844", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619611255, "uuid": "ed33814f-4184-41fe-a28b-f94c66ae24bd", "comment": "Malware payload", "value": "cd350d65cd7e245d7136705bfc0e34e53df458df4496ca2da7f6291a06d7c2a6300be86fc2b960f5b74ac2ef1e630772", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611255, "uuid": "eef01718-ef72-4061-8fb5-c62fb932f4a3", "value": "1445238DFD98577AFA6A3C781057CCC1948CBE702B4EA513E704BF4A8DB2275AB53250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611255, "uuid": "28623a8e-b334-4b6b-8a05-76a13f049345", "value": "24576:AJoT8qD7YPOkll3UEgeLt7vNhVnNkrS9eBse+nYT:Ai37YPOoBgeLt5N79eBse+YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619611255, "uuid": "1bd41e0a-1fa2-46e0-aeeb-d284f56efb96", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619611255, "uuid": "d0254eb0-f5df-40d4-a587-2e570308b3c3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619611255, "uuid": "9d21652e-cb34-46ed-b577-f6b25f414441", "value": "1f4dc395_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaeb3bb-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622658, "uuid": "f9fe8df3-a976-457a-b68c-94ab8508e5d8", "comment": "Malware payload", "value": "48b68c53a8e558c786d43c2e08618a9c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622658, "uuid": "e54e940b-200e-4ff9-a992-69887b5110dd", "comment": "Malware payload", "value": "0c41d469983efed836e3727d4a12b2303fee28c857264b7cb99c7e0c2ab327c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622658, "uuid": "2575f6f1-efc8-4629-8f50-6d3da1c1e4ba", "comment": "Malware payload", "value": "671349c146c07d433a47a74cd738ce322293bcf4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622658, "uuid": "838dcbfe-2f82-4dc1-84cc-308cae9d3b15", "comment": "Malware payload", "value": "2495b9955ade327669ed90ae97bd650e7c6aef9f6038c07782966d1475306c1335824a794e2340a33b6dba8626761578", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622658, "uuid": "1e078ab2-c078-4451-8116-31cf6a7b1e27", "value": "F283028C353DC5DF3ABE2E0951DC887E740EE8B43144154ED8C96A6B9E8BFEB1856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622658, "uuid": "36f8bf4b-07ce-4ef7-a220-4de590cc837e", "value": "1536:kG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttEKkApVr6wo+Rxtw4:kGEhrHJoEsBMG7qzkaxApxT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622658, "uuid": "abeaa88e-6e7a-499a-9f34-bf9ba9210da7", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622658, "uuid": "fd431bf7-e947-416e-8206-95c0c7756eeb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622658, "uuid": "6146c7d0-983b-4475-8bb2-6122caab3f66", "value": "diagram-1549475074.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a1adbe-a876-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619651382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651382, "uuid": "b30b2d16-a468-4e59-aade-ff793e2492a7", "comment": "Malware payload", "value": "41a7f4b78d4f7f358542c4ef2a2d9dbb", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651382, "uuid": "7c113514-c8fb-4385-8cc0-f5209432a8d7", "comment": "Malware payload", "value": "0c438622b62bf03a33e3e25d3ff1afea740111c2d90a2b9659eddd7a5021cd5d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651382, "uuid": "def7cd4d-b967-4162-a291-df706e3dc87d", "comment": "Malware payload", "value": "174256cf955ce751161dbf209eb3aa75e26a5176", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651382, "uuid": "e3d9935c-1e61-4741-bba6-0ea3182ec5db", "comment": "Malware payload", "value": "56a4686479783e20003ccb2194a9aee3b12327884b16adf4dc7b67cef21324a512e3c7fac547ac4bf6f7d8d3993816ca", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651382, "uuid": "b44cef5f-51f5-46a1-b876-63dc23a7931b", "value": "FF445C1A76950CB9EC778138CD935A06E7B278150770DAFF0360426ADF2F7E1A93AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651382, "uuid": "43c9ef9d-98a4-4015-a318-16a5a79e7c1c", "value": "5884ec2e5c21d7a7284394850698f94d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651382, "uuid": "9031c5c9-7e10-4afe-a9bc-e3c16f5b8928", "value": "6144:7KRZVTvXlQAFZ1vLZAGObJHYNMbnohPGwv:76ZB+S1jynKMbnoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619651382, "uuid": "970a8969-65f9-444d-a686-65786ee914c5", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619651382, "uuid": "433d5186-6afe-47c4-94ef-3e95636aabf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651382, "uuid": "ed9adc62-b17a-436d-b666-65dcf5ee24f0", "value": "0c438622b62bf03a33e3e25d3ff1afea740111c2d90a2b9659eddd7a5021cd5d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c8a53d-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625721, "uuid": "af5f17b3-3818-4a1b-bd1e-b7cd3a106a50", "comment": "Malware payload", "value": "da639572bb7c18ee1687d45d66329e28", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625721, "uuid": "53b5eb8a-7aac-4fa8-a8e4-9a668445efc7", "comment": "Malware payload", "value": "0c64bfb31dc170aec2d30327c46b77c1a21582a8c737e56955b982309193be6a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625721, "uuid": "be994604-5159-4855-a111-177304c66cc6", "comment": "Malware payload", "value": "064b3ebd735383d45624f383aba547b2e6397d2b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625721, "uuid": "eff0117d-a115-4e2a-a48f-f621e55c13bb", "comment": "Malware payload", "value": "650066163053916f89513d54f5988ae9e233a3323c7a48e937c852a2693b870d330e3e15bde130a9280c687b5f625ea1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625721, "uuid": "2fff92b3-13f5-48f9-b35c-3c75fd3a9c7d", "value": "5D83021523BAC998F5CDDE2D4CE30D8F3F42A9782C1ED5B5622D0199E326C964F2453B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625721, "uuid": "c8671237-8ce0-4792-9b46-d90786e1a289", "value": "1536:5DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdaPqXT/WkO0B19M2iu:5DAysJADlV378P3RPVJLdaqXj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625721, "uuid": "6604cf50-d067-416a-b3d0-72ed32da9be1", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625721, "uuid": "c16cdd8c-0def-4f87-bb89-2b6bc8f090e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625721, "uuid": "3b891148-2711-47bd-9f32-59cee15d2797", "value": "statistic-1696997683.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cc17e8-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627314, "uuid": "32dd488a-de95-412c-a23b-bea195870057", "comment": "Malware payload", "value": "d86ab4a53ef6e9009b3bcc3bda7d352e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627314, "uuid": "b8ae27bc-76b8-480e-8d0e-0c25ef3d5510", "comment": "Malware payload", "value": "0c809d4aada1a845f442206db64dc0d46dd57e2e46394d90a873d8877018a4e7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627314, "uuid": "dae178f1-ae2f-44ef-8f3a-4bdc158b4fca", "comment": "Malware payload", "value": "5029a3c4b98ee5a0ce2a895502c26a3984f63b50", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627314, "uuid": "49f8396a-4fa5-42a7-8d31-5ff0adadc043", "comment": "Malware payload", "value": "fb68bc33d9ba6b51153e04229c3bfa10a920b2e4d186ac8c3ecde56ed3b4f2b35e77468cc48fcf3982d5255128ae7df4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627314, "uuid": "3900a840-3cfe-47e9-949b-fc0ebd0aed4c", "value": "2F831220037A864D74CE9D3D9CA31DCF3F66BAB4352E5DE2656905D8B236C420F2897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627314, "uuid": "bee51730-06fa-486e-a8a0-b37b78a468f1", "value": "1536:eDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdVNp7Ctdn77/6k:eDAysJADlV378P3RPVJLdLp7mdnn/6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627314, "uuid": "94ce0d2e-da57-4e0f-bb68-5f98c68f5eae", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627314, "uuid": "2a4aae88-9091-42a2-be4f-3b2a2bf62f8b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627314, "uuid": "badd4bfb-26f8-44a8-8b9e-17b2e9c5c841", "value": "statistic-853526923.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec110a7d-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623081, "uuid": "04bc86df-1611-4a7c-804b-be57c16c6189", "comment": "Malware payload", "value": "1e7200446beb7ee8e94f4be7f391b905", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623081, "uuid": "67c8e340-3d85-4dc0-9400-4086b1616009", "comment": "Malware payload", "value": "0c85d9b014ddf182cce1ac260bc27baec4e38a6eca89a8e77b55a4b24df4b6f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623081, "uuid": "fda9ff8c-8e55-4c44-8df0-21281c39bb1d", "comment": "Malware payload", "value": "c373861c949d5acea9a677978f685f9bec131448", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623081, "uuid": "d0b8c8ab-4f12-4cbc-8866-def5d7f18e24", "comment": "Malware payload", "value": "190486ed0e8772e91cf32839ff5b087c731b8f5381454c562b83854d1b449ca45269768498ec4cebb24937952721c5a9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623081, "uuid": "22e17469-fb88-459c-ac30-6f8f445f3b97", "value": "5F8302CC213DC5DF3AFE2E0951DC887E740ED8B43144144ED8C86A6F9E8BEEB1856560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623081, "uuid": "f403d27b-2add-47b6-a7ca-45c6ae36a151", "value": "1536:7G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt0KkApVr6wo+Rx2:7GEhrHJoEsBMG7qzkqxApxT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623081, "uuid": "d3542c89-74ec-4be3-995a-87aebe6f3bf2", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623081, "uuid": "7d863e70-821b-41ca-a4d3-4b81213dc984", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623081, "uuid": "e74e9221-c283-4548-97b0-086dac3b3a3e", "value": "diagram-1840020037.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bbd5ad-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640673, "uuid": "0dcef1cb-4876-454d-8fc4-1a1ce5202833", "comment": "Malware payload (Quakbot)", "value": "c9ba61ac36da0b0f3e9b97260df5da10", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640673, "uuid": "5376be94-0b61-43e8-8279-0a2de5c021cd", "comment": "Malware payload (Quakbot)", "value": "0c9a2cad9a466b9fe45d73fc85c1c7aa860720971b5cf3faaa5f0053fe7e8754", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640673, "uuid": "d51ffb89-689d-4987-b840-620c161f6411", "comment": "Malware payload (Quakbot)", "value": "0a575f6fd53008253959a645b6de811da1ea36dc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640673, "uuid": "600abcf4-0b1c-44fc-b8d5-cc9c5f9a2014", "comment": "Malware payload (Quakbot)", "value": "dc85d02955c92f9b3b1b10e0b504c596266a24a0ee57187f384ff0734206bd0eb277747b75e9904a3ecbd532ec1de808", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640673, "uuid": "f2c24f74-83f8-4b4a-8902-24c698bce50a", "value": "08948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640673, "uuid": "a2ae3664-dbd3-4a50-8c3a-e99acbdf260a", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640673, "uuid": "f36d930b-0112-49d6-9dd5-8d5127406bed", "value": "6144:RVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraD:eFNmLKSVpJbPT+4xru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640673, "uuid": "f0ffbc5a-6d1f-401c-b501-406b57a18e41", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640673, "uuid": "126e22e0-4571-4d3e-be1f-d31cd8f92d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640673, "uuid": "694a08c9-b73d-4753-84af-d75a2d4e4bc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8847a3ba-a867-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619644818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644818, "uuid": "72c8d5fa-4055-4075-a293-0ded958bd191", "comment": "Malware payload (Dridex)", "value": "e5cda1715cfbd6421910bf4d44deecaf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644818, "uuid": "30b1215c-e1e1-4432-ae2f-4a944f85a103", "comment": "Malware payload (Dridex)", "value": "0c9e5ed10d639346f49d9a0423c6f923bc69404af337cc81ca19dd4c160784ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644818, "uuid": "d8e94d3d-c801-47c5-ba4f-2366eb5a9182", "comment": "Malware payload (Dridex)", "value": "fe6322522f95efb92e26b36b996f386ea4a79129", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644818, "uuid": "a1cf11f1-1759-42f3-a96d-d0536627b5e5", "comment": "Malware payload (Dridex)", "value": "343ca902d68db05bb12b7627f7687c7a64308ef9ff3a93b98a4b8b50104d48329bc8b5dddcbde662693c6afcd624ff00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644818, "uuid": "e870e74e-5935-486a-9e9a-c16a6355ec16", "value": "00F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A88DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644818, "uuid": "a354dfdc-19aa-4e7b-b9fd-c21b38485905", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644818, "uuid": "c6fb04f1-82f8-4aab-b603-6d1d551b8433", "value": "3072:A8Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2FGkFY:XnS62Fl+pkeJl3CvRStrFl+EYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619644818, "uuid": "b98e3d92-2041-4824-9701-6a334711a3e2", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619644818, "uuid": "0d75ab09-6f4b-499d-b17c-84fa98788395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644818, "uuid": "1a9d416a-5a53-44d2-ad2a-a226cf0ef7fa", "value": "e5cda171_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bfe9f4-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622995, "uuid": "0e1970bf-14f6-4aef-b234-bd2fc261e2bc", "comment": "Malware payload", "value": "dad221b3a96c648f8b8be3e939a8339d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622995, "uuid": "768a82e9-239b-430b-b12b-ef99ca815884", "comment": "Malware payload", "value": "0cb65e32c544273fd661e5b6e890ada03ef2063202e555a44f996bb14a10c4ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622995, "uuid": "c5bbac5b-9b51-467f-92f0-1f780cd7e300", "comment": "Malware payload", "value": "57888ecb912a846750a0734ddd5e3d45b8160c57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622995, "uuid": "6b4e7d12-c704-44cd-b6be-e4282070b017", "comment": "Malware payload", "value": "aa345d5ebbb9d74f251a0c237da6faa71f17790ff951d34b970a5cbfd3a0d625d3ad5cd36cd10ebce7063b114c2798e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622995, "uuid": "b1332dd8-1c0f-4c44-b756-bbe42d5b18e5", "value": "AC8302CC313DC9DF7ABA6E0951DC887E780EE8B43104154EE8C856AB9E8BFE71857560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622995, "uuid": "4b17e1bc-793b-46e0-bdb6-8de5f4370293", "value": "1536:VG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttgKkApVr6wo+Rxw:VGEhrHJoEsBMG7qzk6xApxTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622995, "uuid": "02261647-0c8a-444e-be2c-0684b336d276", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622995, "uuid": "15c18e98-9571-4b44-bb96-a8c92fe68969", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622995, "uuid": "e706564c-80a0-4be1-a319-9cece5e257ac", "value": "diagram-1778255875.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20891af3-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624887, "uuid": "36919994-0566-4e70-9af9-f49f620b03e7", "comment": "Malware payload", "value": "8a3c9a8149ea0d4b6170849e405d0da2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624887, "uuid": "b729ddaa-c8ce-42c8-8fe4-1f674b838811", "comment": "Malware payload", "value": "0cb9e05696ba7c3139d1e77e3cbf6b2f8451bb9081daad67c0eed2cdcab05a90", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624887, "uuid": "e38c4e92-e57a-4dfa-a6a2-d9691e60b6ca", "comment": "Malware payload", "value": "1eb953a8dbef14bfa1dd88e25509258d7064e3cb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624887, "uuid": "0b46f218-ab04-4f10-aa67-3b16eeae089e", "comment": "Malware payload", "value": "c88c431f98ce8e8293dc3e5fa2e1001de7f32c37025c197938863301d4dfd62f7ee57db30be59242d999a8e2c34b067c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624887, "uuid": "81eb73d7-2cf7-44e7-a243-f89f1d8c42e6", "value": "C383028403EA4F6EB9CEC97948E20E8F2F46B5B4191B6CB1B16D0494F2324951F28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624887, "uuid": "8748cd38-9fa4-457d-8194-9298cb629a09", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdySgxkDUoz:DDAysJADlV378P3RPVJLdySUoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624887, "uuid": "63dd7c5f-eb52-4376-a622-1b5bbb57efd5", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624887, "uuid": "6cc0a097-b21a-4c9d-9849-4a922859f351", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624887, "uuid": "ce858d3c-15ca-4a95-bd63-c0b27b13c9e2", "value": "statistic-1075264251.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a928f6e7-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624257, "uuid": "e0d4e3f8-4298-41ad-a0e3-97b2b252c15f", "comment": "Malware payload", "value": "462cc3bcf9ffc4e2945baf87a90231cd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624257, "uuid": "ed64cfd0-4b74-4291-929f-08575b6fb6fc", "comment": "Malware payload", "value": "0cbd2c6c14642e79cd99c650c42dc0b7b6573aa68b135600db9386960e2496f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624257, "uuid": "28b1a622-a46f-4cbc-ada1-c919c288f35a", "comment": "Malware payload", "value": "c4b45cd82627d99a60629de157042f3520217b09", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624257, "uuid": "7b7360cf-ba7d-49cb-87a4-893701294f7d", "comment": "Malware payload", "value": "67d3af3d67949cf4800154af4d9953ec1a0239210816fe88f86556362a659ff99772ef9b1af9491f2b2ab169b136b8ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624257, "uuid": "7a7dd031-b8e7-411b-90b3-c5cb34c84157", "value": "8983028C6239C9DF717D3E5A96D8C43A7D0E98B93040349DE5C066AF5E899E70C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624257, "uuid": "92b595ce-5e0f-43da-b9bd-3e7fd45274d5", "value": "1536:VG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGre:VGEhrHJoEsBMG7qzkEEVerre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624257, "uuid": "6b1213e4-d80e-4458-9c0d-8078f0de6646", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624257, "uuid": "5e4f2975-7d64-4eda-943d-c82d4e476391", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624257, "uuid": "93ebc2ee-03f2-44f7-8a44-74b13e522fb9", "value": "diagram-641460420.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3731a678-a7bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619571668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571668, "uuid": "0b430f9b-1a38-4f9f-ad21-f261d6599175", "comment": "Malware payload (Dridex)", "value": "5e5f16af323c19cfb79a642a36ba0566", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571668, "uuid": "af65cd63-d956-491e-aef8-e931615e95ab", "comment": "Malware payload (Dridex)", "value": "0cc65b354445cb1ac140804e09071342729faebbe518b99070a764653d4a3480", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571668, "uuid": "4193c018-6bc1-4fe7-af55-b4b517baa4a9", "comment": "Malware payload (Dridex)", "value": "1e83f296a7fdff8142cbe1497a64829fde2f39eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571668, "uuid": "631d2ad1-c27d-427c-bb92-154266dcb90e", "comment": "Malware payload (Dridex)", "value": "c64786395b109cd5789b5650999d14e1c5fb4e30769628c7fc9a3e752a9141c37ba10de31d972b629dc4182291bb3d6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571668, "uuid": "340c7110-e8c9-4750-91c4-c7070046270b", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571668, "uuid": "b02af211-ca12-4013-ba69-851c0d362909", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571668, "uuid": "482b4048-f797-4c0d-977e-d43ccf4684a8", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619571668, "uuid": "da46fbed-53c4-497c-96da-5af59949341e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619571668, "uuid": "b19da9ae-74ef-432a-b111-b83cb20a7cde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571668, "uuid": "aa663a26-8a32-4673-9a73-9b2d211a257e", "value": "5e5f16af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af303d8-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625307, "uuid": "404c04f3-7b71-4b8c-851c-dee60d866e21", "comment": "Malware payload", "value": "e615bc38274a0c45fa10d0efcddde8d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625307, "uuid": "cd661f39-c33f-4294-9e5c-b71282f9032c", "comment": "Malware payload", "value": "0ccca37fd4034d09283a5417e6ed1e3790ea91d4d46be78f83992a9f7b6055f1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625307, "uuid": "bd6c4186-3634-4aed-a9df-50b5abdeebf3", "comment": "Malware payload", "value": "ee246fb6508f8c14315785015789f4adf42a5930", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625307, "uuid": "72408d78-25a7-40ae-99a5-da5610a009ed", "comment": "Malware payload", "value": "4da5b0055f497108c6e78e5a3350547898f2b76547f97ae7faf9fcab2082f1a9db0f737695839838ce7078577c8a19dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625307, "uuid": "7db5ac96-97f9-4728-b142-7eac4f7aa81a", "value": "6183021563BAC998F48DAE2D4CE30D8F3F42A9792C1ED5F522290199E327C960F2053B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625307, "uuid": "4c2f5da0-6193-46ac-8506-3d0914aa0791", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdLPqXT/WkO0B19M2pg:DDAysJADlV378P3RPVJLdTqXjhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625307, "uuid": "70d831c9-0687-4cb4-b43a-ceac8b821516", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625307, "uuid": "7f026668-652a-4ad3-8cc8-9e57624bea3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625307, "uuid": "092eb50c-4572-4645-b077-4ab09100b354", "value": "statistic-1381036898.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d7befd-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627131, "uuid": "5d87974a-3c26-4871-8975-e2d4320365bb", "comment": "Malware payload", "value": "bde6a30c6f8d85d6bdeeca6b0055e4d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627131, "uuid": "53d68450-9640-44eb-8745-87ff678d5406", "comment": "Malware payload", "value": "0cf446462ac7cbca8e5b318e4b5d43f3c88d47b26274647976e9005fba1fae30", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627131, "uuid": "489a3935-c20c-4943-98f9-4d790cf2ad75", "comment": "Malware payload", "value": "c35428bcdbd00364ce5cda953476db23cbbfc4a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627131, "uuid": "89723bee-6445-40f5-bff0-9533ab4328e0", "comment": "Malware payload", "value": "398abc014e01cbb8bd63c48afd23abb9875259670530acd289add93744dab35aded80c849e89b192b8dc0293ab2a0c5b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627131, "uuid": "44862f68-c5c8-445d-9209-010359be2c3c", "value": "F083021463B98958F4CE9E2D5CA20D8F7F56B5742C1ED9B2763E0186F2268520F3493E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627131, "uuid": "a87f3920-d150-495f-a0aa-d99aa6c24ed0", "value": "1536:jDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdehET/WkOsB19M2w:jDAysJADlV378P3RPVJLdwELo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627131, "uuid": "deb0e2ce-b6a5-4de2-abcc-caecd4fb8857", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627131, "uuid": "051c78fd-6c23-4315-b53d-f1e37b854711", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627131, "uuid": "32100574-911f-4f96-b248-b15c61a571db", "value": "statistic-733395499.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d4bb1b-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623183, "uuid": "6a010684-f3f5-46f3-9884-cb4b837ea3c9", "comment": "Malware payload", "value": "f0dc9e51b4f57fca8d16a8a882ef27ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623183, "uuid": "51cd6d0c-2777-4999-9715-a10f53ccd4a0", "comment": "Malware payload", "value": "0d0782c4f007c5deb632aee482c8597fb2e9a161fbe05ba18e6df4d185792e6e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623183, "uuid": "bcc0cd19-9b5c-4393-8bdb-8d4024536eaa", "comment": "Malware payload", "value": "99fc3bdaa1ccab6558614ffa2ee1c28f991b8011", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623183, "uuid": "fb670663-2a0f-4fc7-b6c0-a831324aefbe", "comment": "Malware payload", "value": "60032031dd94d8f40668e938f7117f8564a63bff7ce892945064b09ae52e5c0c05f725aadcce7c31f017c0fae3556594", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623183, "uuid": "9157ea89-61a2-4881-aa84-cd761f8a68ba", "value": "238302C9203DC6DF71BCAA19B55C893EB94D6C742100649ED8D4266EAC8DEF79C97430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623183, "uuid": "8db08925-dadd-462b-afdd-0ab243876f32", "value": "1536:5G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttFI5EzJKE9LfFSp7mAE:5GEhrHJoEsBMG7qzknI5AB5gpSAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623183, "uuid": "39408dd6-e52d-4594-b618-7e7611e5f90e", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623183, "uuid": "572265af-eb3f-4fef-a127-223ff3716e3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623183, "uuid": "e1d503ca-c2b0-451a-9448-0d7abcfaedf6", "value": "diagram-1922863120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6c4119-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626303, "uuid": "c9d88f4b-047a-4b0d-baa0-6f5edad716e9", "comment": "Malware payload", "value": "681935e1500d7ba08c51240587e0397b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626303, "uuid": "027c6465-bca9-4fc5-9bad-22a0474028aa", "comment": "Malware payload", "value": "0d176a16f5eefbd53d999230d35f5239a1cb8853cbd460b9439977517c65a8cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626303, "uuid": "37fa68f5-c503-49b4-9207-b86bb84409fe", "comment": "Malware payload", "value": "124d77ec2ad2286c348e185007ab47cecb0c567d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626303, "uuid": "dcb9db3a-273e-4c30-82ac-44f910c360e6", "comment": "Malware payload", "value": "b2573386aaf3e81d445046d93934d258de55a6f1134f6bdde6dd226f0658e8732231a8ac8379afefcba46f4494e0da77", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626303, "uuid": "82a45176-fc3a-42a2-856b-afe058b3ddf1", "value": "8783025413BB8E6DB58DC93948E20DCF2F56B6B02D5B5CF2B12D0494F1238961A3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626303, "uuid": "576275e2-83d9-41ce-aa03-a03a0c9a117d", "value": "1536:6DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn76Q:6DAysJADlV378P3RPVJLdw76Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626303, "uuid": "a2caf1c0-0bc4-4290-996e-3c506a2c7840", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626303, "uuid": "27561000-70dd-4362-a2f8-83a1ceb1e458", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626303, "uuid": "ebe5ea83-88ee-4471-a88b-1b8b5a7b93b6", "value": "statistic-2122785199.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7522ccc-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626080, "uuid": "39eb06dc-ffa0-4462-8dee-297665fbeebd", "comment": "Malware payload", "value": "437ff91b88d5fa69cc074326f0388f52", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626080, "uuid": "bd9302cc-9d04-4dc0-aff8-a97d822320b1", "comment": "Malware payload", "value": "0d1d9b6a324e74fff08361114bc3e9d1f0c6d95e44ac5fc874ff8bac8d629bbf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626080, "uuid": "e85f1a7e-576b-468e-84ea-4fe74d5e8e0f", "comment": "Malware payload", "value": "95641569a38f0c62fc179afb91e59c66636dbe1c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626080, "uuid": "69db2bed-704a-4f6f-8c88-77f5530701fe", "comment": "Malware payload", "value": "8b2d10d0a9332eef9953022dc3bcac0e3324f4a96e10f925408594e02d97e06864fd9746c7e02209b73b0e73dd5f960a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626080, "uuid": "09357d6a-e78d-4139-9668-708ff6735f1e", "value": "78830250537ACB19B5CECE2D5CD3198B3E9BF9B42A0E5CF1A12D00B5B3668051F14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626080, "uuid": "ccae0837-6f2b-40a1-86cc-50c43490d3a3", "value": "1536:lDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdt/8oZePFOLVEr0xkvU1UeY:lDAysJADlV378P3RPVJLdt/8oZeUM0eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626080, "uuid": "96a4c38e-8407-44f1-847a-a0e5b7e1cc0c", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626080, "uuid": "c1dd7c12-c74d-4160-a1d9-05cbda0b3797", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626080, "uuid": "36faeb44-70d5-423a-9128-3bd2ce02c502", "value": "statistic-1945557062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3731d91-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640676, "uuid": "f4a3e032-cdd2-45fe-9be9-c59955245750", "comment": "Malware payload (Quakbot)", "value": "aa1cc967719742ba981b550a1e1957c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640676, "uuid": "3f0028b1-9975-454d-a709-14c742aed3e4", "comment": "Malware payload (Quakbot)", "value": "0d29fa1d6be181c81355b46ad01f01e723d811e2ff426a089ed22daaee5d4295", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640676, "uuid": "6957a3ec-0773-4e8c-98fd-b41cbe8b0e32", "comment": "Malware payload (Quakbot)", "value": "f02ee6faf7091f65748c5b4c1f7439a60328be29", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640676, "uuid": "12ad0d9d-e7ce-4fc5-9e95-ec174b5f3906", "comment": "Malware payload (Quakbot)", "value": "cc785a851edce58f05ce437ed00cc440f025eb6f6ad03b202e9f60a8dc5daf7543a9108ccdd950745516d93145c1c364", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640676, "uuid": "d94b1947-353b-46f3-92ca-9530a92d49b1", "value": "5F948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640676, "uuid": "cc1610ab-3592-454f-a49d-63462ffed1a6", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640676, "uuid": "8aad39b2-30ce-491d-9a94-f60d3b017d9d", "value": "6144:6VWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraV:TFNmLKSVpJbPT+4xrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640676, "uuid": "ebbcba26-524e-4e6c-85e0-af2766f3bcbb", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640676, "uuid": "c188fd57-5e55-42fe-a765-98b244cb78d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640676, "uuid": "fbc7ec21-fd55-4057-90a0-65e7bbb85bee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a0fff3-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620874, "uuid": "6e22d929-bcb9-434c-a792-465fbbc95a8f", "comment": "Malware payload", "value": "9cba86ff37d3702179e0422aed9e8bef", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620874, "uuid": "905031c5-d44e-4278-a125-27eb5906d185", "comment": "Malware payload", "value": "0d377a7596971567393203ea89bd98dc8a3b79164d327986a4333a0285579ad2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620874, "uuid": "7f461cf6-bb37-4be1-862f-bc948acbaf84", "comment": "Malware payload", "value": "2a6edb828ac10a70191b6fc628ca342e04f07f75", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620874, "uuid": "2c32901b-3227-4269-b8ff-fea2e46dc585", "comment": "Malware payload", "value": "78ecacfd08820e1ad6fc04b5755ba855123fa4e273cf3214cf11109b8b4d2c69fa706daa1718436ba68aac7b6ab213a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620874, "uuid": "410b1e91-1b9d-421c-9109-d702091525a7", "value": "0383121453B94A5EB8CE8E296CE31E4F2B9AB8F4192A55D1794D04E1F2374660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620874, "uuid": "b533075e-ed14-41be-9584-f59aa6cb7665", "value": "1536:MDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wf:MDAysJADlV378P3RPVJLdP8BXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620874, "uuid": "58df4458-596d-4165-ad77-47ea33b109f4", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620874, "uuid": "2869b405-9386-4d8c-bf92-4f72075940c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620874, "uuid": "a9c6cebf-c189-4fb7-a7de-0626c5a012fc", "value": "catalog-254612865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52784d8-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640679, "uuid": "c199b575-0022-40f7-b84c-f0f2daa4f013", "comment": "Malware payload (Quakbot)", "value": "3e70ba2ed166a0fa59d1b904a9bff726", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640679, "uuid": "14565f85-bc01-4c28-a17a-4ad996a58739", "comment": "Malware payload (Quakbot)", "value": "0d5b90c2f168e96e5716d600fcfaf74ea2da9a1d7cdf57313afd121a3767826f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640679, "uuid": "7c47b746-fd21-486a-ba00-4f053ae16794", "comment": "Malware payload (Quakbot)", "value": "be2f34a6c1bb8cae7d89feffd397d600906673d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640679, "uuid": "17a89e42-a485-4bfa-98c3-403310bb3049", "comment": "Malware payload (Quakbot)", "value": "b1edc971bc7a3395be431a8ae6121b012feec890982c86c9c0d84f7ceaf088b10a466b7d4da4092dd059e79504af5140", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640679, "uuid": "644a932a-b5fa-4f20-b350-7e2d78ec0390", "value": "E8949E7A6716D162D2BC23B143C3DF580E17D6E53234444612B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640679, "uuid": "bdca3e01-a3aa-4648-bf27-6beee0645f66", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640679, "uuid": "6d1c787b-2370-4401-8b58-f31adbe6b1ab", "value": "6144:uVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWrag:XFNmLKSVpJbPT+4xrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640679, "uuid": "fcb7537f-aa75-45de-8cb8-1a105d65a600", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640679, "uuid": "76fe8211-7883-450c-917b-5322fc4e158e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640679, "uuid": "fefe9311-4f80-4976-ae88-5a4a4b77d530", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a87517-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621811, "uuid": "54830e64-1678-4cef-a839-913367a34459", "comment": "Malware payload", "value": "7ac312318856a1330a4f6d6c38a880e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621811, "uuid": "bba4320c-e9bd-41ad-a30d-578ee22b56e9", "comment": "Malware payload", "value": "0d6a270816066f572217150e8038be0577494dc0e73a27084c22e97f0785110c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621811, "uuid": "f28d76ac-0602-481c-8eba-564ef404334c", "comment": "Malware payload", "value": "c6cf696e86ad22e113c52ae9fc3fdb4c9da27081", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621811, "uuid": "5b9e1cc5-f3cf-4663-add7-e6a6caf28d6e", "comment": "Malware payload", "value": "1de1005b9ee6b19528f61aed6f2a395e6bf6c0c13cc042fa9f055306684283033a275b03b74c0ad590165b2172fdc0fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621811, "uuid": "53c78461-05bb-4cae-9340-3736214e49fc", "value": "C883127103AE8B1DB4CE9A3954E21E8F2F47F8B42D194892541A04A4E327C629F38D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621811, "uuid": "0b5149d4-64e1-4c87-b56b-d7ca8201994e", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRal:0DAysJADlV378P3RPVJLdcDsMU0dRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621811, "uuid": "ccb78410-8300-4cd1-956e-881f6f12b781", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621811, "uuid": "5508f339-988e-4baf-aee9-ed713ab2f6dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621811, "uuid": "5a9d029d-7b21-4d00-b50e-a264802ab45a", "value": "catalog-938419351.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420f6003-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620219, "uuid": "b440f7ac-db86-49e7-9611-f3fe09ba965f", "comment": "Malware payload", "value": "543547fd65f5ac0edec3e5328f70e934", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620219, "uuid": "571b124f-3017-4232-8c0a-5f99e8abae27", "comment": "Malware payload", "value": "0d8489e5bb1dbb2f573f2661e45057f76c973ca0a808bd1d0a58773f876b3610", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620219, "uuid": "fc8bac0f-1f15-4da3-aec3-63781f261d3e", "comment": "Malware payload", "value": "c9bc634348d05cf35ff17921a2079017364baff2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620219, "uuid": "86ac99e0-74c2-4782-94d3-2087dba45bd2", "comment": "Malware payload", "value": "e4952d9332a847ba1f58b5a4a0ec440d9edac627c4a2fed35dc52e7dd387e440356a065a248353af895c7e50199e5486", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620219, "uuid": "fecc5d83-46f2-40bc-805e-3e7e3801bb53", "value": "B783021413B94A5EB8CE8E296CE31E4F2BDAB8F4192A54D1794D04E1F2374664F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620219, "uuid": "3b7a70f9-6866-4eaa-a833-8fa6c8a70b3a", "value": "1536:pDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0w6:pDAysJADlV378P3RPVJLdP8BXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620219, "uuid": "097df4a5-8bf0-438e-9345-78a9eeedc218", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620219, "uuid": "b5bf8749-e1cd-4367-8dad-9387fd649d9e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620219, "uuid": "b87caa25-2a26-453f-92ae-5dfb637cd0a2", "value": "catalog-1845811990.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb5e834-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626760, "uuid": "91abe642-3e18-40a3-8323-8f07763ebf58", "comment": "Malware payload", "value": "beb771c6a80c33dbe00598772be6bc03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626760, "uuid": "771194f7-499e-4d85-bf9e-7820173a936e", "comment": "Malware payload", "value": "0d89808c19dae625730dd413f60f416d3ee7b28ad322400bbc1832d6370ca956", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626760, "uuid": "891b0e49-90b0-4437-934e-0ee6c5456848", "comment": "Malware payload", "value": "84e6a8fc38aee35e8a304f6bef66f63f5cb62756", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626760, "uuid": "a235f020-7d9f-476f-8cbd-8a43606fe72a", "comment": "Malware payload", "value": "a4dab8d2ead64f5a807a295ae0f89e977968243d26ccba5148594e5c79945b035ba65879dea9f63f793a99e10c1fcc5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626760, "uuid": "5d350aa6-a07f-4d7f-90e4-bf7d756e7c90", "value": "7683021563BAC998F48D9E2D4CE30D8F7F42A9742C1ED5F66229019AE327C964F2053F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626760, "uuid": "8fcfbaad-3b88-4c13-81f1-305f055386ef", "value": "1536:vDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdLPqXT/WkO0B19M2nT:vDAysJADlV378P3RPVJLdTqXjfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626760, "uuid": "0ad4c8c9-10a3-4a22-8feb-8b4b47ca9e72", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626760, "uuid": "5899447f-557b-4471-b7b3-6e1453735d6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626760, "uuid": "8a8ee48f-b843-45fa-b205-039a4cf66b0b", "value": "statistic-490671885.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97168ded-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625945, "uuid": "05d7d532-24b5-4fbe-ba0a-cacdc9e9bad3", "comment": "Malware payload", "value": "7eabeff3f57447237fdc8d2ee53a5788", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625945, "uuid": "e1990e7a-e559-4152-9eca-625a1b6a94c2", "comment": "Malware payload", "value": "0da0345fcf718bfc693dfc4c9010c7ab9343ee2332d1e53226a42df0e21fd876", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625945, "uuid": "53f19bbc-9b27-457c-a81e-df2b8072bd23", "comment": "Malware payload", "value": "4c9b9a369498f1ab3202fbe250925c0192482be9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625945, "uuid": "812f1b93-42d1-49b0-a02c-fffc6d0e875f", "comment": "Malware payload", "value": "a866a4bf0177bbd2d27d8fa31619a00142786f4131758239a972e5e0e77f686e86c00a7156078fd3d741ea1b58ae2d6a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625945, "uuid": "a0eaa72a-f8d6-4ef0-be5e-9cb32458c673", "value": "0183026923FA495978CE9A2E8CE11D8F3F4BF9F42D1958E0527E0061E627C511F1893F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625945, "uuid": "58189117-a90f-4858-8dca-56a668e93ddf", "value": "1536:KDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdUb00T6B8tKY:KDAysJADlV378P3RPVJLdUIlB8sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625945, "uuid": "69a902d5-a524-49d7-9ebf-17e5c7eb5f8c", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625945, "uuid": "57d8b2c9-3912-4567-b70c-f81dd766ef19", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625945, "uuid": "8984cae7-6740-47df-8074-0d497ee7b854", "value": "statistic-1859661591.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083354fc-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624417, "uuid": "be245ed7-e833-4745-b5e8-6c373c91ea6c", "comment": "Malware payload", "value": "791492f1e5af7ac181e193eb3eaa0f5e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624417, "uuid": "40166cdf-392c-43a5-8467-e31302f143ad", "comment": "Malware payload", "value": "0dacc823862efb08c74460452e243e2292026ed21af0fd53dc085fd8ad1eb4e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624417, "uuid": "76a4b1e8-c820-435a-b605-c265d592b3e3", "comment": "Malware payload", "value": "c85d3e0961167ebaa42d06e109ebfb7f97366aaf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624417, "uuid": "b4b44774-8af8-49f4-b4b9-879d74b22576", "comment": "Malware payload", "value": "1777353ce7688fdb5aadf602965137e3c2c569bdc54de35c6072e5c4fc3b959712d19f386271b3b2b742b678381663b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624417, "uuid": "ce7cb0dc-605f-4fe9-b77b-db9fad943839", "value": "348302CC653DE2DF767D6D08A2D8883E780DECB4214434CEE4C81A6B5D8EEE758A7460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624417, "uuid": "6bc470ec-5fff-4d9e-a645-fbfdc18cdf66", "value": "1536:WG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSS:WGEhrHJoEsBMG7qzk6h12xGwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624417, "uuid": "adccabb9-e7c3-4150-926c-b8ef0da118fc", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624417, "uuid": "3175f3d6-80a3-4133-b126-59f21f90de26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624417, "uuid": "3338ecc3-6abc-474b-ba35-878b9c103dcf", "value": "diagram-759729440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778900e2-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623315, "uuid": "65126d38-eec3-43d2-93d6-4d7408fbed92", "comment": "Malware payload", "value": "bbac75c15384bf98afd4bf916ceba3b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623315, "uuid": "a4b0642e-7e77-4f39-8a36-ae9cf207857a", "comment": "Malware payload", "value": "0df3fc9469d3ce7c4953e64f4ec65bbcdbe11f7ffbaf07de1b0be626d77ad509", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623315, "uuid": "8f751c8e-3881-4881-8e5b-1dae0d4c3d18", "comment": "Malware payload", "value": "a09479629a9fbcfe012fe451ef299c789ea6aca4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623315, "uuid": "0ead0e3a-2a22-410b-a1a6-1a8639342e92", "comment": "Malware payload", "value": "f8844ed5d43d8c64e6c753bdc146dd12279e75cf253041ac1bb27f1c3ddcc82b8c245e88f29e190bf58bb617583e30ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623315, "uuid": "1a98f902-0d8a-4ae9-9c72-51a455b95344", "value": "C58302CC6339C9DF767D3E5A62D8C43A6D0E98B93044249DE5C0A6AF1D899F70CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623315, "uuid": "a46148ee-0a05-423f-8bbc-9544c383ce46", "value": "1536:mG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZDEVejoGrFAp:mGEhrHJoEsBMG7qzkHEVerrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623315, "uuid": "fb9e553a-f252-4821-87b6-a0e5d9d78da9", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623315, "uuid": "fcf5b077-6717-42b1-80b0-dbbb83a9ee1e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623315, "uuid": "51ee4b82-1bf4-4b87-a55e-c47ff45e9569", "value": "diagram-2005212901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87da47d-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645302, "uuid": "3704af01-1820-4149-a1bd-c79098eb25e1", "comment": "Malware payload (Dridex)", "value": "a254f90a7bc24a04a015a270ffbeb676", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645302, "uuid": "5192d30a-b903-4472-8fa5-4860ce9f737d", "comment": "Malware payload (Dridex)", "value": "0e21ffbfd2fab83ae6fd7724668c8cd8256cb3f23a3f9e56db68faad716d7fe1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645302, "uuid": "a2cd15a0-e10b-4270-b4c6-aad70e3220eb", "comment": "Malware payload (Dridex)", "value": "9e61d049ef7422cbca034dd3ff1b8ff3e05a8745", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645302, "uuid": "7d48569c-3a69-4252-ad32-1cdd22489a0f", "comment": "Malware payload (Dridex)", "value": "a594fd2c6ba060029a515706b1abb4427248c1a255a90050296287c478d4e52ba3779b341cb6944bd91b17f0d32b21c1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645302, "uuid": "d44e9cb3-8808-4922-b477-a942a3420dbe", "value": "8BF3BFC6E7EFE0D6C02BB43385CDB036EF6069D88A3ACF35C104892E69D7D549A35469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645302, "uuid": "def2323d-8442-4770-813d-f8dd1d1b5b55", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645302, "uuid": "5ce8a5a5-9028-4d1f-b5f5-fd55c82ab0b2", "value": "3072:S58CMtKJlXoDRl4epTGmoAc7iTRilfn6wlYYbZwd:XnClXSRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645302, "uuid": "eb00813c-b4c7-4251-9089-47b1cf350ca9", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645302, "uuid": "316d540a-77ec-4bde-84e7-0946ab91bdac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645302, "uuid": "7334c7d2-a1e0-49d4-b898-5a8681b3a4bd", "value": "a254f90a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b503a6c-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625442, "uuid": "f6ec68fc-97a4-4279-a09f-dbd5852926d6", "comment": "Malware payload", "value": "fdfd1a5a0d008f9a7811d9c32dae5f0a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625442, "uuid": "8520c3ec-9523-4a3a-8133-77dd1bfbbf41", "comment": "Malware payload", "value": "0e3143eac524951c50d5754ef27afac9bc1cdca52f5fce64ac746a63e72eb57b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625442, "uuid": "fbe9b252-9024-4c3f-9741-5857df4c4227", "comment": "Malware payload", "value": "ca68aa7aea8d0f0c26a1f5b375c59b289784c4bc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625442, "uuid": "46c55b2a-a3ee-47d0-ab65-bba9c8917ffa", "comment": "Malware payload", "value": "4bd946127e0010984b16c514020de7da0176a0d040f19e376f7b711263833655d5c64c6518d726eb49fc5ef61d951ee4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625442, "uuid": "7b5f1af7-e458-426a-8a54-16f89133e728", "value": "BA83025053BACB19B5CE8E2D8CD319CB6E9BF9B41A0E5CF1A12900B5B3668051F14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625442, "uuid": "82ca2afc-559d-442b-8720-7fdf85f42939", "value": "1536:uDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdt/8oZePFOLVEr0xkvUFkF:uDAysJADlV378P3RPVJLdt/8oZeUM0e3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625442, "uuid": "af7dd3e5-782a-47f9-8c10-ab6cd4e2b4ca", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625442, "uuid": "f7f25abb-5a07-41f1-9315-b022107c5716", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625442, "uuid": "490cb8cc-02bc-4ce2-b5bc-b7ac35090f5e", "value": "statistic-1517350585.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7193843-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627287, "uuid": "29fde7bc-92a6-4bd8-8adc-3a238c2d3608", "comment": "Malware payload", "value": "4fdaa9ab7b503b5077157692622998d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627287, "uuid": "0e68a48a-eae0-4013-945f-574035475adb", "comment": "Malware payload", "value": "0e39cd89dffdcfaa95db4ea9ab14c452f66e97ae2f6c2753fe3e69e29a2890f1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627287, "uuid": "529fb9bb-5d4c-4c5c-982b-c2c5de184c87", "comment": "Malware payload", "value": "c766cc2666000071b2ec65913ebc19946e9137cb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627287, "uuid": "2a709289-cae4-42a8-a9f5-a94e61ab61db", "comment": "Malware payload", "value": "5b16d00fe13cf6e4f610538d84b7e8d93233ade69879628c77c5de9ce9dfbccdfb1b6c79acf51f7e6dc46e4d05598307", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627287, "uuid": "2eccfc32-276d-4e75-9a16-c3617e73c714", "value": "5383021823BE4959B58D8E2D88930ECF3F66F474281D58A2B55E00E9F223C565F34D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627287, "uuid": "58faabd2-03c6-4df1-a3b8-5a079a3d0d9c", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdA8eTrIarVAN3/B1eM26:4DAysJADlV378P3RPVJLdzau8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627287, "uuid": "2e6de500-91cf-428b-bf88-d3f0875dcda4", "value": 86107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627287, "uuid": "7042918d-ffba-4036-a081-d7779d794535", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627287, "uuid": "db6e7e17-bb0b-4a0d-9a27-32d2fb2e42a2", "value": "statistic-826119.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bcb524-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621264, "uuid": "fdf1080f-90c6-42a8-b959-89df5bd367d1", "comment": "Malware payload", "value": "2538ac9528a60177090a9a8d26931c88", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621264, "uuid": "68b32ba5-596f-4f4f-9c54-746d92ea0a21", "comment": "Malware payload", "value": "0e4117e4d80196e9a55e6da04aa742e0527c4f522284e89aeab2af03cf9c9f54", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621264, "uuid": "ffb5b6ae-e288-465b-a2e5-efac4fd33090", "comment": "Malware payload", "value": "b82008daf7372192fb759622ed5fd124f99a960b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621264, "uuid": "37b77a85-d80d-461c-8d0f-f28c16e84b3f", "comment": "Malware payload", "value": "b540bddb12dfb652b26678d27c931bba6e92d59a178d1e9b56350e9de5037092b708038bf62ea1249c370254d4f3f0f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621264, "uuid": "5a7efc3a-d45d-4f34-8def-57577d5ba047", "value": "B983021013B54E4CB9CE9F2958E31ACF2FA7F9B4260D69F561290894E722C474B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621264, "uuid": "863bd03e-6bb6-47a5-8534-134641db9888", "value": "1536:GDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJW5:GDAysJADlV378P3RPVJLdlDpH+jAJW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621264, "uuid": "90446271-c499-4f97-b627-a3505b06e6a6", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621264, "uuid": "a7d4add1-b13a-4c77-874c-8dc13329478e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621264, "uuid": "fb9e6b4a-f832-446e-970f-abe8a0d376e8", "value": "catalog-509142907.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bfebcd-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640682, "uuid": "18e40326-7e60-48fa-bb0b-e6ad5195c8e3", "comment": "Malware payload (Quakbot)", "value": "571a53fa497732ce49cc38db3e6cd0a0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640682, "uuid": "6bc005fb-42d0-48cb-b9f2-12ff50ba5a74", "comment": "Malware payload (Quakbot)", "value": "0e42734690b463249129442ce81dbed1d5e0acc3c0ac4f668d4ec5e8dead4458", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640682, "uuid": "cee2854f-80fc-4f98-ab94-f5467c7bf6df", "comment": "Malware payload (Quakbot)", "value": "45e017312195a9cbe411aa10aaa55394912598a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640682, "uuid": "dec58fcc-5e95-44a2-aa1f-5aaab93caaed", "comment": "Malware payload (Quakbot)", "value": "df747b6b08602bbf6b947dd14600b64f29e5da5c1da548aff8055c3e21809dcd9022cc3c6eed02ddb368b52041a91ad3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640682, "uuid": "f22d2289-8917-423f-be96-cfc1f1fe3159", "value": "F3947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640682, "uuid": "4911c322-41ba-4b37-9213-bafe688b889a", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640682, "uuid": "b026a67f-01b7-411b-8070-51a74cbde47c", "value": "6144:ryPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmAl:LTwr03pdf8vhhOKJET5ByAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640682, "uuid": "fe5b13d9-1d27-48d0-a11c-8ed5643a4e67", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640682, "uuid": "0542538f-a5d6-49a7-85fa-f29f3cf97fe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640682, "uuid": "0619fe40-54a1-4b00-8954-68c9d5968494", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18f9e3d-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619091, "uuid": "f09234e5-391b-416b-8d36-653c0cb33e20", "comment": "Malware payload", "value": "00ee7316678368d1a556db9bb518192a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619091, "uuid": "8e887f4a-f14c-472b-95ab-68eb3d084a41", "comment": "Malware payload", "value": "0e4b11a943f4c8c1337c893be1ec2b69cd3ebc4c6a0d247be480de2144603e12", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619091, "uuid": "454529a8-b00e-4f1e-aae0-40815a8065b6", "comment": "Malware payload", "value": "d1f1698dabeb24ec7abe3be3ee1bd9b8f7563019", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619091, "uuid": "9264939c-5abe-4c7e-a2b8-93df22566f83", "comment": "Malware payload", "value": "baaefc0146a978de0ece6e0194d9128d9998a191111b6044b42a24a75ee0451aa66dcc95b4fff077c9ddbebce4cad45f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619091, "uuid": "9ca43aff-afc0-4477-af6e-9e4ff6b50f58", "value": "9283025443B94B5EB4CE8A2C6CD31E8F3B9BF5781A1F69E1381D04E1B1278650B28D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619091, "uuid": "f54dd556-e21a-4ac5-9ed3-c1b23693ead1", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdoN4WV8BAY6Hv7R7:zDAysJADlV378P3RPVJLdK8BXsjR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619091, "uuid": "3d32edf0-1da7-41d2-9c08-5d443756301a", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619091, "uuid": "c396fac8-e247-4a42-8069-f1d58f4eccde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619091, "uuid": "fed6fbf1-fb5c-4cc8-b76a-756567a2115e", "value": "catalog-1024344489.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7d23df-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624402, "uuid": "dca00f28-c57c-4cf6-a88d-8d040c835fb0", "comment": "Malware payload", "value": "43f907e760601499a54eded8a623e078", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624402, "uuid": "5948368c-7699-454c-8082-65d2289c1e71", "comment": "Malware payload", "value": "0e57c5525367b94523230678f262eae3ae463df05cbaebe869391cc82b9e516e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624402, "uuid": "3dc0e6db-137d-4896-9030-e3a0a71858b3", "comment": "Malware payload", "value": "a8e56e43f4b39f529da92753e4451b77e462c254", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624402, "uuid": "3e469fbf-dc20-4c22-b62f-18ac6cf38697", "comment": "Malware payload", "value": "b30988e36b49aee49d183b8ff633d5aa6f8d713d909da08bf40c96e0e8173cf3e838b0cab1650aadd00d0bdb2b9bb777", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624402, "uuid": "536928b5-f4c0-458b-ab4d-2672ec2eee8f", "value": "AE83028C653DCAEFB1AD6F09A2DDC47FB61EFC622008248DD4C876665D49AE70C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624402, "uuid": "be69f32c-b519-47b1-9741-9a825ab9e1b7", "value": "1536:/PG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttfe6n6475e0NEnP6c+t:3GEhrHJoEsBMG7qzkp4q/NEn/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624402, "uuid": "a71cda6b-61fc-40e6-b1d8-9ca907bf7abb", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624402, "uuid": "8708a26e-2d42-47f4-9ae6-9f23e4c212e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624402, "uuid": "a8d3140a-6bd5-4892-b6a3-e9bc1be282ad", "value": "diagram-751480665.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ed5633-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626690, "uuid": "6f1178e7-9a68-46ce-b503-43d88635dd98", "comment": "Malware payload", "value": "416eab449b46e70930886080271b9a51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626690, "uuid": "dc9de843-0e41-463b-9e6b-ef47ed08816c", "comment": "Malware payload", "value": "0e709511d09ca3c5ef375d2a538b7b7cf82265ba20c528155f2d9f8c484381e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626690, "uuid": "250612ba-7f82-4fb7-a38a-e445a98a91c9", "comment": "Malware payload", "value": "0f0db3b32bb678d2f4573d99e1a515b203fe4972", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626690, "uuid": "1c563ace-d235-448b-9b1c-1368505cd3c7", "comment": "Malware payload", "value": "04cbb0273149ff85c378932df85764074d930a22de3a61fc9a08618fa6186db073c753f39bda3f516bf49dff8410d134", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626690, "uuid": "d5a2e85d-a6fd-4dc4-b55f-8e6cbde8d552", "value": "2483020813BE5909B5CECA2D8CC31FCE3F57F8B825194962A55D0099B627C6B5F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626690, "uuid": "38dce974-6f14-4f6c-97e0-ee7267edb3a7", "value": "1536:BDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n1U:BDAysJADlV378P3RPVJLdcKuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626690, "uuid": "17820922-cf4b-4064-85c7-6a6fe3baa818", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626690, "uuid": "408481ff-63ed-4da6-a0ca-c27406e7f4c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626690, "uuid": "07acbd64-1b8a-49c5-8981-32c7ac14f2ab", "value": "statistic-424351739.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af719d78-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645313, "uuid": "7a329b02-cf37-434f-87b4-d33c82a47b30", "comment": "Malware payload (Dridex)", "value": "eb60fe424469fe1c27eb9451b1e91428", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645313, "uuid": "44d5f568-095a-4847-862b-9c386faa5248", "comment": "Malware payload (Dridex)", "value": "0e85608a12645902f3c1209138cfe8deeb9ad151bd13256ef5aae1770a620270", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645313, "uuid": "425b7316-e958-4cb2-9391-69023652319f", "comment": "Malware payload (Dridex)", "value": "d0ead900f724f50b743d9ce04da1a3fe9150af8c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645313, "uuid": "cffacd34-c008-4ea1-96bf-ec1df626ee0e", "comment": "Malware payload (Dridex)", "value": "0ac8760c6ba7d87a5cc93c281a6a2996d5ac0ceabcc5c8fce416e5505adb4003cc7b2976c1543bc9b20080d5b589c447", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645313, "uuid": "27501708-2232-4bb2-9caa-0b04e79508f3", "value": "3BF3BFC6E7EFE0D6C02BB43385CDB036EF6069D88A3ACF35C104892E69D7D549A35469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645313, "uuid": "ce4a7dc7-adee-49bb-943b-58b194c9feb1", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645313, "uuid": "9c41768a-a936-4f99-a23a-84a5ad057d21", "value": "3072:M58CMtKJlXoDRl4epTGmoAc7iTRilfn6wlYYbZwd:9nClXSRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645313, "uuid": "fedb4b2e-09a5-4a48-b11b-593b8c278172", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645313, "uuid": "b4c70dc1-47e4-4b42-bc8e-6e163b35a518", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645313, "uuid": "f99b3f89-b8d7-4143-b9b5-c7e0371f19a2", "value": "eb60fe42_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6636e93d-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619421, "uuid": "df1af330-044f-407d-a93e-3e100a736444", "comment": "Malware payload", "value": "678124d06b81776c03ca2e2cc1302583", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619421, "uuid": "3568cb4e-ece7-4fe4-9380-e4811cabd4c8", "comment": "Malware payload", "value": "0e9058637ce9214dd8a192a47511ea1affd6e70d30d8e384815b752ced57e18f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619421, "uuid": "1c1246ce-e228-479b-b5fe-e4fd8277387b", "comment": "Malware payload", "value": "be10bce7697716a94a0a8ccbc533479163e26349", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619421, "uuid": "901d7fe2-f6ae-4770-b531-cc294030c40d", "comment": "Malware payload", "value": "6e4b5676daa0e938e1f8386754a5d28ed3f85fa283c604e661b9c7f5c194316fd9b4e4f789eb58cc1221d9692b2853a2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619421, "uuid": "0119b44a-a52e-499a-b786-b8039c4845ea", "value": "7483122003B78F4970CD8D3998E32ECF7BAAB9B82D1E99F1556D0459E223C961B1447F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619421, "uuid": "b96f7e27-278c-4b44-9c3b-68ba6dd1d098", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKH9g:PDAysJADlV378P3RPVJLd+Z8VH9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619421, "uuid": "215d28f8-2bff-4d66-9032-3742e3d73219", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619421, "uuid": "4de72ad5-fc5f-4935-ae56-4fb9915239d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619421, "uuid": "698f5b5c-ad80-430e-85ac-d8bf83fa7647", "value": "catalog-1250220699.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6458336-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623045, "uuid": "83ed2acb-0c0e-43ab-a3a7-c83ba7d1c369", "comment": "Malware payload", "value": "a2c73581f5008deaeb8bbebbb5252785", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623045, "uuid": "7aac71dc-2b9f-4ee1-8216-973e58427e8e", "comment": "Malware payload", "value": "0e9226e53c1c0f27ee8e69710df648d4d76dbb81239b1afdb0d82964a98f19df", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623045, "uuid": "b976f1e8-e8dc-4a37-8b6a-447d0ac903a1", "comment": "Malware payload", "value": "55aa6ff0f456f206ea06aa059b4db321e00a2562", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623045, "uuid": "3e8a533d-731a-46c5-b009-88cd1570bd83", "comment": "Malware payload", "value": "6776c42ede22611b2420564c0ad8a1c8e17dab0059bf5a573435ff19e49c0b9106cc0e0ee2a9cbe0284ee58bd8d7abe9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623045, "uuid": "9a3fb065-0871-4d00-ac26-81d77ca5b77f", "value": "5E8302DC653DC6CFB09A2E0552ACCD3BF90EA4B93008788CD8C46667CD99EDB58DB550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623045, "uuid": "05e0fd1c-fd0d-4099-9379-115ff4b9165f", "value": "1536:hG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tterjMO:hGEhrHJoEsBMG7qzkorjMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623045, "uuid": "1bb2e951-f4f5-485f-a9d8-366a3dd0216b", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623045, "uuid": "fb4e2254-ba78-40bf-85f4-24d6ce9deb84", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623045, "uuid": "5083ebad-55a5-4c00-b3be-5ea4ce3b6415", "value": "diagram-1811086638.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fbfa11-a876-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619651250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651250, "uuid": "b7faef98-27ea-46ea-95c7-e9ad3c767298", "comment": "Malware payload", "value": "fe03dc39490fd2cdb1a42b3be4afaadc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651250, "uuid": "d81aa5e4-487c-4eb4-9b6b-ed0c04ff645d", "comment": "Malware payload", "value": "0e9423c6b3d555a01513b11f32ab37696a240a469b496b64c01069c40e636447", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651250, "uuid": "8e385114-7330-4ea5-8408-1d39ddcf1924", "comment": "Malware payload", "value": "44b233b7735bfc99551844ea886ec90d544f2520", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651250, "uuid": "99f87ec9-08c1-4d23-ab5f-d92dfc8c136c", "comment": "Malware payload", "value": "0b5f0b1155dcc8400fde8a45218ae5c90b1cd912a5b7522a8a1c61045272b067000ec49221f89b5cda91ed58a5521e26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651250, "uuid": "563c5ea5-79ec-4787-8ac4-1a0d36ad02ab", "value": "7D12D0D1DDD8413C99F083157CE69EEE6844251540AFBF0B826E223BFC91BDE5D8142D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651250, "uuid": "8287920e-1b63-433c-ac1c-c92ca2eed512", "value": "192:ZnNi7u7I+K3UVn7g834gAWtNy7awjyjWhcFECYdv:ZnNUH3w0tbP7awgWhcFErv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619651250, "uuid": "8c36bb3b-8183-4f6d-a24e-6260f99db252", "value": 9668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619651250, "uuid": "eaddcc97-0a64-4382-9b66-0f9a86361e4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651250, "uuid": "623691fc-2ffa-43f5-bb58-ab403f538b25", "value": "fe03dc39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e92ef-a7bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619571653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571653, "uuid": "1b2c6641-d005-41ef-b391-8077e17c313d", "comment": "Malware payload (Dridex)", "value": "fbf8cd89b6ec4b761e108e64460926b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571653, "uuid": "66ee1359-14e2-496a-9359-0a7798ea36c6", "comment": "Malware payload (Dridex)", "value": "0e95b0ed6336167f5a411924cacbfa921e4428cbe962e9dcef4dbb97c7ec2dfd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571653, "uuid": "ed9651b5-d47a-442d-9250-6a1a88f60963", "comment": "Malware payload (Dridex)", "value": "af93cb18ef7910d418ba3de246cdd40f7c825253", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571653, "uuid": "a8f70215-361f-4348-936d-4c5024e7f44c", "comment": "Malware payload (Dridex)", "value": "3ba301b3365b427dc22bcdcbca74534d12f84770f9b319f0864cab39e03a80b8beba42be291bd17c3646dec3d8c2a371", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571653, "uuid": "a7947715-3371-4567-9d36-96fb597a155d", "value": "70F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571653, "uuid": "1e299882-7187-4022-8cc1-ff5bc38f327c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571653, "uuid": "3c590b23-cf0a-4e57-9d68-cbaf9d596bb5", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619571653, "uuid": "cbfa6ab2-cd13-4da6-a57d-c0160d7f7349", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619571653, "uuid": "6d1acabe-52ac-4041-8762-df5168a696f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571653, "uuid": "effd638a-43a0-4b62-b115-b88c8faeb9c5", "value": "fbf8cd89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b470a342-a871-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619649187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619649187, "uuid": "31503a7a-0985-4e0a-a585-451463cb6960", "comment": "Malware payload", "value": "dc3ce0d803e1117531540ee30172b486", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "swissfileknife", "colour": "#8A9D4E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619649187, "uuid": "74febd29-2054-4db9-bb9c-d220fdf047b0", "comment": "Malware payload", "value": "0eb2a690eecf3e04135ae05df44f672f69bc15ebbacc6141a288b96a4d751182", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "swissfileknife", "colour": "#8A9D4E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619649187, "uuid": "5956b91e-0937-4676-a294-fb25547c110e", "comment": "Malware payload", "value": "eeaeceb22c84918272e2caa87fd0fd0a0c93853a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "swissfileknife", "colour": "#8A9D4E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619649187, "uuid": "a2e0158d-640a-45e6-97c7-c986d0911bad", "comment": "Malware payload", "value": "0fe623c4370654d4ec810ac504d95637f6d7ea7410c7182090cb217e3f0abcddba95467406dac5ecd8dba3844fb64942", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "swissfileknife", "colour": "#8A9D4E", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619649187, "uuid": "65bb4a8b-07c8-41e2-a795-d1693d2b4f53", "value": "EDA59E06E7409036E5D200F3536A85BA6F34F236132460CBB5CCBEA83F556E27576B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619649187, "uuid": "00b1ca7c-5db5-42ed-83b9-1cb185545fe9", "value": "077b824af9a20dc9f73d400ebea40d4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619649187, "uuid": "c3de114f-d8cb-4e9b-8f94-8af53d5dbb1e", "value": "49152:tOJ4c0d0Mu7xLw4c0f0Yek3SgYRCrE0L24dreIRTocJZRt:qiCfBc0fbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619649187, "uuid": "4408c933-f6c3-48c6-87f4-9fa7923147f6", "value": 2166784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619649187, "uuid": "53da85da-9426-4ef6-bab9-fe3e4d308d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619649187, "uuid": "b0fcb1f3-f566-4337-9f08-393a3d0735be", "value": "0eb2a690eecf3e04135ae05df44f672f69bc15ebbacc6141a288b96a4d751182.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcfa386-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624208, "uuid": "b36f05c1-7d3b-4ea5-a8f5-2603e2ced93a", "comment": "Malware payload", "value": "f82f57b1e10d2d44c1aa2d5e65f6c4b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624208, "uuid": "4fe8d14c-43d2-42bd-bab5-b00b1984846e", "comment": "Malware payload", "value": "0eba1682eaf6644c18702518e61311fc2b1b8a69f74b8f1cfc213328a2fb00fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624208, "uuid": "8b605e0e-07c0-4eef-88ae-e8489d49c550", "comment": "Malware payload", "value": "f26e945c7eff97e97a6934283c903e67bf7454da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624208, "uuid": "0d58421d-60f4-48c4-8234-3b41be60d472", "comment": "Malware payload", "value": "891a339dffe7058c18d24a48f05bcc0517f153afcd9fa2b7f3a8a0381acb539dcd47dbb65fe098a12b6960c0c623d45b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624208, "uuid": "b61bf931-1fab-446b-8ed3-ca3e67131659", "value": "FC83028C653ED2DF767D2E08A2D8887F790DECB4214434CEE4C81A6B5D8EEE75897460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624208, "uuid": "f032324c-3427-4c9f-8183-5a0e6f6f32e4", "value": "1536:0G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5hWgYkCxGcf1aSX:0GEhrHJoEsBMG7qzkrh12xGwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624208, "uuid": "00b9c351-9df8-416d-8c94-0c53b6bc80b8", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624208, "uuid": "c43f3a19-9972-43bf-8f7f-45b4d538dd3a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624208, "uuid": "4b567309-7672-467d-bca0-d26f4bbf7c45", "value": "diagram-613908041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4854d6c8-a814-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619609063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609063, "uuid": "6fe790f8-75ef-4568-928d-0feac556881d", "comment": "Malware payload (AgentTesla)", "value": "18b44f77e1e7745e9fd83d75ad01df91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609063, "uuid": "013caa0b-b57b-4a37-accc-4a2069a82b91", "comment": "Malware payload (AgentTesla)", "value": "0edb8c8d9ff0709677aca64cc723b82302d244cfb9dc69129674aa417d495321", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609063, "uuid": "92e19b53-4e1d-43ed-94e3-ef763d368934", "comment": "Malware payload (AgentTesla)", "value": "875c610a50fa8e58a394bcf4a4fb7cd28ea2918e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609063, "uuid": "467d384f-23f3-4837-99f9-56177eb7e123", "comment": "Malware payload (AgentTesla)", "value": "168a0beae01706ee29f859b2406bc878c1f10978c31b8fbcae6744454fd7c78598fc274ba7595c2c2f5ae40e284046ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619609063, "uuid": "973ec5d6-2497-43d1-abc5-6dbe2059d56d", "value": "E2B423894D0A8690B960C21D91EF650F583CD4A7BD6CE828FFCE9842B932C9D4C7B75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619609063, "uuid": "1e6e5431-7c22-4416-afbe-93da2f94fcf6", "value": "12288:81QmaToe3iE5NAN15sCs7nhQwbLwTK0kMUoUZf7qR3wBMUoB:cQZhWpfsmokTK01UT57qR3WMUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619609063, "uuid": "35d15461-8ee9-42c5-9adc-fedcf563cf66", "value": 506648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619609063, "uuid": "98975e21-6db0-42b4-a0ad-30974c9457db", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619609063, "uuid": "ad7976ee-785a-4620-8d1b-b1c583f47fa9", "value": "Invoice 01859.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8739f34b-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619476, "uuid": "0d6a6745-ceb0-49d9-a178-747a265576e7", "comment": "Malware payload", "value": "f00a449a1133d01571a2e566407a0cc9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619476, "uuid": "4fd8a305-5a85-4ed8-ab86-9f7f722dd7b0", "comment": "Malware payload", "value": "0ee052bc71ebbfe8b528a56d62119bbbfd544bdd31b5e33ae2e337267e2803a7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619476, "uuid": "61a17315-4824-40bb-9ee9-6664e11f00e2", "comment": "Malware payload", "value": "5c07c8522454e44b78782d1381af18eb6c892f13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619476, "uuid": "1992a1dd-f235-4bbc-86b5-a930fa306a15", "comment": "Malware payload", "value": "ef833722706e49db1d8a158817bd16619dd2422bc8cfd41bf1b1d6b4101953698a842bd42731e19aa063e2a6514ffb5b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619476, "uuid": "ff5b7a70-189d-4093-b6ab-8e28d045d35b", "value": "4783121413B94A5EB8CE8E296CE31E4F2B9AB8F4191B55D1794D04E1F2374660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619476, "uuid": "c9fd4696-79fb-4c36-af94-af4ac022e3cf", "value": "1536:SDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wc:SDAysJADlV378P3RPVJLdP8BXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619476, "uuid": "70c4e52c-663f-4156-a8d4-0321d45c5c66", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619476, "uuid": "e266c727-49c2-4d9e-b791-65daa7a3ecad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619476, "uuid": "929b7f2b-9b12-4f5e-a270-d6b532609ff8", "value": "catalog-1287645800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40316c52-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626229, "uuid": "b920111b-4c88-4584-9ccb-3654c09bf7b4", "comment": "Malware payload", "value": "4876d1b5e0929ff5b29efbb1b751ff6a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626229, "uuid": "d20d30c2-f293-4713-9840-2ebdd32e600a", "comment": "Malware payload", "value": "0efa912d18d0fbe45ff7b4f5342eba6eaba23bcc2eea20d748163605d2124b33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626229, "uuid": "c0b5ef3d-2156-4b20-8298-f7d85ade7be6", "comment": "Malware payload", "value": "dae6f4f3e8ba2f6bbbe1053dc713eb5f0829549e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626229, "uuid": "78c2e760-0d3d-476e-8ada-126171b78c14", "comment": "Malware payload", "value": "ceed5484b49919b63eb2eef2400e02ae7500410a53b73a076f5f841baa71bf470cbc8016dfed1daa0d875f007e3f5777", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626229, "uuid": "915b411e-512d-42f1-8fc8-f0aefe4d294c", "value": "E983025413BB8EADB58DC93948E20DCF2F56B6B02D5B5CF2B12D0494F1338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626229, "uuid": "51bf3367-eaa1-417c-a898-0c70d265dd34", "value": "1536:pDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7or:pDAysJADlV378P3RPVJLdw7or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626229, "uuid": "2ea07779-f7b3-4006-acb9-3e9c805bf31c", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626229, "uuid": "77945bec-5dc5-4f88-816d-c760b7603abe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626229, "uuid": "53725a72-310b-46d0-bb10-7f7f6551e4a7", "value": "statistic-2072192818.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e858ca0f-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640684, "uuid": "aa2e7b3f-810e-49a1-ab1b-f6c2b733566d", "comment": "Malware payload (Quakbot)", "value": "0b24308eba1a68eac5430beab2538cd7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640684, "uuid": "cfff761e-6a06-4fb1-bcc3-a0c48650eccf", "comment": "Malware payload (Quakbot)", "value": "0efabddb98ee48e5a4e40b7b9f28637ceac841ecda6faa4f9afd77e1d8540c91", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640684, "uuid": "49a77806-b13d-4903-94d4-f42442df6c54", "comment": "Malware payload (Quakbot)", "value": "828b45dff6a4b9790fa00911becaf2bebd1d8921", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640684, "uuid": "90b07a54-6d27-440b-8141-b623909615c7", "comment": "Malware payload (Quakbot)", "value": "7931fedff14601fdf088ce9c25047dc0dd09fcb9db09ddc6dbb23e99729980b79de544b996bf8bafc0e2e560615ae6c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640684, "uuid": "cf104b70-9533-4402-8398-70fb2fd3c0fe", "value": "3D947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640684, "uuid": "986147ec-e825-4ebc-9697-6e660b96209b", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640684, "uuid": "72cd78b6-0c5a-4931-a58d-8a57ab880e6f", "value": "6144:myPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAml:KTwr03pdf8vhhOKJET5Byl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640684, "uuid": "c0f25c1f-757a-408e-a6a4-cf492f56abea", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640684, "uuid": "7effdab5-088e-44f6-b51b-63845e68c1ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640684, "uuid": "5fbc9c7f-cce9-4a63-8ea7-3f94e860e5ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c47578e-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646972, "uuid": "0c43abd7-6cf4-4ffe-8c62-1de963a39697", "comment": "Malware payload (Dridex)", "value": "e6c7a72a281b22ccbf1a8019a1f29af0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646972, "uuid": "8ce4c698-14a7-4c89-bbff-76cb43a0b258", "comment": "Malware payload (Dridex)", "value": "0f08d108adb1bdca7fb6b60b5c0c9b7418c421efec0ca5afe789be94ffc4d34c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646972, "uuid": "e70f72e3-2f05-44d0-8df2-80d456052106", "comment": "Malware payload (Dridex)", "value": "2043e9cd7b55dc9be5941152ec6c05c39d9d007b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646972, "uuid": "29d8599f-129d-4945-a0af-7c8c5a9a0d9e", "comment": "Malware payload (Dridex)", "value": "5b15a98441bbd58cea855b287ecfd2f4fdd1e8c9b6d1f08db3beaba7ba25940d26ef6a66ed4938fb471191966143a612", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646972, "uuid": "c3751cd4-70f7-4d22-832e-a644706fdf08", "value": "45F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646972, "uuid": "119ce5c2-ecc3-40a9-b912-6aef90ff0d9a", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646972, "uuid": "324ec455-9ffd-4441-8b92-deb9e15e445b", "value": "3072:aBT2d85tleLD51fC5AHYEoefukoTFMpGmj78D:jy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646972, "uuid": "cff1c761-6c06-4c6e-b20f-97d369e36c52", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646972, "uuid": "74638833-aa5d-4149-aa8a-b9c68f378158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646972, "uuid": "8b9d4a7a-e871-44d1-af0a-aec9447ca30e", "value": "e6c7a72a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424926f2-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619360, "uuid": "5e008665-b968-4fb4-96ad-3f7a59f6ca92", "comment": "Malware payload", "value": "f9ccc7e7dd65cb161e35679cf1e10245", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619360, "uuid": "d1fa37ab-884f-46e6-9883-ef4cbab71b31", "comment": "Malware payload", "value": "0f29c3c305b826a34548853f6763b0592441cdece3a9ec5b0a4f4dd5a4f95c32", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619360, "uuid": "8ffe9c41-5cbe-4e85-8cc0-ceb7de392c82", "comment": "Malware payload", "value": "e8041e061f126dc9b2684a4e62ba9e3424597d6b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619360, "uuid": "d04eac42-6aa6-4db7-8ce1-1121eb1cc5de", "comment": "Malware payload", "value": "2c46a09c4314699f50f039a6f5b4d6c3a07708f12c422e99eaa9bd53744588b33c6043b648ae4667d91b6578dbea85fd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619360, "uuid": "86ea7dce-e001-455d-aaf5-6299d0fe9a51", "value": "2683023103AE4B5D74CE9A3954D21DCF3F86E8B42D195992512A04E4E32BC629F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619360, "uuid": "7d4679f4-91b4-4270-9003-7b5ed4c7749a", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRM:CDAysJADlV378P3RPVJLdcDsMU0dRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619360, "uuid": "3792cf6a-6d73-4076-a27a-aae4ebb75ceb", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619360, "uuid": "9dbe0958-eab6-482f-b973-c647034890a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619360, "uuid": "c7d6a812-75b1-46bf-8147-cd775c58f301", "value": "catalog-1216442886.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fdb5a8-a859-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619638993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638993, "uuid": "a3ec17fe-6b45-4de4-a19f-769e8301b113", "comment": "Malware payload (Dridex)", "value": "d72e875fb26796ead9ddbc317a0a8876", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638993, "uuid": "3cacb030-c1ca-464e-980e-ab46c9e17828", "comment": "Malware payload (Dridex)", "value": "0f401b68eda24c0884112dac647ee24dded0fe703a29a696c8f48d4993740979", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638993, "uuid": "3eca231d-3001-4ad6-a12b-9199642a8109", "comment": "Malware payload (Dridex)", "value": "39a783496c037592d58c8632368f01e904a275e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638993, "uuid": "32be59a3-a633-4ffa-86fa-f274f577c64f", "comment": "Malware payload (Dridex)", "value": "3a37730ff824b7945ef8f55a7d09f182b84aab0993ab9dcb4bc91b34434952f3d61b75a0c82f0c5763e84d8675c74f95", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638993, "uuid": "7d9c3b4e-ba23-40b3-ac42-b50c44959ccb", "value": "FFF3E0D2EA8BD390F5DFBC7E385B363063B999488603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638993, "uuid": "40fb62fc-4e97-4341-b460-b5b865d5dc4e", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638993, "uuid": "73545f51-2b19-4b3d-acc0-c8b5f906a6c4", "value": "3072:5tSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2TGkFY:znS62Fl+pkeJl3CvRStrFl+EYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619638993, "uuid": "c2eeb228-92cc-49ef-9693-1e57a6631b4c", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619638993, "uuid": "3f731e0f-068e-487f-89ad-28c1ba263f91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638993, "uuid": "6f1100dd-eb2a-4287-b769-0d1f13ddef95", "value": "d72e875f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f467e84b-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620948, "uuid": "b4227782-bd7b-4dac-a1f7-a98328b6f575", "comment": "Malware payload", "value": "517265993c796c2dde9c5fcff5ccb869", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620948, "uuid": "1417bf92-cb63-44ff-b900-0d62797c45a9", "comment": "Malware payload", "value": "0f4e42396c7f1993d394fd80bc66b22fea22aaf0bd0cfe26aae686ead9a27a64", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620948, "uuid": "0be5637f-9238-4a27-8eca-5b093f6dbf49", "comment": "Malware payload", "value": "46b6090147e095b121dac3e4a60ddd831fdf9182", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620948, "uuid": "e021352d-86e7-4ab9-b4ab-a2050f37229e", "comment": "Malware payload", "value": "faa076e0badd236c2d454f2197917db1a3ac5ad16298812a174df39c80026b551651497c9fa4354d10473f25ee9e9b3a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620948, "uuid": "8260fd9c-b18f-4076-84ed-e6b880730cb9", "value": "7183122013FB5F1870CD893DE8A26E8F7B6AB9B42C2E99F1526D0456E027C561B2447F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620948, "uuid": "95909817-f3ce-4039-92db-bdac216eeb7f", "value": "1536:aDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd5cZ8VzpIsOK6C:aDAysJADlV378P3RPVJLdSZ8VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620948, "uuid": "4b932276-64ab-4f7d-9310-77877275fec0", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620948, "uuid": "2b3da48f-9e14-431c-aa64-e278bcc93a78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620948, "uuid": "049ed623-a6ac-4fe1-8e2a-bd4eebe0d6f1", "value": "catalog-303910801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe06031-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645442, "uuid": "6d180c71-a535-4d1e-aef2-01882322b4a6", "comment": "Malware payload (Dridex)", "value": "c2bdfac0daa87593a4cd0ee49fb74c23", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645442, "uuid": "0e90ff08-4a8c-49cc-9559-9974e5dd36ea", "comment": "Malware payload (Dridex)", "value": "0f5682812cf7d5c28f93aa195440fdebc3b3253936c2f5b093dddc8a707839c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645442, "uuid": "7b37f900-e795-4cdf-b8ed-91d55b96ffcc", "comment": "Malware payload (Dridex)", "value": "e2124f20b1dc70b0cea5fc32223d0c901feedeac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645442, "uuid": "45078264-8bd2-41e4-bf95-41a4194be625", "comment": "Malware payload (Dridex)", "value": "8d7716295ee8f16002c7e4eeb88ecf27f8dd9e30ccce83aab614725f3f99d7d4788146625faf86cf79de79302709661a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645442, "uuid": "633ac6c9-c26e-45ee-914c-e5be97c1de6a", "value": "21F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645442, "uuid": "d09bdbe5-472b-49dd-b779-3f3d3efd44a4", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645442, "uuid": "5b286e0c-f977-43e3-8b93-249d601692de", "value": "3072:P58CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYbZwd:ynClX8WZ7/HrRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645442, "uuid": "389702e1-f88b-40da-a530-043443445a28", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645442, "uuid": "5b12e2a5-fa3a-46c7-ac1a-d4ec7f69c418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645442, "uuid": "7655b472-092e-40d2-adf7-f9b56af83cb0", "value": "c2bdfac0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb8d1bb-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620101, "uuid": "7cdb4a6b-1656-416b-b934-44154399782f", "comment": "Malware payload", "value": "c5b4d1cd336b87868878c4e36e5ee698", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620101, "uuid": "e52ff23e-ba3f-4dfc-b983-ccccfb78c357", "comment": "Malware payload", "value": "0f668977426e9bb25dbad85a65242520d48bf6019f4037f2f1f7c5179339a935", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620101, "uuid": "c48b2efe-3621-4e37-998a-d5b83d4f2a5c", "comment": "Malware payload", "value": "21e357ff0570796c859e362d3cc0d70de23eb55d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620101, "uuid": "57293fef-3b49-45a6-8e48-f636779dd37a", "comment": "Malware payload", "value": "4c1a3a8eff29dba89b837a5f6acf122869e57a60451f24a6530646b0394e645ccab54cc3d652a2625a2eb99e127cc62a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620101, "uuid": "496c602c-8db6-4e69-85d4-74b429ef6815", "value": "AE83123013B79F0CB0CD893E98A32E8F7B6AB9B82D2E99F1456E0456E113C561B1447F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620101, "uuid": "e44914cc-df48-4845-9c0b-b9ccfd079cd6", "value": "1536:MDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKlY:MDAysJADlV378P3RPVJLd+Z8Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620101, "uuid": "94c0ab2c-c5b0-42d6-981b-997d94ee1d46", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620101, "uuid": "a47b2943-62d7-4661-b77b-cc7d75085e3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620101, "uuid": "42d7197b-cdf4-4616-8e51-b136d8e986b2", "value": "catalog-1764095867.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8d60fa-a86d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647372, "uuid": "c2c91cbc-e96e-4afe-b385-926d218ac18d", "comment": "Malware payload (Dridex)", "value": "4e046064fc388504a2ee6bf558fae150", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647372, "uuid": "7c538ace-92fe-4027-96ff-7640c9d2f02f", "comment": "Malware payload (Dridex)", "value": "0f6a5334847337b7d851d86787219b45c4722ac48400e7c6e480ace229cdb384", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647372, "uuid": "34ad275b-1adb-4f65-9149-e3b0010e7ba7", "comment": "Malware payload (Dridex)", "value": "a65a167b79fbc8fc0469fdcfe4de134f6257ca8f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647372, "uuid": "6e3b8f39-3ef1-45a9-b00f-da977c23e8b2", "comment": "Malware payload (Dridex)", "value": "57581f3e15a38069091bafea85d12f8360bdc7c8995cb3af46f9c610a4af7921083b8690d41964a799bff4c0d1efe20a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647372, "uuid": "8b233135-67da-4b6f-95ec-c843fda916f7", "value": "D2F3CF41D5A6C458EBDB2870C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647372, "uuid": "f1138958-a4d8-4771-81bb-244490b987c5", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647372, "uuid": "3123be66-2561-42bb-ae13-c82b1e763eb8", "value": "3072:2UT2d85tleLD51fC5AHYEoefukoTFMpGmj48D:Yy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647372, "uuid": "e23e2fe1-c7b3-43e8-9b38-1e8f97375f9d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647372, "uuid": "7ac9c084-ee89-4357-b28e-319772be2192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647372, "uuid": "ab7dc0f5-3569-488a-ba5f-2f8c2d9e4cab", "value": "4e046064_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f23ca00-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624455, "uuid": "c0568fbf-7ff5-4381-aaa8-e60fc3c4550d", "comment": "Malware payload", "value": "876ec1128cb9574c053d339bab3eca2b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624455, "uuid": "1264c15f-b8b0-4ef8-907f-6e49943a6838", "comment": "Malware payload", "value": "0f79af6bd964de7f933d02c8e819f707b2e8d000173de8beec19d825b2ae778f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624455, "uuid": "f12ce6ae-a6db-47ad-a423-1903a339169d", "comment": "Malware payload", "value": "e9335b88296ac23f410373c91ac5752bad4366a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624455, "uuid": "e88327fd-9caa-45d5-a0d7-22cd69a9bbdf", "comment": "Malware payload", "value": "394d65787613edc677ec573424b474d622b518adb2ffc96ef6de2e01d13e126e838991b16aa129e27d725acb54c5fbf9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624455, "uuid": "5ecb7c0f-52b7-45dd-8677-7db934f6c0da", "value": "4783028DA53DCAEFB1AD2F09A3DDC53F761EFC612044248DD8C466A65D49AE30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624455, "uuid": "237e758d-b93b-4e3c-9f94-8aa7df998773", "value": "1536:2G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttje6n6475e0NEnP6t:2GEhrHJoEsBMG7qzk94q/NEne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624455, "uuid": "9eaa0af1-e393-411d-9042-5694f191b0ce", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624455, "uuid": "c4e4a7b1-0015-491f-9131-564d53dccbcf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624455, "uuid": "c64b3bf1-2f41-4747-a8f1-12c62a98ecbf", "value": "diagram-780693178.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cde707-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619622081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622081, "uuid": "d50798a0-7cb4-455e-8eca-84e578b6c721", "comment": "Malware payload (AgentTesla)", "value": "12d60fc89c58df88384e3caf15651f4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622081, "uuid": "26f7e908-4d6d-469c-b376-f530d7f4fe81", "comment": "Malware payload (AgentTesla)", "value": "0f86a74b9169cca3624334d0670d3958e5d1101111cc15d77a195570d0a3d55d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622081, "uuid": "4bb269ae-f916-4b82-9dfe-786d904ddc8e", "comment": "Malware payload (AgentTesla)", "value": "2aa5e064ed84226c19ecb19c99ab1098dadfc5da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622081, "uuid": "72c0b2b5-e475-4ecc-a240-3f54998aefd2", "comment": "Malware payload (AgentTesla)", "value": "60486cb505f5647ece13d43f6eceac2a84fd8a6aea6ca725abd9682ae4b429e86ac04c7861a47b58955b35b731c48f16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622081, "uuid": "6402ac9b-c65b-4575-80de-68491ae2845e", "value": "0AB4F12693E88F1AE2FEA3B954B1110057F1B516F333E75D7D9D008E0EA6B814662B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622081, "uuid": "5f840bb7-6e9a-49a8-8d4e-3f94d656e859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622081, "uuid": "94564c3b-4c79-4423-9ec1-13ec0e09995a", "value": "12288:B84LCiq1A1f/YOxDlygbdtI3NAfGXezhxyY1NdYX98:B84LCiylOxDlHbTXOOzhxjvd08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622081, "uuid": "2e94aa2c-b7fa-4b08-adba-3783b8429e8e", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622081, "uuid": "36e48446-25fc-423a-8486-9914a41e9dd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622081, "uuid": "e0707d2d-0684-4713-8f68-429f276448b9", "value": "mv ARAMCO PROJECT EE2021986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac03e0a-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620341, "uuid": "9ae2935a-092c-4d4d-8374-cca5b4110764", "comment": "Malware payload", "value": "7e11c0ca89c59d83064ccef6a4665085", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620341, "uuid": "d4ded696-bd89-40e0-8207-7f701458fbf0", "comment": "Malware payload", "value": "0f8c8516d3f12c9f4a6fd2a5144a6ffb0e1bfd1b55e06943820a953d95e99bb7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620341, "uuid": "8eaf72bf-91af-416b-82bb-196988c2aef4", "comment": "Malware payload", "value": "183664ca5e3d3f99b0b9cb3e95edeade4c7c0470", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620341, "uuid": "dd57a984-14ef-4815-9979-2e76d65c51e9", "comment": "Malware payload", "value": "f6a38b7271510053a520928219716fa9188bd1ead20c59e5ee8e3871963f7354686250a2736a85693c3b86c44a8c4bea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620341, "uuid": "3dc581e4-55dd-4445-bc7b-40ea6ce7735e", "value": "43830214137A064CB4CDDF2A5CB31DC76F56BCB82519A8F6906C00A4FA338526B2C97F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620341, "uuid": "e7b804e5-24e3-4bef-8fc2-6027938d9aad", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdVR1EPCO0ERQ:0DAysJADlV378P3RPVJLdFEP90ERQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620341, "uuid": "aa0b5973-257a-4c3e-a22a-952e263b42f1", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620341, "uuid": "57859270-0ad9-4a25-aa8e-c30b4658334a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620341, "uuid": "829f6650-5162-4f40-84a1-9410863133e5", "value": "catalog-1934889355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51479af3-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645155, "uuid": "5236896d-2fb9-4c8f-94fc-3d5b15d9911a", "comment": "Malware payload (Dridex)", "value": "c749e81a92e8717649a3e33800b4f4f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645155, "uuid": "adaa8f3f-85e3-4686-9af9-6e6f53fe9744", "comment": "Malware payload (Dridex)", "value": "0f8f01f949e6e667cdbe4a38c27882d07164c97139e0ffb52ea6c8ae41d29ab7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645155, "uuid": "546b4f84-5153-4d3b-bf89-6dd06c76c80f", "comment": "Malware payload (Dridex)", "value": "b672df6b0ce4d4362713aedccf7609899ff7dd31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645155, "uuid": "c5d124af-4601-4f90-bd79-141c20c0e68d", "comment": "Malware payload (Dridex)", "value": "0e77285fb3e7473bbaeb31e6f5cb6c720fd7fe8311f2b5fd0e2705e2cd055b15b8d2ef20e65a6060c162d758756e6105", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645155, "uuid": "e25cdc7e-2848-4b8e-ac1e-7447cf54f0df", "value": "66F3E0D2EA8BD390F5DFBC7E385B367063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645155, "uuid": "ff35f23b-c50f-4259-a082-8da6f08e7617", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645155, "uuid": "4a33802d-ecf7-421d-baa4-6b894975830a", "value": "3072:X8Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2FGkFY:snS62Fl+pkeJl3CvRStrFl+EYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645155, "uuid": "2a112cd1-a728-49cb-ab0b-0e2ab8859933", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645155, "uuid": "b28ca527-829f-43b2-be24-4e0ec8d16dfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645155, "uuid": "e02b8bcb-4955-4ce9-bfd9-7f8ebd42f3b0", "value": "c749e81a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbeb23b-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627241, "uuid": "51a78fe6-879e-4758-b245-868b44a1b831", "comment": "Malware payload", "value": "c81c71f85a8097c3aa9064ebe114157e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627241, "uuid": "f0ddfed0-24c0-4fd0-8ac1-d75bfcf1fbfb", "comment": "Malware payload", "value": "0f9947c44aab26151dd43781520379c4266201c3769bbfd8f348b416ae91a7bb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627241, "uuid": "10e14fe0-08c3-4b29-8357-d4597b7f1192", "comment": "Malware payload", "value": "1b61e35c5280ad56b8419d83e51ec3b9cc8f65a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627241, "uuid": "534c7de9-2da2-48da-b37d-6eb82f8f8d8d", "comment": "Malware payload", "value": "a6a47e4ab47ec7cab30449e8b1b96033b39243546c205f6d26c353cb53761f98a12e6f25134f2acc00b88d8a99fdfde0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627241, "uuid": "3c90aa84-ab3d-46ad-9c59-2dcc9ff23a83", "value": "EF83020403FB9559F48E9E38ACE20D8F3F8AF6B53D0A58E1976E0455B72A8910B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627241, "uuid": "726e5707-610f-45c0-8c78-e5a980d40795", "value": "1536:qDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wB3M:qDAysJADlV378P3RPVJLd/eh8wB3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627241, "uuid": "817a08c4-cff0-484f-b288-37f9e61c016b", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627241, "uuid": "9452eb82-f793-4cc7-b35c-b14cc8db0b2b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627241, "uuid": "76b710bd-e0a1-4e71-a165-7bc684dcd4f4", "value": "statistic-794657572.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d550c796-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619607, "uuid": "6fbbe7b2-af5d-4604-8ab8-f34bf2609f7f", "comment": "Malware payload", "value": "b907d9289e1a39f2d6a8ec3c90531e5f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619607, "uuid": "134356cf-8409-4aee-b6de-30ef90636a11", "comment": "Malware payload", "value": "0fa04ba1b2a1565f6451760a231fb9e88efc38f9b3897af7a0eebfdade57d4e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619607, "uuid": "224cc812-03ff-4598-9655-62fe93871d81", "comment": "Malware payload", "value": "625c24a2f41a26ad769e71608d95b2624983f3be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619607, "uuid": "ef281403-d739-42be-b301-bc3b461aed86", "comment": "Malware payload", "value": "9b7d40343960608114993a0030b2560408792a91ab41b8d46dfb67289d1867fc1eb9acb7b54cd4e4837c7461fdcda393", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619607, "uuid": "dd2ae895-ed14-462e-874f-6ccad7e5d68f", "value": "5383125413B94A4EB8CE4E296CE31E4F2BDAB8F4192A55D1794D04A1F23746A0F2CC7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619607, "uuid": "3d005197-6659-4bcd-afc2-3ccc99ab3428", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdPIkGV8BAY0wS:4DAysJADlV378P3RPVJLdi8BXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619607, "uuid": "65ae26cc-2916-40dd-b6db-6dc59bc31b78", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619607, "uuid": "aad20f3c-8006-4def-8c10-b72a5cb8bcee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619607, "uuid": "8ddfc795-a3c8-4276-96e5-d47c21f80303", "value": "catalog-137964540.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58431c4d-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623263, "uuid": "c2d718b7-bb59-45aa-88f3-c4d02e7dc7a9", "comment": "Malware payload", "value": "5ef2b65d29dbfae0b7cc96c51699db84", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623263, "uuid": "501518cd-a711-484a-863d-41919c0fe3e6", "comment": "Malware payload", "value": "0fa56c1fea8a3f4b284ec49ab9fef2a874be6460b05e073d56cae49119b9c43d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623263, "uuid": "f5e9cd8f-e2c4-4bdb-b694-0aa58e0342ad", "comment": "Malware payload", "value": "b51e457b525c301cbfa32a360fbfdcea4eba8981", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623263, "uuid": "f9e03594-6197-489b-98fa-1be72ff39d37", "comment": "Malware payload", "value": "238ee6622289a5f6c6bca67d13b915b5d0f7382f9dd6688ff11eacd48a423a31612f0720d1260791a6421822afb0532b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623263, "uuid": "ca23f45b-4d8b-4a2b-bc49-df778067d5bf", "value": "3083024D613ECACFB56C3F0AA1ACC97E790EDDB4204018CCD4C4776B9E499AB4CAA470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623263, "uuid": "2c2d69a6-a491-4820-bf6a-b42771d57a61", "value": "1536:VG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttBjKKmo3zuUkbybB4:VGEhrHJoEsBMG7qzkft7KRbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623263, "uuid": "82878864-23c3-4e0b-8abd-e9d34fa98d93", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623263, "uuid": "d3cf036f-efa2-4dc2-9ab1-a5bcf2fbb0a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623263, "uuid": "fc1f967e-61b9-4909-8722-927f55e92f7a", "value": "diagram-1973212087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f826afa1-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622243, "uuid": "f3bb8fec-4283-41f7-b447-6c146435658c", "comment": "Malware payload", "value": "41b69f0eba756c31dd827010ada8bb90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622243, "uuid": "26e6386e-80f4-495f-8a65-5707085cedb9", "comment": "Malware payload", "value": "0fdddcdc6469d4d266281e244973abd63984f7a3579393952902b1c16184101f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622243, "uuid": "a3cb360d-f4de-43fd-b587-20a757b660fc", "comment": "Malware payload", "value": "b4461f300380dde0d8a2b217e70f6ea40fdb1108", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622243, "uuid": "f9c03aa5-ba33-47ed-8eac-48ab13e7c2f7", "comment": "Malware payload", "value": "1862cf10582b7b035337f41b83f1b9f66447b65f1740ee5391b61c422aa36aca35939a339f9ab1a7126001a84b18a6c2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622243, "uuid": "55f93706-5816-417d-a49f-3c1c86ec658d", "value": "2583028D653DCAEFB1AD2F09A2CDC53FB61EFD612044248DD8C466A65D49AE30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622243, "uuid": "d06c5d64-3b4a-466f-963a-0d99f1101bf4", "value": "1536:JG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOe6n6475e0NEnP6S:JGEhrHJoEsBMG7qzkQ4q/NEnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622243, "uuid": "17d35e0b-a008-4d0a-adef-3e1ff3b3f79e", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622243, "uuid": "f0bc2108-cacc-4767-a050-c92e9e123e1c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622243, "uuid": "7b6b2633-36dc-4491-bac1-46950cee0357", "value": "diagram-12402159.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ed8800-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627225, "uuid": "33702a1c-4bec-4a10-bad2-b0fbec43a532", "comment": "Malware payload", "value": "e1ab49bc72cbada12513bae26140b02e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627225, "uuid": "c0be6646-9e68-4d80-b8de-28b598e9686c", "comment": "Malware payload", "value": "0fe72896753108f5577c389697bcda20a3b41de4efa519f11947f638920961c4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627225, "uuid": "c111c90f-89f5-4839-b248-735e3055719c", "comment": "Malware payload", "value": "f9d805659af9f90e44c3503faf778d0d0db3a2c7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627225, "uuid": "ab2b43af-40af-4b71-a71f-4d83b4634102", "comment": "Malware payload", "value": "3c9246d939c14b56d1523b29391b6b1811e4ee536f14c8c1d70bf7c07162a39fab776278ba8ee22993edc3316ceec94d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627225, "uuid": "ed57ab42-0617-46f1-a556-c2577350a73b", "value": "9183024003FA4F5EB9CEC97948E20D8F2F52B5B4191B6CB1B17D0454F6224951E28DBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627225, "uuid": "e35b6909-be16-4eee-9acd-bda0357eca0b", "value": "1536:tDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdwSgxkDUoNt:tDAysJADlV378P3RPVJLdoSUoNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627225, "uuid": "6cd5fce1-b235-460c-ac19-741c11763fb5", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627225, "uuid": "8a8bc619-4628-4c3c-ab3b-9540f2c0f9aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627225, "uuid": "950e6074-7db8-4a2f-a6ae-b582227346b3", "value": "statistic-784640507.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f0ae60-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640687, "uuid": "2f77879e-d1ed-4445-81b8-1a6f4fb76b54", "comment": "Malware payload (Quakbot)", "value": "3c57d3054f255d32335cade40541932c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640687, "uuid": "c21cab5e-88ae-42fe-93e3-b8238984c9c9", "comment": "Malware payload (Quakbot)", "value": "0feeb8923305afcf0a238c0a009b8bbd98eec3c3d6bfff12526fd7590d127d2b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640687, "uuid": "e2786e35-c21f-4738-96fd-54b6a3044e14", "comment": "Malware payload (Quakbot)", "value": "e3aa75638a864c5291a3ebfdfa4e959f28a09bc7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640687, "uuid": "0ef6c8cb-9987-437f-97d2-bc05862f7745", "comment": "Malware payload (Quakbot)", "value": "68be254a543528d1046c9c14f4cf9bad72405f09d7988ac5f2c9e59c033c223912d459993f8a5a845eb41de182b7b0d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640687, "uuid": "f10a60eb-caae-4d2b-ab1a-3f79d049a6e9", "value": "56948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640687, "uuid": "c43c71f8-09f3-4232-b01e-60bb218033e9", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640687, "uuid": "da5ddd5a-9502-451a-9706-b7e3b3a31fe0", "value": "6144:rVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWrav:UFNmLKSVpJbPT+4xr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640687, "uuid": "2b5bb3fa-a9ab-4494-a260-5766742551a5", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640687, "uuid": "1d8f4e5c-b147-4d65-8b92-8bcae1397428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640687, "uuid": "f1a557f5-c098-4f42-9aae-2ba119043f16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9540e68d-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622506, "uuid": "da86a56f-6f55-469a-a22e-288d280202dd", "comment": "Malware payload", "value": "7218559d9469e2ea791731b3bf4d778f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622506, "uuid": "b0287db3-387c-421e-9f9c-5b471661077b", "comment": "Malware payload", "value": "0ff9cbfbc0aafd35e845f751cfbcd346d220d99886466ff60d7c42ac3948f0c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622506, "uuid": "fbbd0824-d7ca-4485-b412-66f3ad1cb82a", "comment": "Malware payload", "value": "5c7c9391caf90fef74717db57bb97b553514685b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622506, "uuid": "472abcf5-446b-42ce-85cc-dc45df7ceb1e", "comment": "Malware payload", "value": "8c7ed3003200d40df491f88f723eac7fdbef2c65747a563124b2391d671714469aa6c5af94c7c08dece71fa9ce6791dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622506, "uuid": "b6f019ea-7806-47b2-a194-2ac544e87e6f", "value": "A983028C653DCADFB1AD6F0DA2DDC47FB61EFC622008248DD8C876665D49AA70C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622506, "uuid": "1563398a-fd24-43db-b618-dc57bc4a15a5", "value": "1536:uG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttfe6n6475e0NEnP6AO:uGEhrHJoEsBMG7qzkp4q/NEnXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622506, "uuid": "196a50c6-bfa9-425e-a53a-e5b3275ee85f", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622506, "uuid": "68816b55-ed62-4193-9000-c6cccbe640a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622506, "uuid": "3dcb1ce5-dff4-49b2-b4aa-e8afc79734fb", "value": "diagram-142349617.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1df4995-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622554, "uuid": "e126d9e6-dd95-4ce2-ba1e-d457205cba13", "comment": "Malware payload", "value": "3cb23ac2a0cc5d3f1d36803771ba95da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622554, "uuid": "9b1f4ced-52ea-46af-ba45-992492862036", "comment": "Malware payload", "value": "1003b89fb37371c454d527f2d91d397258fe6474ca35871bbaea827a73045c57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622554, "uuid": "eb3d2900-6b3b-41ae-8b12-365aedd5d592", "comment": "Malware payload", "value": "906e6057cfed4c28aac657f58e84b11af155acbc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622554, "uuid": "dc13ec55-7580-44b7-995e-31fe54f07a5c", "comment": "Malware payload", "value": "19839444e89cb919c57f1947f090b9ce24f1b1f446744a8214006ea4b442dd3e96dec7788d0b19c4f349ab8895686fae", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622554, "uuid": "d930b250-108e-48e6-b52a-4ffba0ddf993", "value": "5C8302C9203DC6DF71BCAA09B59C893EBD4D6CB42100649ED4D4267EAD8DAF79C97430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622554, "uuid": "4651d8d3-ce35-4515-9bd0-fef5a36e763d", "value": "1536:FG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttFI5EzJKE9LfFSp7ml6:FGEhrHJoEsBMG7qzknI5AB5gpSl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622554, "uuid": "33a80d38-e415-42e2-a579-b0f0157a15b3", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622554, "uuid": "ac158b29-d622-487d-b058-6a632c49a6f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622554, "uuid": "94f77cad-fbca-4ffc-a230-778ba7a0a0f4", "value": "diagram-1454831240.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0881158b-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625276, "uuid": "28e50073-8111-4ebe-bf82-0e4a9ea7a5c9", "comment": "Malware payload", "value": "080f12c1bb7c3767086c2aac1e5ca690", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625276, "uuid": "78d267d5-db54-4571-8f68-ce51034d7860", "comment": "Malware payload", "value": "100be343f8b5ef545c28f2652b4e1c734de9c77e292f036a0460c07719b4fd64", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625276, "uuid": "e2694430-b356-4000-b81a-0823c04c0558", "comment": "Malware payload", "value": "dd754eb71b2c22f69a1d016235c1f7035ea22017", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625276, "uuid": "e9a20b01-760b-4726-8ab2-bedde47b564d", "comment": "Malware payload", "value": "75a3446d411451d659d286a4205a93061beebea1af30163b0a88ee57d0a22129ba10dcd2ebf0a74bbb2041cf0e42b496", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625276, "uuid": "8e82811c-664c-4a4b-a609-6e55310cb425", "value": "7983125003BA860978CE9C3C9C931DCF7F2BBAB4251F5CA3519904E8762BC424F2897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625276, "uuid": "9d447bb9-3cf4-40f7-9130-dfbb55c0142e", "value": "1536:wDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdr3BfMtlF784:wDAysJADlV378P3RPVJLdTBfUlh84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625276, "uuid": "a76587b4-3642-4e77-95a3-87327b91c996", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625276, "uuid": "1d1df259-62eb-47ca-8323-444568ca9c84", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625276, "uuid": "48132605-0dab-46d4-a3f5-e69d93caee9b", "value": "statistic-1362017792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e98af88-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623193, "uuid": "d66d26cf-c2d0-4418-ae27-cae541da6aab", "comment": "Malware payload", "value": "e060e2d4d4e110fed9dae13b1d205896", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623193, "uuid": "8ffe0a91-a748-4dcb-87df-43c178511f8a", "comment": "Malware payload", "value": "100ce423b4fd2ff1885ee75a05d65ed92b8bb5800bf6b276ffacb1a1a1a5d779", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623193, "uuid": "125ad54e-07f9-4c0a-870e-0aee7fa31471", "comment": "Malware payload", "value": "c11098f317d089c9391776b5fc1c0760d035d74f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623193, "uuid": "0a4adb21-9609-4ec1-9ab5-17756b0ccc82", "comment": "Malware payload", "value": "614820fd10a9579f093b245f0139f138f01dab2702066a37e3be2417901c018a5778765482d732e3509a780f0023cd73", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623193, "uuid": "75f057b7-cd17-4b83-9bd7-8d2c15ba1f39", "value": "4283028C253DC5DF7AFE3A0A62DC887E740EE8B43144144ED8C9566F9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623193, "uuid": "7e13b1de-364f-42dc-ad30-b0de8c1f2884", "value": "1536:MG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt9KkApVr6wo+RxJ:MGEhrHJoEsBMG7qzkDxApxTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623193, "uuid": "0011d934-c10f-4f0a-a95f-fe9709b31118", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623193, "uuid": "93698eeb-5930-4f2b-bf69-946af658648d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623193, "uuid": "8d9bcdae-c68e-4826-9739-866ae3d7c81e", "value": "diagram-1930556981.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438882c2-a800-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619600465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619600465, "uuid": "eb8f9a62-9ef6-4023-a65b-2e580e4b5808", "comment": "Malware payload (Dridex)", "value": "6c38fe99201d26700e839ffd7f9a0f39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619600465, "uuid": "7cacae21-2537-40cb-bd33-384055858aef", "comment": "Malware payload (Dridex)", "value": "101c1c487a55e23bf70cdb5e27cd5105ca5125be0ef07773ee4869b0dac3bd47", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619600465, "uuid": "36fd77e0-5a5c-4234-87d3-9607e4fab51b", "comment": "Malware payload (Dridex)", "value": "663872a373e3c2cfea8d18fb664df43f6ee7f775", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619600465, "uuid": "2b864322-ac17-41ce-861f-29dd1efbffe8", "comment": "Malware payload (Dridex)", "value": "ee0707addfd0e1e7824af3ec279d6af33cf55f19acbe2fa4c9fe6f4e820c1836c7abe5049867b983e9226f92e12549a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619600465, "uuid": "0eac4166-436d-4ea6-a43c-c212d1563c46", "value": "B2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619600465, "uuid": "f5096f21-df1c-448c-9239-8bd775f1b1e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619600465, "uuid": "972702ee-1ecd-4c79-918c-289f0ea34321", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619600465, "uuid": "44e744f1-94da-4ccf-9a92-f549cbf8f81e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619600465, "uuid": "0c6e89f4-8c4a-4a30-a1b2-daee5db92540", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619600465, "uuid": "cceb19f5-8301-4e45-a2e8-6d75fc604281", "value": "6c38fe99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12764935-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627011, "uuid": "c4f14ef7-3648-497f-b57b-fadfdec1e60f", "comment": "Malware payload", "value": "449883636a9278b81464b2f9a5d4f4db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627011, "uuid": "ecee0325-4778-4263-90b7-a1b4b9544a2a", "comment": "Malware payload", "value": "101fd1e363a2216290e8b3effd5dc4ed34a8bebc1d33a17153f6f5cd8f6b2017", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627011, "uuid": "d0ad5346-a9bf-4572-a594-2effe50f55d2", "comment": "Malware payload", "value": "dd6e269c3b7eb46a1f811cf4007fb114a894474a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627011, "uuid": "4bb17a00-b934-4243-bd37-36963c3c9313", "comment": "Malware payload", "value": "da48f1c683f8efb84d173ccd3b8eba747deb38043c4d638ea4561ab5d6faead7284c53e1cbd27d5eef0280c643df3a2f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627011, "uuid": "12ad5fbd-ffff-4e61-af7f-292f3fffb700", "value": "B383021523BAC994F4CD9E2D4CE30D8F7F42B978281ED9B5622D019AE326C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627011, "uuid": "8c4e7cd4-93e9-440f-a9ef-501a06be5359", "value": "1536:5DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdaPqXT/WkO0B19M2q:5DAysJADlV378P3RPVJLdaqXjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627011, "uuid": "2fdfd145-3113-4c5f-b988-540db3a5bb5c", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627011, "uuid": "67d7b572-4fb7-4b33-8a67-7bda39d9e8c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627011, "uuid": "f6534264-c5fd-495d-8b9c-1b7bdde05095", "value": "statistic-653383536.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f820134-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626630, "uuid": "3b5b5d41-cf1e-42cf-a086-0cedae7fe26c", "comment": "Malware payload", "value": "3d27610e0b37472564db67be5e694c23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626630, "uuid": "fb2a74d6-9a62-4a2b-9f5b-b85f0ffc0d25", "comment": "Malware payload", "value": "105214fb616a44ee3c6e4a4f51ae3d9b7973c8d96cb7770cc8f8276b6046ab1d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626630, "uuid": "13a27d3a-f3b0-4bf9-b1e4-79170c74d10f", "comment": "Malware payload", "value": "b0c4026487f7b495f1b2dda10da83225ee981782", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626630, "uuid": "3ee59fbd-e3c2-4767-a785-92b23a0bcea0", "comment": "Malware payload", "value": "ccdee80cfa99ec0bb7ce2b20773af3537d95514e6e4b3217c7feffadfb4181abae0a4bc69c088eb6e7959508568ef0a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626630, "uuid": "e7833f5c-22b4-4ba3-a10e-9382674b0bbe", "value": "7883021403FA9959F4CE9E39ACE20ECB3F4AFAB43D0E58E1966E046563298510F3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626630, "uuid": "6f04bec0-df94-45f1-aa21-bc5841700633", "value": "1536:uQDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wB3P9T:1DAysJADlV378P3RPVJLd+eh8wB/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626630, "uuid": "11838249-6087-4f99-a9b0-0f07d577e129", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626630, "uuid": "6243f14f-570b-44b9-8fb3-38e9f9d463cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626630, "uuid": "b64f2c0c-d835-4ce7-a0aa-20b4f821a4a6", "value": "statistic-385142960.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac89fa5-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625012, "uuid": "db7d962b-1c80-4440-85a0-51ac54ba1ce0", "comment": "Malware payload", "value": "aa1a83dff3ac0fce118f60a707866d56", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625012, "uuid": "484093c4-a502-438e-9acf-eb4a78dbb475", "comment": "Malware payload", "value": "10654c9f23e92f2ccbc542229c9a06614b205a6940e8271d6b592888223f1315", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625012, "uuid": "8aa629b7-98eb-4870-be90-5b824b34eafa", "comment": "Malware payload", "value": "42332239947252b7ee007771391205c7a4436c80", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625012, "uuid": "8dfb13ed-1d96-4446-925f-7ab26e4de963", "comment": "Malware payload", "value": "4a77ab3deb56cf93f5b93cf81c50283879c5c38ec7a6f979ce9b795d659d5155376c696deaf9254e5f068a7649a32ece", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625012, "uuid": "2eb317c6-6c99-46af-8c0d-eb7b3a93c5dc", "value": "8583021163B9C998F58DAE2D4CE30D8F3F42A9B41D1ED9F2622D0199A227C964F2053F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625012, "uuid": "775119f7-c197-4e40-b425-e2da5c06b500", "value": "1536:SDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2qiX:SDAysJADlV378P3RPVJLdCqXjio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625012, "uuid": "1eb2214b-5b09-46b2-92a5-ed6f74f5793f", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625012, "uuid": "8fb0718d-c452-4a9f-baf6-005fb0764381", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625012, "uuid": "c40735d9-af43-4b77-9126-93801cc2130c", "value": "statistic-1165287844.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784d6ca3-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619881, "uuid": "d1a68027-cfb6-4bcb-971e-821fe0266da4", "comment": "Malware payload", "value": "8f4fa4dc62601751c94af3071f5b95e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619881, "uuid": "da2d667e-2615-40fe-afde-18a8e6891bbe", "comment": "Malware payload", "value": "107b29933279a9b2c702e654750e0746f84b4d463f154d3992f3c2a90c4e2242", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619881, "uuid": "fde17e4a-f7ba-43ed-ad1c-0cbfd16ab1e8", "comment": "Malware payload", "value": "ea368dc2f60acff6694c74a2559f42a227e0f020", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619881, "uuid": "0d9e33fd-3b1e-4014-9fb6-09e28a276b56", "comment": "Malware payload", "value": "4576c1b8de84252de2b39b8d22ed6c9b3ecc5cb9af2e95833cca3f6381168f2b32ae198be80ee2869b5a30273a5db5e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619881, "uuid": "c113c3a0-6211-4780-8b65-39f057028a2a", "value": "7583021123B58E0CB9CE9F1958E21ECB2F97FDB4260D69B5611904D5EB22C074B28A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619881, "uuid": "057d47cb-b652-44bb-8e0a-88f7de2d2b9d", "value": "1536:BDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdaDpZP9+jAJ19J:BDAysJADlV378P3RPVJLdaDpH+jAJ1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619881, "uuid": "7447824a-d047-4c71-9a61-4d8382e073c2", "value": 86106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619881, "uuid": "8a84dffb-c6f6-40ec-975d-9d8a3c974cd3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619881, "uuid": "079d624f-5f39-41a9-9e40-d12ab744269e", "value": "catalog-1598676819.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3ab1cc-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626623, "uuid": "e64153ec-3093-49fc-a90e-e9c239bdf5c9", "comment": "Malware payload", "value": "daa23e214bba02b21d38e07b3027c639", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626623, "uuid": "b3aff89e-0ac2-4997-ac90-27fe21814ae9", "comment": "Malware payload", "value": "108de3c1a613817f9e88cbf7047438f159d2f414397edea955e7947d3d47a1ff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626623, "uuid": "ce236715-cd13-492f-9ac6-22413e17598d", "comment": "Malware payload", "value": "6758f7ac5695bf7eab9fe5577e962bc4e832cb67", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626623, "uuid": "73ae45d8-4834-48c1-961b-02f1f592c98e", "comment": "Malware payload", "value": "d6ee2b5156c7c29344f8d7a14709cacc4c1472cac6fbcaba50f3d0ae7b273dadf871b5bb7f63808bbf58617e0c5dc958", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626623, "uuid": "3cdc2ed0-30ab-416d-b514-e459c1b9c815", "value": "0E83020413FA8919F48F9E3DACE20D8F7F9AF6B12D0A58E1966E0455B32AC511B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626623, "uuid": "68d25dd0-2780-4dbb-b371-d0e15215bc2c", "value": "1536:SDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBA:SDAysJADlV378P3RPVJLd/eh8wBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626623, "uuid": "046a88a7-fe8e-4fb5-9621-42350262742e", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626623, "uuid": "cdc604f0-0482-4061-8c5c-303e4cfa0655", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626623, "uuid": "e241681d-d4bb-4ec0-b871-d619a95e1296", "value": "statistic-383991206.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5c2415-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627402, "uuid": "9ac5a951-eedc-4ce4-91b8-45e1845fec27", "comment": "Malware payload", "value": "62df6115cd7a04bea9c06e529f1a5e74", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627402, "uuid": "f2b92667-e81f-4be1-ad16-b2207a2ce030", "comment": "Malware payload", "value": "10988243727253df367d13b2a263c8b94f8589742708fd90624d4da4638a8214", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627402, "uuid": "8dc37614-abd5-48a9-8658-d99e541ba7f3", "comment": "Malware payload", "value": "2022415f34f9bde2d326e88b73798c5d0175a269", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627402, "uuid": "d8c1e9d6-1c07-4b75-ab5e-6981caeecc73", "comment": "Malware payload", "value": "0696a9107dd4ec32fe06ecdd4aab52d053197f97eac4b5b2ab8e49d68733cc08df09fe227b882d21eef0478b7b1f8597", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627402, "uuid": "463c8111-f71b-4ce3-97d4-473976233ee2", "value": "758302A443BE5A5DB84D4E29ACB20D4F3F66B6343D0E68F1B92D0485A331C561B24A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627402, "uuid": "aff98d43-cbd2-4b87-baa1-6abf4ec89932", "value": "1536:FDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdihsMnSEwJPTm+qk:FDAysJADlV378P3RPVJLdUxpE99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627402, "uuid": "58ad3490-77ad-49da-bf35-7006b62a102d", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627402, "uuid": "cd6bde4a-4448-4b4b-b055-5b6c22da42cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627402, "uuid": "f65e30da-f570-4822-937a-ba0f5cdc9a9d", "value": "statistic-916859557.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcab92d7-a7b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619568080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568080, "uuid": "aa98e975-0fc8-42ee-bda4-fdc67902ff06", "comment": "Malware payload (Dridex)", "value": "d8d7b304c7e60b771d4764366fd5ef1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568080, "uuid": "82dee696-af7a-4fef-b41a-3492b28052e8", "comment": "Malware payload (Dridex)", "value": "109d3fde7137db029fa4601aaa7a68e30912bde03792ea4a49b053fb1dc471f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568080, "uuid": "f7e60ff1-dbe4-43b8-8440-305bd5d0f6a5", "comment": "Malware payload (Dridex)", "value": "f3115ab638b2b27fb3cc06d84db7cccf0d5e6478", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568080, "uuid": "be1ac0f8-9a3d-4ed3-992d-3d3310a3a521", "comment": "Malware payload (Dridex)", "value": "d430c6f124d931b43207428668bfa52655a7c11a44f6cbca666cfdafa15d2a47254b1b28166729fc82f352091c2a6166", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568080, "uuid": "5acc1f18-d446-429b-a560-4ad461b09bf7", "value": "71F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568080, "uuid": "f3f2d045-a6bf-4001-9741-45d55070b849", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568080, "uuid": "522c79bf-9035-44e7-a4f1-fdfdbb00860f", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619568080, "uuid": "9becf459-9e66-4916-82e2-1e6f60ef8e3c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619568080, "uuid": "6e1c33b9-be77-4f0d-b5cb-91efe2f34773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568080, "uuid": "4ae360d5-e7c7-46fa-bd08-f661c6742539", "value": "d8d7b304_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bb3fea-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624327, "uuid": "04d9ab77-59a0-4706-a8a7-d4b4e00c1c22", "comment": "Malware payload", "value": "13c2d10b744887c6afad5e9189488d9d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624327, "uuid": "039aeb39-5d3e-4f34-88e3-c7b80db4c12d", "comment": "Malware payload", "value": "10a5cbb8f5ce5f47d726e171b7290552d49316f6c866b8ad0edc3979685cc994", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624327, "uuid": "5e4c7c33-724e-4fb5-a5a4-7e041330a1e2", "comment": "Malware payload", "value": "aab62e8d40946b4cebe6e448cb79d2cc79bc3006", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624327, "uuid": "07fcab34-215a-4e95-97f0-0fa5ebb81365", "comment": "Malware payload", "value": "33f02aa50654dfc8eb5bd156bb146593c7a9f25569bec795a751cae5dafaf47cc033ecc25ce6b51b5da921fcc7c42aef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624327, "uuid": "e931ee86-c0f9-42db-a3b1-d855a65797a7", "value": "E383028C363AC2EF717D6D08A5E88C3F6A0EED792044749DE4C06A67D849FA70E57530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624327, "uuid": "2900c977-0574-4308-bfbc-7436897c82f1", "value": "1536:cG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttBsujryI8bF7:cGEhrHJoEsBMG7qzkSI8bF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624327, "uuid": "1cefe16a-fd38-4f6b-aed0-3311e70a452e", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624327, "uuid": "59ab6783-e1f7-4ca6-b902-5a4422c90c49", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624327, "uuid": "30f2ac21-bb6c-4098-8d27-ab3416571f4a", "value": "diagram-69070836.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1be70bf-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646284, "uuid": "d0154ed7-4273-4c43-b6d7-42e797c37b57", "comment": "Malware payload (Dridex)", "value": "1ff55180bbede364cfe34ec17bf52689", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646284, "uuid": "e5423c03-6358-4d71-afff-af825c226c9f", "comment": "Malware payload (Dridex)", "value": "10ad884b4e173c5d90aeda1753996860a305c7e9ccdc9abf91a64544bd26a59c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646284, "uuid": "3cd6cdcb-a7ad-40ef-a707-cbe6757dcc64", "comment": "Malware payload (Dridex)", "value": "15d937e251e8dfb06a4383eaa4413f3fec288615", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646284, "uuid": "593ad779-7c5e-416a-a0fc-2550fb36fa34", "comment": "Malware payload (Dridex)", "value": "acea0ee8b4e6eef6faf60cba6c1481444d5e77538c6ba69323611d0ca655ac0e5265b088be48cb0ef25fe275dd4bb206", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646284, "uuid": "6daa6092-7ecc-4a00-b65b-8a6609c169b2", "value": "17F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646284, "uuid": "02ee6f0a-683c-4099-b94f-d4bb02627770", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646284, "uuid": "ff476b6e-468f-4b2d-be05-0b8fa277cc63", "value": "3072:XnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:ay5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646284, "uuid": "2ca5fbd3-edd6-493b-890b-fbc0f4c6a235", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646284, "uuid": "ecdf77ae-5d2d-4fc3-bf3d-06effac658b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646284, "uuid": "ecfda514-48d6-49f4-9d81-22e769ab30aa", "value": "1ff55180_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eddac10-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621180, "uuid": "5d35ecd6-a9ef-4a1b-a113-92c9787d8cfe", "comment": "Malware payload", "value": "5a6277a6912a020d2cc12cc79438706c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621180, "uuid": "9975785d-df9e-44e7-8b59-3294f34f5ddb", "comment": "Malware payload", "value": "10b8da46bd3e4888648e044e3d6f96cb8b21c7da10aaafd591ff8e585ddf0d2d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621180, "uuid": "e05d9914-6cc9-4dd3-8086-1a815baacf47", "comment": "Malware payload", "value": "f2170e6db0a8c2b29f2d8f3a0a1392719df0b141", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621180, "uuid": "441844b7-a5e2-4496-bb05-8ef9ca771446", "comment": "Malware payload", "value": "62cc13be1ab113ef67616a70615d0fa48e88ae69ae148d5a797d4ed05820d7301783724a4efcd2c2071916f269a909f1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621180, "uuid": "e966a65d-cacc-4a4a-b7b1-f8197c2aa4c7", "value": "E783025413B94A4EB8CE8E196CE31E4F2B9EB8F41A2B55D1795D00E1A2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621180, "uuid": "1ba31b1a-9572-47dc-9eba-1890b9bfc954", "value": "1536:dDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdnIkGV8BAY0wIV:dDAysJADlV378P3RPVJLd68BXyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621180, "uuid": "febbf37e-6fd5-4383-b6ef-57ee40614257", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621180, "uuid": "57f41559-fd85-4236-b038-1f4e805c19fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621180, "uuid": "d205f07c-1bda-4f03-bc81-a4cb5eba6a5a", "value": "catalog-446928335.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a986a48-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624931, "uuid": "fbe925a0-f3eb-4fd8-a914-9cd16dc90001", "comment": "Malware payload", "value": "9d7dab46b81ee0f719dbe4cfcbf943a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624931, "uuid": "51bd457b-dc90-44e5-957e-461a24cf6982", "comment": "Malware payload", "value": "10c2890cd4f3e369b8cbc2295129f130206b3fb41030e5d46d60c9285588a907", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624931, "uuid": "801956da-a645-4bdc-8185-863595d109c3", "comment": "Malware payload", "value": "f954a932fc777ad38cbb4c7873ffb54bce7d0dc1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624931, "uuid": "be54cf88-a45c-4af9-abe3-c063809238a0", "comment": "Malware payload", "value": "4e1d6e0d77173653e0a9310410a3621eb45d7106d090dfe52e94dd8794f1f7a7c3cf15e777f6f579209ae25c0a50c945", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624931, "uuid": "aba4c039-d944-4379-bc21-5f722d09a65d", "value": "F983020413FA8919F48F9E39ACE20D8F7F9AF6F03D0A58E1966E1455B32AC511B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624931, "uuid": "02c64498-5ecd-4239-b683-fec0ecdc72b6", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBN:zDAysJADlV378P3RPVJLd/eh8wBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624931, "uuid": "73418e57-7e9e-4dd1-b9f3-be9266d95c75", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624931, "uuid": "de9b76c9-32f9-480a-a367-2385eab07eb3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624931, "uuid": "9a75043d-d1c1-401f-90d2-c8e91859cef2", "value": "statistic-1104079397.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f5c1b1-a841-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619628304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628304, "uuid": "95541e9c-e0d3-44f7-b84a-52152b3a91a5", "comment": "Malware payload", "value": "62cdc7d02c332c4aae1b3aaaba8386ee", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "SysUpdate", "colour": "#789CBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628304, "uuid": "fc4b777f-4684-4f00-a23b-8530264274a1", "comment": "Malware payload", "value": "10ca2b47daaadb716b12a2b071de01e86c902e11263dc39e396be642adf369ce", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "SysUpdate", "colour": "#789CBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628304, "uuid": "7a55e584-8e90-41c7-bed5-0381260b9300", "comment": "Malware payload", "value": "cba27fd14118708936ec0996e6c7ba031087752a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "SysUpdate", "colour": "#789CBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628304, "uuid": "9ffff507-9c42-40ac-aae9-d02f50fbdaed", "comment": "Malware payload", "value": "f52f1ee23865f6e9cda3879d83c90daa8206f9533123b5ca3a8ab4bd162b78a5d9ea22a17a83a713739225c8684a5f07", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "SysUpdate", "colour": "#789CBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619628304, "uuid": "e241917b-967c-47fc-974a-35f205f1d8fe", "value": "2E5422250A983CCB7F60B9C47C8DC0B7F3F974E11E26B25443BB69A61A29D982FDD144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619628304, "uuid": "b8755658-5fd7-4900-89c0-f7dcaa610d4f", "value": "6144:vEV6xmRB1bybdPOPJTDX6Gil+1Y1SvKZ/GyVd1CBgGg:vEV6xmBg5POxf6KSZ/GyVd1Ciz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619628304, "uuid": "f17c1a58-6a0a-4992-8b65-e32c8cf47dc5", "value": 294277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619628304, "uuid": "335e6392-96c5-4180-a46e-f95bfeafccb3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619628304, "uuid": "75dadf96-1e48-4a18-bdf7-36e2687467e4", "value": "10ca2b47daaadb716b12a2b071de01e86c902e11263dc39e396be642adf369ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9fe641-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620133, "uuid": "0d57d97e-34e9-4d47-98ed-39b61edf5af1", "comment": "Malware payload", "value": "3a524d9c89596ccb9753c33aa8ba4cda", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620133, "uuid": "d136c770-d8c0-490e-bc47-731c565d6aa1", "comment": "Malware payload", "value": "10d9dbe79650a120ebe46cea65de943c99cc24abc297623d50082b0024543ccb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620133, "uuid": "9beb8bfb-9422-46fd-b6d6-f48ea38763de", "comment": "Malware payload", "value": "2be63c05dea8195be866cb93bb98d03d3ee92758", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620133, "uuid": "4b5f749d-4de2-41a1-9aa0-4c7174259c52", "comment": "Malware payload", "value": "517b0584758e5bc49d945bf7887dd3e91d07b923ee9d3661b7f143bb318b2598d532039ec5fd7e9fc3a725a2d7505c2c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620133, "uuid": "25c7468b-42b6-49fe-b443-a1650ea2a492", "value": "9E83021013B54E5CB9CD9F295CE20ACF2FA7F9B4260968F571280894E726C574B14A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620133, "uuid": "aa066081-69e9-4f47-a61c-b1b9c80188c5", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJU7L:0DAysJADlV378P3RPVJLdYDpH+jAJU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620133, "uuid": "142b2890-7927-493d-a4c7-de1cd773ff43", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620133, "uuid": "8633acc7-004e-4a51-bb4b-022b243e5955", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620133, "uuid": "03cf1e1d-daeb-4aea-b887-da6edc7ed087", "value": "catalog-1790879745.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34ca2b5-a7b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619568037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568037, "uuid": "dcf0396e-3783-47eb-81d8-db13ec4aeb80", "comment": "Malware payload (Dridex)", "value": "432a2324b07cda074d0b583638145cc4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568037, "uuid": "9bd0950b-0adb-4751-8110-038e46d0a675", "comment": "Malware payload (Dridex)", "value": "10e4bba151cd754f3f7986503def8075446a6944dbbdfdccacc42d2b5b07bb8a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568037, "uuid": "5465ee9e-3b57-498c-9c0e-a1eb2bf82e6e", "comment": "Malware payload (Dridex)", "value": "883ebdb35dd6e026bc2b3cc95981140a3a59ce2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568037, "uuid": "dd809fd7-4787-4fc5-90e7-ac086acd093c", "comment": "Malware payload (Dridex)", "value": "5cadfe9c32bebe5ea135b44378e563f6996ceae152e0ce6516fd919c1dd65e65119f34c5a0600f3ae23a7ab1b539e5e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568037, "uuid": "2fc9972d-61c0-48eb-9885-6f9352784f7e", "value": "47F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568037, "uuid": "a06ad969-5cf2-4f54-9004-339acf9f33e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568037, "uuid": "65e5ca44-c940-422e-b5e3-7a7cd96f3d49", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619568037, "uuid": "22cf8103-59d8-4c7d-86ef-ed01584c824a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619568037, "uuid": "d5c9c5d1-e0c3-4b1a-9069-9c2b4039f012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568037, "uuid": "6bd02411-7d4c-4466-b733-5946d118e48b", "value": "432a2324_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f172db-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622727, "uuid": "fda4ef57-85be-43b4-a280-0293f2904893", "comment": "Malware payload", "value": "f836f43e549bb29fa2ca9dbb9396d79b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622727, "uuid": "d6d8fb52-66d9-419e-bace-a077247a0c13", "comment": "Malware payload", "value": "10e697ee6914dafac7859eb2f5a25e95dbf41ebcf7491e231123d0a96329b575", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622727, "uuid": "5e56ca8c-ac0f-4d2f-be0d-a651311138fe", "comment": "Malware payload", "value": "07e125e11d5ef597a324b09d36878a5f97a0bda9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622727, "uuid": "012c3ce0-5b85-42a9-9f11-136b1be2f793", "comment": "Malware payload", "value": "d730f02c8e6aa0352abf780f8f736099f0d1890b5c99c2fcf2f1aeab93c67c7a01f65ad3fcf3c887cd2393943830d5e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622727, "uuid": "835f74a4-2427-43a1-8e25-6e24ceb4d138", "value": "B583028C6339C9DF727D3E5A62D8C47A6D0E98BD3004249DE5C066AF1D899F74CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622727, "uuid": "b11edd6e-5f2b-4101-a366-f855dd70bc7a", "value": "1536:XG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZDEVejoGrkAK:XGEhrHJoEsBMG7qzkHEVerrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622727, "uuid": "c31a14f1-11ad-4774-9471-724d56420968", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622727, "uuid": "0431f8f7-2db1-4abb-9879-ed928f7bb56e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622727, "uuid": "00eac19f-44a5-4189-a903-286cb8f0e2cc", "value": "diagram-1598024036.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb8f249-a867-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619644883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644883, "uuid": "57082b55-1f4d-410a-ad73-6253f68acda2", "comment": "Malware payload (Dridex)", "value": "ce210b0493418e0dddf2b7cf71412aa7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644883, "uuid": "b90ff4b5-c754-4701-9cf4-e90dad800428", "comment": "Malware payload (Dridex)", "value": "10efcc5e867ac1cc3018110a5a6226540c7128d20fc0d88b7d9f1d559474c05b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644883, "uuid": "6ca1efcf-b60f-45c7-a55c-572ac638be07", "comment": "Malware payload (Dridex)", "value": "e2c147bc5d55f8594d9b1545bd90b5e587510058", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644883, "uuid": "94ea95ac-9b3f-404c-91da-bcbf7c4f4306", "comment": "Malware payload (Dridex)", "value": "87d308fe444a2ff6bad4b1a49ffaa4010da9d8b6bdc01e7838edff058f4643195ca7cf1959ad407a34b4c847e3f3ac40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644883, "uuid": "a803dd03-8ed7-46eb-9dba-4be553cd8d6e", "value": "33F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644883, "uuid": "775aa819-52e4-46df-9bb4-cf855b3dd511", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644883, "uuid": "4a2ceb8a-dbe8-4c79-971d-0f8a7db88241", "value": "3072:KWSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2NGkFY:XnS62Fl+pkeJl3CvRStrFl+EYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619644883, "uuid": "00b48e02-2551-4b85-9e7a-3f23682e1437", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619644883, "uuid": "9cde3d68-73b7-49e7-a928-022813d54bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644883, "uuid": "a56eb0e9-8eb0-422d-9cf8-573989fa01bc", "value": "ce210b04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0818f5d4-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621840, "uuid": "11f3048b-7e68-4f1a-b634-20305c4dd82f", "comment": "Malware payload", "value": "f1b9fcd77c0e2106e775b0ff46201020", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621840, "uuid": "5537e268-c61b-4e49-83ee-9ea5d838a243", "comment": "Malware payload", "value": "10efda098292db43c855596a6aa88a44925dd9a12146f129f9cfc455b3f8e0cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621840, "uuid": "29c7f9fb-0316-4a54-a5f2-9b038dead2b9", "comment": "Malware payload", "value": "742a1aa2825d3fefee3e9105a67518ca6e029a6d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621840, "uuid": "66e575d9-0b24-4db7-a012-9183b6912018", "comment": "Malware payload", "value": "6db1da7155fddcbc06456e2c7248043c1dc3aa4b3d76c3957e3568c4d28a690f120a96d1cbe4bd8d2d9be1f1b0ea964f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621840, "uuid": "92d701a0-0862-47bd-a851-6a326c6120e6", "value": "9F83027043EA4F4D74CD8A3A5CF21DCFAB6AF5B43A1D58B0566E0461D223C962B2853E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621840, "uuid": "30cd4537-b84c-414b-84a7-206d2c0518bd", "value": "1536:lDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdRE58VP0IsOzCy2BXcEnvxx:lDAysJADlV378P3RPVJLd258VnCy2BXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621840, "uuid": "494a6f32-1ed3-462a-a4b2-fdcfb2e94ef8", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621840, "uuid": "47efff38-27a5-4a6f-89fa-1a5251d7360f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621840, "uuid": "f3f40cc0-3999-433d-a894-30115c7f9773", "value": "catalog-960869891.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6597561-a877-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619651794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651794, "uuid": "8afc5331-53f3-4369-8382-e009556351af", "comment": "Malware payload (Dridex)", "value": "fb75e65f6cd48457d4c101b09a4888de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651794, "uuid": "0b784bc2-772a-4f32-9d85-5858cff9d052", "comment": "Malware payload (Dridex)", "value": "11059f204a977cc9f3c86e26a427d87be870baaecdf2fecdab02f707efc1b437", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651794, "uuid": "40547a7e-2001-4059-8d37-43b686221349", "comment": "Malware payload (Dridex)", "value": "7e1ef1e4a59a166c898cb04010adf84778487457", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651794, "uuid": "82dbb9f0-5292-435b-84ea-7c59c3a8f7f1", "comment": "Malware payload (Dridex)", "value": "9552852007d28d0ad78a63d2791f56f8b9cdc62b85f55e297a858f804d5d870130415015056f88fd77cff37aee582bb2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651794, "uuid": "70ed5c3a-d3cc-49ca-98a8-b7de63fca9d8", "value": "8EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651794, "uuid": "e0601e84-4815-4612-a8d0-81d1e88799dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651794, "uuid": "e37130af-8ff3-43c9-bfb0-6c1d1d4f43de", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619651794, "uuid": "bacd8c3f-6cd1-411f-8216-e383c3e89de1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619651794, "uuid": "619c3641-bc4d-4ec0-9538-37d78d34987e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651794, "uuid": "ed3b1171-4309-4257-995b-7699519075c2", "value": "fb75e65f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778ddddd-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622456, "uuid": "85a55fa5-96e1-4151-9991-687aa4b2ac3d", "comment": "Malware payload", "value": "1c4bbec21de35786eb9f6a151a70ff42", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622456, "uuid": "4298c1a6-7d5a-42fd-9097-dd340b7bf015", "comment": "Malware payload", "value": "1106d6b757a4c686b928ddc30f59ff39447150b4ec98c786649a3bbb7abf29fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622456, "uuid": "033e4364-f78b-49ce-a90f-6a2cb493d196", "comment": "Malware payload", "value": "c0e09378806e4bda8f83713e423e7617cbb92ddb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622456, "uuid": "01c5bbe8-26fd-4f3e-907d-a322a3b33528", "comment": "Malware payload", "value": "bcf727e94f1b55bb2ce5cbbc475f953cd0efb06170400aa3a91d6958b722785bd7966b77098dfa3e3504918c45d75989", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622456, "uuid": "f506a353-25d8-475c-838a-5bd10fd6842c", "value": "0A83028C6239C9DF717D3E4AA6D8C83A7D0E98BD3040349DE5C0669F5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622456, "uuid": "b8c8e654-000e-4907-a2d9-5d5596c0220c", "value": "1536:QG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGr0:QGEhrHJoEsBMG7qzkEEVerr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622456, "uuid": "d28b9c45-d6f5-491e-a405-7ec213f5f8a3", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622456, "uuid": "e7c1f1ce-9c82-447c-88cd-4dee183e85ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622456, "uuid": "f53b7668-f21a-46f2-839a-b7332282b303", "value": "diagram-1389397273.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29fb5f1-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626099, "uuid": "dd305872-848d-41cc-bbcc-84c1dbdfe396", "comment": "Malware payload", "value": "c3a2d15a94548da6c61287278290c73f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626099, "uuid": "cfa2016a-ff2c-404b-95ba-9466eb8017fb", "comment": "Malware payload", "value": "1117c037a09951d9188fbe835b19ce4d690e4326b8db83a9c9b05a56d770fb93", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626099, "uuid": "382b8199-816e-44dc-b393-8f75e81b9f54", "comment": "Malware payload", "value": "37d9fa55ad46ea0e15ccd4ff974eeaf6c778e59d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626099, "uuid": "e5b07f6d-7b9c-479c-9169-5a760b58c3df", "comment": "Malware payload", "value": "ef2b26949c1edf2a0d785e4bd4c1f6fb42eff1da5c051567a24b9f8c3f542511cd77ec887a41ad5f9a20124131ebe9a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626099, "uuid": "09f16fa2-59a0-45eb-aacf-c8f8cf183f9d", "value": "7783021823BE4958B58D8E2D88930ECF3F66F5B4281D58A2B55E00E9F227C565F34D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626099, "uuid": "203ab77c-4a83-46e0-baa9-0d6bc8ff51cd", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdA8eTrIarVAN3/B1eM2O:DDAysJADlV378P3RPVJLdzau8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626099, "uuid": "7cdce50f-73fe-422b-9657-0b5fb5cc3181", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626099, "uuid": "53b94672-ff98-4aa4-9406-66cb2b05b4ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626099, "uuid": "7750aae6-9af7-41bd-807c-a4b183d7b910", "value": "statistic-195514235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcc1a06-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626305, "uuid": "ed15345d-d0b4-4da8-85b9-20df7df37b1f", "comment": "Malware payload", "value": "eebab07ec0f276bfff07cfc3f6d50387", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626305, "uuid": "0d5ee09d-7e53-4b8b-b16f-a333fd061095", "comment": "Malware payload", "value": "1120a2f9649eb572ab3b8e90f3262509b887c765d3432436765fa4db480c50a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626305, "uuid": "80e22cd7-084e-49fe-838b-3ed1e064d5c3", "comment": "Malware payload", "value": "e60d4f8ebb1e22bdb5e6f03901b2e0f9a0cbdc9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626305, "uuid": "a6e66a41-e6d0-4afd-ad2a-14deb615ebb3", "comment": "Malware payload", "value": "38475a761d304cd54bebb095234faff4441cdd476b63f8941cc0fe6f41d62054b00b3e568dfb14fd63fb91b717778fd9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626305, "uuid": "68e14b5b-1102-4c3e-8640-356e673a2ba4", "value": "2D830250537ACB19B5CECE2D8CD3198B6E9BF9B42A0E5CF1A12900B5B7658051B14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626305, "uuid": "504aca15-c03e-40ba-8566-0799429a7355", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd2/8oZePFOLVEr0xkvUlsT:XDAysJADlV378P3RPVJLd2/8oZeUM0eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626305, "uuid": "bfa3373b-2c75-4369-955f-2004a92e72b8", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626305, "uuid": "bd6c9a89-9e63-4fd8-a6bc-f26aeff4109e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626305, "uuid": "f98d4ac5-17c6-476b-820b-384084598454", "value": "statistic-2125037770.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07c76e6-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622122, "uuid": "d65f072a-c2ab-4973-8357-1eecd325b87f", "comment": "Malware payload", "value": "a4b51f7d6da06467521a78b047203b81", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622122, "uuid": "aad35043-9e0f-4464-9d25-ed8691fae4b3", "comment": "Malware payload", "value": "11408112b81fd81f65b560bebb71c3d6cd695172baafa69b021a1723df588254", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622122, "uuid": "4b3d4b8d-0b96-4d9e-9da0-86c4ffb835f7", "comment": "Malware payload", "value": "66c9f79165b981184aac7404b20b74315487cfd9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622122, "uuid": "4bbd30cc-3a6c-4c55-844d-feff3df02d6d", "comment": "Malware payload", "value": "48ed3f124091b19e3200da27b5753a81d60a51cc5a8bb2520fda858709486da35b5aa6ce79f41a8008352942a9d18aa5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622122, "uuid": "04afe388-3c3d-46c0-a2f6-0eb7e078bd74", "value": "4A8302C9203DC6DF71BCAA09B59C893EBD4D6CB4210464AED4D4267EAD8DAF79C93430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622122, "uuid": "3dd8a966-e71a-4cea-b821-96816e8ec8af", "value": "1536:lG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttFI5EzJKE9LfFSp7mSV:lGEhrHJoEsBMG7qzknI5AB5gpSSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622122, "uuid": "3a058b45-b25c-449e-b9fb-077fe99cced0", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622122, "uuid": "533d23a3-357a-4226-a436-7d1772959ca6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622122, "uuid": "bbab4f1f-0921-40e8-8a2a-0202b1611b19", "value": "diagram-1149591292.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1c27b4-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625979, "uuid": "855bb608-f57b-4e51-ad89-15bd4c7db97f", "comment": "Malware payload", "value": "730bc8757a8d73600fa6be6772ba520c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625979, "uuid": "9e08cb6e-acea-4e20-a75b-56fa28527c9d", "comment": "Malware payload", "value": "11494d04909aff5962e06a9733bff8be54d60a1b6cf8e64bb2d188ff92d41b0e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625979, "uuid": "b3548fdc-3290-4571-b12c-ade15fdb3c0b", "comment": "Malware payload", "value": "e51e4fc9656f1991d7801eee8de0e5647c9f6eff", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625979, "uuid": "35e1a961-64fd-4ebf-a813-c3d96b8af45d", "comment": "Malware payload", "value": "217b34236f541dacdffcbe2f5024258f81d824362d60b7ee3dad3f4b6dc1e5d46b99a1de564ac37210e43acb6548b093", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625979, "uuid": "493fb61a-d9f2-4477-8303-c0503507aab3", "value": "D68302A053BE4A5CB88D4E29ACA20D4F3FA7B6743D0E58F1B92D0485A335C561B3493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625979, "uuid": "92f6e3e4-5d7f-49a3-991d-ae7d2c5f8ffd", "value": "1536:hDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9hsMnSEwJPTmYlm:hDAysJADlV378P3RPVJLdLxpEzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625979, "uuid": "b93ee7c0-4484-4ff8-a251-d1d8d33713a5", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625979, "uuid": "582baea1-8ae9-4a93-8bf4-d0363772692c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625979, "uuid": "c6d0b9f9-5386-4753-b278-f88bb735bbf7", "value": "statistic-188161939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae972888-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624696, "uuid": "b78f7d8b-77ce-4733-a3be-81038c7deb01", "comment": "Malware payload", "value": "79b85a8ef1f22f50b704a42639442cd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624696, "uuid": "9a1fc553-5d8e-4f15-b975-91bae0bf8afc", "comment": "Malware payload", "value": "114a09330a38d61619d2f4fa600e9d7eaabee4c61b659e5b9d866793655aadf5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624696, "uuid": "c72aa33c-07e9-4327-b738-d3d172d766ba", "comment": "Malware payload", "value": "5daf15ef23f154ab2320c920c5add60f6248ad86", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624696, "uuid": "7bd8619e-4a18-4ae4-b388-09cfb5bafd47", "comment": "Malware payload", "value": "ce5f4d8411417a1d3a198edb8e4e0ad0fb3af93343639a39e7e931d1bc0b05e2a5d3cf9bec79587cd8010c8041ed937b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624696, "uuid": "26c3ab9f-f755-4716-b634-7f999ebefe3a", "value": "3505239D72B6120BF7CF7DA747A0D9C7CBF916144E1C02B84C0B95068A6787AF2E29D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624696, "uuid": "458145fd-36c1-4c9d-9a40-9dc3883d0e3a", "value": "12288:Nq/alrzgXTq7JOaKskArz9czRcuOrcrBLl4lzNFYwGz+en0YMIaEabAzuYFn85Bo:Sm7JOpArzGz1CGzTzxG+8fJj5XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624696, "uuid": "839f3797-32cf-4eb8-b725-06c5e6d9f217", "value": 803431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624696, "uuid": "f79cab92-818f-4277-946e-4ce552354043", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624696, "uuid": "36d90bb5-6f5e-4b11-a45d-7f4cae82557f", "value": "1619426678.Vfc11I226592M38643.dynamene_invoice #18771140 pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78bef85-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619208, "uuid": "2463f761-4b42-4ce7-94bc-d75fde646644", "comment": "Malware payload", "value": "f8d118d721d7792e9762d0f60aa29aa5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619208, "uuid": "42663d40-5d53-49ec-8af3-089a42981f2d", "comment": "Malware payload", "value": "114fbac69bf243e1b2391879735e2254256c878aa18aba79993c9f39fd2ac366", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619208, "uuid": "401dbfe9-6b70-4f8f-9d37-1d7b8bd6ba68", "comment": "Malware payload", "value": "13c1b54024a9628e4d4897f0751a8f14767ed7fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619208, "uuid": "b59be460-3d97-4047-a8e2-a7aaff520c17", "comment": "Malware payload", "value": "debac5cfdb6291e8058f6b8d590656729ceb3635bfd805838b0789eed9cce3d1f85f1c99f90acb2f4b1f6f4d8cd62992", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619208, "uuid": "471b3fb0-0b20-4db4-8f03-d6a27edd8abb", "value": "9D830210237A074CB4DD9F2A5C731DCB6F57BCB82509A8F3905C04A8F6238536B2897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619208, "uuid": "9d281f6f-bd6b-4562-9f90-ad718572be69", "value": "1536:QDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHR1EPCO0V:QDAysJADlV378P3RPVJLd/EP90V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619208, "uuid": "298b9f97-a69c-4d20-8c5b-a1cf7131e5dc", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619208, "uuid": "aeaabe78-c422-414b-94dc-eb7b34310b95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619208, "uuid": "4f9acdeb-cefa-4e2d-9ec8-fc7df6245c7a", "value": "catalog-1107225726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1004ccb3-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620135, "uuid": "979025c2-80ee-4abc-9fe2-1fdfc9458a39", "comment": "Malware payload", "value": "0b6f1943e87ea242495b84397cfa7be8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620135, "uuid": "be63f2d8-5ed5-4199-a026-f92c039df277", "comment": "Malware payload", "value": "1152bdd3e01b2bafd9f7ce1e54b2de5020eb3e72623cd1c89466dd5032eeda77", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620135, "uuid": "2d504af4-8c24-4d1d-b3a4-219658d80d6a", "comment": "Malware payload", "value": "a00d25c2ce1d6bda5a65086c2fbe4a5d48f5bb9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620135, "uuid": "32f3fd0a-df98-440d-afda-f0becd0c6844", "comment": "Malware payload", "value": "de63665f8142fd5900672c65fefa0050894c6ba32eaff70662ee37519c2d09f2a02af2a1d354d169de1f55f25740e463", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620135, "uuid": "179a6dae-61a7-426d-ac3c-4a2405528133", "value": "EE83122013F65F09B0CD8D3D98E25E8F7B6AB9B42D2E98F1516E0456F113C562B2047F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620135, "uuid": "02982144-4f98-4a94-a0be-113be5314840", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOK3F:XDAysJADlV378P3RPVJLd+Z8VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620135, "uuid": "39209552-d561-4f8c-a564-c00ccb2ea7e3", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620135, "uuid": "16d78fa2-00f9-47ca-b671-1c53f00b6d71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620135, "uuid": "5a53ba62-eb3b-48ff-9cca-3766faf3ca86", "value": "catalog-1792347202.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8777b380-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623342, "uuid": "0d68bca9-2ef5-458e-a013-d0a4378e5ab4", "comment": "Malware payload", "value": "9629cb9a5cc50916d35d739f6241da4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623342, "uuid": "54a3716b-ccb2-4e74-828c-50a184b1f15c", "comment": "Malware payload", "value": "115432659297f9e276d67c7726d938a72d0568c1674c471faa268f00df2b1b18", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623342, "uuid": "1fb0b971-9884-41d6-a653-40ff4f293f64", "comment": "Malware payload", "value": "423927112db664f2d9339f5a0652625e0e50f7f6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623342, "uuid": "a86d52fc-36e1-4c12-bafd-4e46bd40912d", "comment": "Malware payload", "value": "7069f3046e07a6fa7d48514d17a1d1270ddb2a5ed9984071ce56e6fd24754ffffd752f5f8af7852a4bcfc28bcc5486b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623342, "uuid": "bbfb0942-25dc-4a5b-a572-57c52c6c814c", "value": "BA83028C353DC5DF7AFE2E0592DC887E740ED8B43144154EE8C8666B9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623342, "uuid": "31df2009-a7c4-4776-a88f-751624c9dfbe", "value": "1536:FG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttfKkApVr6wo+RxR:FGEhrHJoEsBMG7qzktxApxTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623342, "uuid": "c142e5fb-4f72-4a70-b42b-991a82b90d75", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623342, "uuid": "b4722e45-8c95-4d89-9274-ec8299fa0f55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623342, "uuid": "c7f959dd-51f9-48a7-ba73-de4f538d809c", "value": "diagram-2024163271.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9120297-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620070, "uuid": "1dcdc67f-89e1-43f2-95a8-57d26ef628ff", "comment": "Malware payload", "value": "80d5c35302bb81dddc47558cfe539ab2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620070, "uuid": "ffb89ebc-5fe2-4713-8d59-45d46c68f7d0", "comment": "Malware payload", "value": "11678d41aa55c73738c22dc074084816b208fb3a8efbcc91e6bfcc584fc9a426", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620070, "uuid": "89a71623-648c-450b-a938-6d1a5d77fe62", "comment": "Malware payload", "value": "8a41833f12e3ec7fcc5e16094a3d7bd1bf33298f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620070, "uuid": "78f15641-1f70-4d97-b4cc-cf5a2c5f0b7f", "comment": "Malware payload", "value": "df09af43fddfa503f97efc248c0ab98bc50d0c19fed0471e48ed859dc38f5319690576b5b21526ca32df446392df3bb1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620070, "uuid": "659e110d-3f45-4749-a0db-e364f9cc98da", "value": "C383121013B94A5EB8CE8E296CE31E4F2BDAB8F4191B65D1794D04A1F2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620070, "uuid": "89ba929a-6664-4f02-986b-2d583b7e5437", "value": "1536:aDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wH:aDAysJADlV378P3RPVJLdP8BXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620070, "uuid": "09e02f8f-f4f4-46f9-8732-b4984eb14edd", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620070, "uuid": "80c364d9-7e1e-4a46-96aa-75d7948f58ba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620070, "uuid": "efc79689-3e30-467f-a1f5-b72646c50d88", "value": "catalog-174463623.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a8fcd5-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623096, "uuid": "28a02b4a-4ac2-4f57-8285-b24d25f0b205", "comment": "Malware payload", "value": "6f9117561a24334aa22f87945953f157", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623096, "uuid": "49e8ade2-e197-4f9a-bb8b-61e7a21837ce", "comment": "Malware payload", "value": "117560f6f756300b12ed004393e3407dd75f343b34f64ff3f25d3767cc36df8a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623096, "uuid": "8e921895-3e69-4288-a8c9-6759d91eb897", "comment": "Malware payload", "value": "82ea20765933db75c34a910d72e4ee662fef896e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623096, "uuid": "a40cdcc9-43da-4655-8c02-0b8713da85fb", "comment": "Malware payload", "value": "c92cb1f78cda48e21d1f44d9abcb36331079b8418d24a183945b166ecbdf433d34418cbea772bb463fc2a37b8aabd356", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623096, "uuid": "56be1abc-df66-4f87-b74d-960648116642", "value": "7683018C153EC1EFB6BD2B45B1EDC47FA50EECB47408248DD4C9266E9C89AA35C875A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623096, "uuid": "efed5f15-22f9-4115-bd04-ac1f07969c67", "value": "1536:dG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttB0ZKvCjFevNZIJldvfZ:dGEhrHJoEsBMG7qzkf0ZUOTJvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623096, "uuid": "6b9cec66-8a25-439e-9e9b-77124fa0153d", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623096, "uuid": "dc75482a-2de0-46da-aca0-7ba4fe1bff38", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623096, "uuid": "d6331a0f-ebc7-455b-b60c-12cd5fe6193b", "value": "diagram-1847823680.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7418ea1-a7e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619587828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587828, "uuid": "9895f2a7-3b0d-48bf-af55-8d7b5bc563e2", "comment": "Malware payload (Loki)", "value": "d1ff4cd9e354362a4a12b2f290bb918e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587828, "uuid": "d2a1e7de-0ed9-4367-8b81-e7d6b25dd8f2", "comment": "Malware payload (Loki)", "value": "1175f6cfd450932c6257e581e6eea18afb20b77845cdb222ecff626bc125c976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587828, "uuid": "90fa348e-8253-4b28-9128-e80e44cb7045", "comment": "Malware payload (Loki)", "value": "31d88cf9f4ce45890e7a938bf31adeba4fe385fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587828, "uuid": "5664d4d0-6666-421c-a64e-91b5bd785fea", "comment": "Malware payload (Loki)", "value": "9133afc9f9463c927b9244afdc6da7ca1f38c64951f2d50d6582864764881f8d7cbaf125003503dae6d6158304f48610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619587828, "uuid": "b25be14e-78ad-4e22-bc66-6cfbe6043dce", "value": "3E057CAC765469F0E3571E2263CF1C0642652174693BEA0E9F6013FD1A67F173E38D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619587828, "uuid": "3f7995eb-aeef-4a20-b863-0bec6c2ceed6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619587828, "uuid": "934e0deb-f803-4a4b-b859-40e1dc071317", "value": "12288:633ZJO+C3n8qgCHEQ+HmfA8zHFInktPsMuIoLLoS60/K7yh0:6DC3uC9+h8z+IoLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619587828, "uuid": "d38d56f2-fd35-4191-8d94-92bb561475bb", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619587828, "uuid": "ada03dc1-9e56-4abb-8ab3-5396d271a256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619587828, "uuid": "4ea09279-7a54-4b82-8768-f2b80459d402", "value": "Payment slippdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3728a081-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639528, "uuid": "5b2b422a-5f98-4a24-a21e-6e43ebd4ae9c", "comment": "Malware payload (Dridex)", "value": "819fc7441db277311c1a3c232fa839f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639528, "uuid": "7d277a2a-0ae2-4af9-8c17-f8b5f2ba19bc", "comment": "Malware payload (Dridex)", "value": "117bdd01457813e78f65ae8ffbbe293d216a7f0b4c53b05781d0cfe34198f666", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639528, "uuid": "071c77b7-7d2f-44c9-b899-bf2c72bd6bf2", "comment": "Malware payload (Dridex)", "value": "54cbf472aa8d43bcdabbdfc86b5370a68b2b9769", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639528, "uuid": "41b896bc-563f-4d10-805a-e31d5f743434", "comment": "Malware payload (Dridex)", "value": "f399a7a205c3c942068263f68bc8fcb5ce5764e10159caea7daccb112753ff1598684b9aa1570342c8151938f1d69e98", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639528, "uuid": "dbd2c6c0-e5b0-4e15-80d4-312bc64b57db", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639528, "uuid": "465749c7-cd04-4537-8eb9-20d6b7838c9a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639528, "uuid": "3e00d4f2-7593-4163-a9e8-44e642f802be", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639528, "uuid": "f6bceec8-bda0-42cf-b481-63f09a341a4b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639528, "uuid": "1a5c3e49-223b-438a-b6dc-2f5ccd5a907e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639528, "uuid": "75683410-1ae3-42f3-ba08-1cf7acfb9e8a", "value": "819fc744_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1353e8ed-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622718, "uuid": "7c34be67-2916-47cc-9476-3916b5063dc9", "comment": "Malware payload", "value": "ed1935759b22081dc037002535055817", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622718, "uuid": "a0434717-4746-4dc9-b925-e0f08f0da1e8", "comment": "Malware payload", "value": "1186b1f2ff9663986a764865492c2608de89f9f5146ff74cd6ec801dea4da6b2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622718, "uuid": "da317f1c-e6a2-458f-b49c-f05c3d8c57e9", "comment": "Malware payload", "value": "37ec8a609f15771180216438bb348c3b784fccc8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622718, "uuid": "db3dde3a-5f01-4d13-bd69-342c80009e04", "comment": "Malware payload", "value": "f2941dd2f469bb5e430cd80f0153d230ddd7421a05b6a69926b39bffe6388458456598e83cc2db5dd3e7c8143d650661", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622718, "uuid": "c30d83d3-380d-4275-a2c1-d69719f9eaf2", "value": "7B83028C3138C1DF37BE6A08A2DC887BBD09D9B53514385EC489655FAD86EBB4C9F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622718, "uuid": "7ad57595-3fe4-43d8-97b8-c6f3b37b8239", "value": "1536:SiG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+pbK:JGEhrHJoEsBMG7qzkZQxOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622718, "uuid": "db5e6d47-321c-48a1-b10f-b063efa639bb", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622718, "uuid": "7852a94b-6366-4546-8e06-24d7b0cfcc96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622718, "uuid": "5d9b1f1c-9732-4c0e-b5fe-ed27b4a9dc3d", "value": "diagram-1592554531.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd3acc3-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640692, "uuid": "ff26c31f-772a-4769-8288-3141211c15da", "comment": "Malware payload (Quakbot)", "value": "e298acc2423c296114e49d4d2f07cdc0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640692, "uuid": "aa4b7d6e-ff75-44c1-9263-7b4031bc6138", "comment": "Malware payload (Quakbot)", "value": "11870ab241e921b1ad56d6af8ec8371f0601e2da0980c6b7bf5b386b7920ff91", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640692, "uuid": "93a49825-f001-4229-a1d8-258d42b8e494", "comment": "Malware payload (Quakbot)", "value": "ae1ca21908466f13734f25460513120afa5b4e6d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640692, "uuid": "f8575827-8d36-49a5-8a06-a992185decf2", "comment": "Malware payload (Quakbot)", "value": "5ff2374bff726cfac34989fbd8d271336318667716ee38a2eb575174fffa4af90f78bd2b566ba963eeb34a00fac515c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640692, "uuid": "abcb5712-b9aa-41d8-bcf0-f4da597046cf", "value": "A7947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640692, "uuid": "4224f43e-154c-402c-b3ed-1f111a5ee3ef", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640692, "uuid": "130e8879-7347-4278-8e3e-f76c29b73c3e", "value": "6144:WyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm5:aTwr03pdf8vhhOKJET5By5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640692, "uuid": "3f6959ec-55da-48b4-bb11-5a2620b1655d", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640692, "uuid": "fbc01e54-fc28-48b9-9efb-de8e6714bedd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640692, "uuid": "a2c791cb-db46-4796-8377-13b4ebdfe35c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4447d31a-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625806, "uuid": "b29f70d7-a6fe-4bcc-bac7-fe79d2897e06", "comment": "Malware payload", "value": "55934a3d4498f0918498b5f49feb77d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625806, "uuid": "57ed6c89-04c9-4a03-8484-b1f1529e2cff", "comment": "Malware payload", "value": "118e97bd1d07e9ab31cdd914f0bd746fd2431e164785b32656caeadebaeef3e4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625806, "uuid": "dfb0697b-4667-4fa3-af1f-04e4c50514e9", "comment": "Malware payload", "value": "81e59f57365befca21ead74975f9af94718ffbc7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625806, "uuid": "bf7bf4e7-8257-4e4a-a59b-4f2227b393f6", "comment": "Malware payload", "value": "5df55aad12f1640b5758f62886833204d48d562712b707f179724b687323b1b5a11de54ec3fbd7206f95175653e5affd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625806, "uuid": "4ce14424-6642-4d3a-b4db-c93703186a6f", "value": "4383021403FB8659F48E9E39ACE20DCF3F4AFAB43D1A58E1966E046573298511B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625806, "uuid": "fb469ca9-110d-478a-ab39-3cbf96b98fb6", "value": "1536:MDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wB//m:MDAysJADlV378P3RPVJLd+eh8wBnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625806, "uuid": "29be7698-184c-47b5-902f-72b29aae3fe4", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625806, "uuid": "e610a4ad-f977-43da-91b4-0cc2b06b0d56", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625806, "uuid": "e43339a0-b330-4715-8194-6ad86b3b8458", "value": "statistic-1763807364.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a07196-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624760, "uuid": "066b36c0-db32-45c5-a216-c9efa8a5319d", "comment": "Malware payload", "value": "7f41ae540d3e7e33dcd6e48490682d3f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624760, "uuid": "fc96846b-f10c-423d-8f60-4c990bb72411", "comment": "Malware payload", "value": "119a3d10290150e2d468f41de52585454b7dea83a3cfdedb7e7ba30a468d8843", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624760, "uuid": "4a969f88-e294-4e4a-9d7a-f3eae93dc787", "comment": "Malware payload", "value": "75cfd589b7dea97e7f5d90b93403f53cc529b650", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624760, "uuid": "c5f9674f-01e5-40fb-89b9-36b3e4c90646", "comment": "Malware payload", "value": "4a5eb39070e2df1eb571c14e43064469af5731c9310839ecbd7139a6279aa35ac13041e9ffb4fd7c0fee65d6f2c231b0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624760, "uuid": "43870246-8536-4fe8-95f3-3d01f62cbbf7", "value": "C383028D653DCAEFB1AD2F09A3CDC53FB61EEC613004248DD8C466A65D49AE30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624760, "uuid": "4b053c41-c228-406b-a13c-ca8c907d0dfb", "value": "1536:2G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5de6n6475e0NEnP65:2GEhrHJoEsBMG7qzkZ4q/NEn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624760, "uuid": "e2f32ca9-a4ba-40d9-a88b-ec44a3fb0176", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624760, "uuid": "bf02555b-fad6-4012-8f27-1b45ce3ef7d6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624760, "uuid": "a41af3e4-8ad8-4ce9-9b31-2a226c188748", "value": "diagram-986381580.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d63cbd-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624673, "uuid": "4d82beca-80d7-4b08-bae4-f23e8dc4ed89", "comment": "Malware payload", "value": "4903c21f77c6c53da186fc685fce4ded", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624673, "uuid": "bc097e14-b90e-4e87-a43b-95d1c765b1c7", "comment": "Malware payload", "value": "119c42e084316a8d6973cc295bfe9ccaebcf8f37bedb024c091e923fcf2a51b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624673, "uuid": "509d2e0a-42fd-474b-8102-7fc8fe21fbe7", "comment": "Malware payload", "value": "531bd670b7f1b9a1bbd78f520bbbf1345606d4ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624673, "uuid": "8e2edebc-c14d-43ac-8b7e-a821952fdd4c", "comment": "Malware payload", "value": "44f704ba4b9efde27c121df18f7e9755087e525295fc5aa9a8ddab588c67ed5ae2cfd5d9037a25bfb12f7c52dab703c2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624673, "uuid": "f937673c-6f77-4e5b-818a-dc88be990199", "value": "3583028C653DCAEFB1AD2F09A3DDC53FB61EED613044248DD8C466A65D49AD30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624673, "uuid": "00d2b3b5-6fc2-45a1-88d2-d96548839be0", "value": "1536:gG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOe6n6475e0NEnP6E:gGEhrHJoEsBMG7qzkQ4q/NEnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624673, "uuid": "8b3d32f2-9bb8-42b1-893e-3b511a5568b7", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624673, "uuid": "636638cb-106b-4eb1-8a99-28fa79162dc2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624673, "uuid": "d9b9e849-0f53-47e0-85c7-ad6064bf8d62", "value": "diagram-92403299.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c897e3e4-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624310, "uuid": "d7581642-2d9c-4552-9cc8-3db1f2d882ff", "comment": "Malware payload", "value": "c8d5fa8095cec36c3ecf9758233a4835", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624310, "uuid": "89a9ca5f-dfce-4166-b361-cc44ac44ac5d", "comment": "Malware payload", "value": "11a4b6a05769469a53e8a5031d9aa49d9941b49a3bec031888c8a3f5d24d954e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624310, "uuid": "c821a35e-6f02-4b5a-85dd-c5d84db5466c", "comment": "Malware payload", "value": "cf8d0cc1a8df7123b7ed40d5c1da1fcafbc4e13f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624310, "uuid": "f935e9fa-0dbc-435c-aff2-7899c7421720", "comment": "Malware payload", "value": "cfe61f18afe006ad1d129f1c055c56313ae070fd5f2dafa9d56328f05e541ffed926e7a0ee4a79b63c7fffe0e402e791", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624310, "uuid": "a0ef4965-0045-44ed-82ec-8fced3a11dba", "value": "9083028C213DC5DF7AFE6B0951DC887E780EE8B02148154EE8C95A6B9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624310, "uuid": "e9965219-6549-4834-b471-2b22d6e0153e", "value": "1536:gG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZKkApVr6wo+RxY:gGEhrHJoEsBMG7qzk3xApxTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624310, "uuid": "83ee86c6-c5ff-40f7-a6e4-2ee255058b18", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624310, "uuid": "1882706b-5a0c-4384-ac15-edf63711a707", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624310, "uuid": "b26982d3-ca9a-4219-a4d8-661a76bd4dc2", "value": "diagram-680952596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67946103-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622859, "uuid": "30d425ee-0f3c-40a6-aa77-27ba783c04de", "comment": "Malware payload", "value": "9fdab496fbe9af478fc01d6bdba52f79", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622859, "uuid": "df10a3ba-5a14-49e8-bae8-fe46794b7c16", "comment": "Malware payload", "value": "11a704dbe173bcfe2ed5e6765d2a0cfce89bdd8dc15d88327facffc9a159dd91", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622859, "uuid": "aadd1935-dde3-4778-9d1a-46d4f1e7de15", "comment": "Malware payload", "value": "bb1fe3a5f3314d6efea570ff863451fe6b1f0d80", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622859, "uuid": "a6dcdacc-e283-4484-9182-e36a5dd7a6a9", "comment": "Malware payload", "value": "2df96428eb157273668a5ca3f56605b39cb1b84584666cf3952987ea73451653ef34b0c2d5edaf9c587fe0a0d41c93e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622859, "uuid": "020f35c9-3d2b-4fdb-b182-d9028414c2c2", "value": "25830288263DC3CF797D7E0A66E9C83F690DE8B81144345DD4C03BAA9D4ABE74C57960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622859, "uuid": "cb88ea8d-06da-439a-83f1-78abfc968e0d", "value": "1536:RG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttT6RuoKryI8NlRu+dk:RGEhrHJoEsBMG7qzkYNI8Nl4+dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622859, "uuid": "a24b99dd-89ab-45c1-85c1-73fb2fb5adb0", "value": 86095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622859, "uuid": "4f162adb-d50d-4a59-af3f-be25cfc90d4f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622859, "uuid": "601d73e1-3d85-4530-927c-cf1e956a9569", "value": "diagram-1701370315.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ad208f-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621109, "uuid": "693612b7-74fb-4773-8c1a-fdb02d34762b", "comment": "Malware payload", "value": "8e8366242f4f46bbf387b1ab01e7b1fc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621109, "uuid": "fa447ead-22e7-40ee-9d51-3904102d3a39", "comment": "Malware payload", "value": "11adfdfcb3591a2e566d2c391dcfd94f184bf6d3614e4b150a0d553e67a12283", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621109, "uuid": "49622133-01d9-4304-97da-563c02ff416d", "comment": "Malware payload", "value": "b7f71ae0124db701a32a49dbaf054c0037e653cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621109, "uuid": "6e5c0f33-f049-454e-8d60-1615b9e6b34b", "comment": "Malware payload", "value": "0ceb19bbafc1071578929d6d5a24ada7dff091138a6aced9d5a8a2167de235dc234be59fc0219d40bb7fd17afb5c0491", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621109, "uuid": "03b92758-4bc5-42b7-8768-985bcab15878", "value": "8A83129073FE8E6DB4CD9E2855F20DCB1E5EF974290CACE165AE04A492358452F3493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621109, "uuid": "7c1105a3-648c-4d9d-b474-7614ab5ada06", "value": "1536:eDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1HEde:eDAysJADlV378P3RPVJLdIeJLOnleJkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621109, "uuid": "81aa9e36-e9f7-4d69-8a74-8b894f7d47e0", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621109, "uuid": "a7d93f57-a088-43cc-8ac6-0463628543e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621109, "uuid": "d598ac28-2f2e-4d2e-8400-d28e426e79a6", "value": "catalog-414644833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccfcafc-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626975, "uuid": "f896132f-0ba2-4152-9a04-8b8d61e49e87", "comment": "Malware payload", "value": "7a6d3585e4233d608b23a1894d8432f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626975, "uuid": "34c4a7d2-2728-4e53-b0da-50a8257974ed", "comment": "Malware payload", "value": "11d033a7fa4cfe73b70a3a8d4362bb374949b887b537cc3e4bde224d74df60a5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626975, "uuid": "740b881a-a7f3-4482-af51-9c932c70b138", "comment": "Malware payload", "value": "b1b40331f8037d55ee7d1873ca18e4a2c1efb4c3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626975, "uuid": "ed65dd71-2930-4ff8-92a9-9ac68aeb5f3a", "comment": "Malware payload", "value": "6b6d4bef84f94045366b44ae2c7cdec08ce5ebff7f897c267bce78be594e8238523016e3357eefd99ee1b6b8999a9055", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626975, "uuid": "29f8a682-33d5-40c4-bd50-5f479a0ada0e", "value": "9283125013BB8EADB58DC93948E20D8F2F56B6B02D5B5CF2B13D0494F1338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626975, "uuid": "11605eb6-b935-46d3-a71d-32efde57ea2d", "value": "1536:kDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7Iy:kDAysJADlV378P3RPVJLdw7Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626975, "uuid": "69893cb1-1474-4dea-be6b-3eb81893d2af", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626975, "uuid": "8c87fb35-4f3f-48df-b32d-c0f2fef672cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626975, "uuid": "aa680845-ad95-46b0-9724-80a30ede8fcc", "value": "statistic-631819604.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e10944-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626106, "uuid": "49eae2bb-bbc4-473b-8b8f-b03595367742", "comment": "Malware payload", "value": "b79855f0b09782c3a918b235a3da4b8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626106, "uuid": "d3cdbf9e-21b7-48f5-a4fa-11453375551b", "comment": "Malware payload", "value": "11d95ad0627344a28cc2445dac4fcb174eae60aa860f76a53da9cebc03033a38", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626106, "uuid": "664e7ae7-f70b-4633-910f-b3877b99beb6", "comment": "Malware payload", "value": "b54b0c7d44fe779f929c06568c084415553737c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626106, "uuid": "1114712e-7369-4c31-8d7a-ac8b2b0f5d20", "comment": "Malware payload", "value": "52caba94215742984fc204cba45aec18f380a25152aabfb266feae2d33f7c42a62ab904442a5690e65ea16f3ca4488b3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626106, "uuid": "796bcdc3-ccda-4c09-b479-d1c493ef3ae8", "value": "1883021413FA8959F48F9E39ACE20DCF7F9AF6F4390A58E1962E0465A329C510B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626106, "uuid": "89111015-8685-443e-b087-485a5a0b3996", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wBUIJ:XDAysJADlV378P3RPVJLd+eh8wBZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626106, "uuid": "f353888f-3f76-4bbf-b4b3-a0a2e5034b51", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626106, "uuid": "7f7fcff3-7883-4767-832b-b8b8f5c32f4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626106, "uuid": "856d5943-df01-4e51-ae23-9bc245476b0e", "value": "statistic-1960311994.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991f740b-a7c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619575268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575268, "uuid": "af2ff909-1b77-430a-b363-83739fe1a811", "comment": "Malware payload (Dridex)", "value": "5a0441e38d367bc1058c5d2cc46fcf3a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575268, "uuid": "53a9d801-7e5b-4395-9c75-3be15366b12b", "comment": "Malware payload (Dridex)", "value": "11e77982f66d2619d7858574d54834d510d93aa6d68978a3139b6ee735f8540f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575268, "uuid": "fcfd3170-c200-4d95-b599-2c491bdebe9c", "comment": "Malware payload (Dridex)", "value": "b75b15c807d228e0b75e9535f02ab1d7198c7adf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575268, "uuid": "b4c7b86b-7d71-428e-9f54-f794c9acabd8", "comment": "Malware payload (Dridex)", "value": "d0b210fad4edd7fbe29373add57a8fb57c40fb82f600714e347f1a4ba59195199809c088c731509510e9f00d95763838", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575268, "uuid": "a751722e-f6fb-46af-8523-ed5819b89004", "value": "B8F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575268, "uuid": "3d6670da-ba97-44b9-8f7f-9a6ad19ab43c", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575268, "uuid": "bc219889-3dce-4371-94b2-6ed65a858d14", "value": "3072:IWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:I42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619575268, "uuid": "712a9953-768c-40e4-9bd2-ad228f3bce04", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619575268, "uuid": "2dbab9cb-4691-4ade-97e0-2891a6140848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575268, "uuid": "4530ddb9-fbcf-4548-b770-f1977d3b3b22", "value": "5a0441e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6fc7ee-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640695, "uuid": "418ff707-625e-4da6-a6ad-12fce73fce00", "comment": "Malware payload (Quakbot)", "value": "00a893c966097f4e6df43e864bbe88aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640695, "uuid": "9a547dc9-a395-4d5f-bc11-2c16fd990ced", "comment": "Malware payload (Quakbot)", "value": "11ed2b512b42d310355b9afc6fa1f18284b912265c8f5e8ec9bf5dc1f5ddcc9a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640695, "uuid": "aafa321f-3716-4e3e-b2ae-28a79880d258", "comment": "Malware payload (Quakbot)", "value": "7086f7e502e2fd9b22637c31249b993ba616bddd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640695, "uuid": "51a9675c-681d-4df0-a871-20ddf4530afa", "comment": "Malware payload (Quakbot)", "value": "cfea82aae0fe53360086f1372bbb756dc294eae95912b23823f2d8862f75ab7a3f0be899abb069ad6e458b3043e9cc99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640695, "uuid": "ee932de4-55b8-4294-b253-0c1951f31259", "value": "BE948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640695, "uuid": "59f8ee05-a2fd-4a26-a204-adc389afcd8e", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640695, "uuid": "6c42ba24-d012-4797-beef-e252424442fe", "value": "6144:GWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmH:GWrsTwr03pdf8vhhOKJETlByH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640695, "uuid": "6fe1d34f-b212-482a-9ffa-b4a523a4910a", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640695, "uuid": "c7001598-dd9d-4984-8733-2a114f12f3a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640695, "uuid": "0ac5ce8c-a20b-4050-87e6-3724e59a6260", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00a0545-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640697, "uuid": "800cf078-c51f-4443-82ab-ef07363d897f", "comment": "Malware payload (Quakbot)", "value": "ee93dda96f84554fb09b2892ea08f64b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640697, "uuid": "3ad7c15e-718d-4ec3-8216-4647486246ab", "comment": "Malware payload (Quakbot)", "value": "11f70af1b72bc21cfe596eaa01b7f846c7cb9f0ceaa4acaac92018ac68a1084c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640697, "uuid": "00f7a9a0-d072-47bd-9e82-d36342549441", "comment": "Malware payload (Quakbot)", "value": "3d84c14d210dc0802d381e67ee0f1464698ebe09", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640697, "uuid": "fb36bff8-114b-47e1-802f-ae4d42b1b687", "comment": "Malware payload (Quakbot)", "value": "7617c7c6d96bee882b1ffc18a5aceb48c5e214c3a9a51d1230198446e76bdcd9edad6a3f520854baf8a4c9df3f9a6cfb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640697, "uuid": "525367c5-2f2c-4109-98c1-a62b64ac7ba9", "value": "D6947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640697, "uuid": "d3744816-0436-4af7-88dd-e9c5b571a769", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640697, "uuid": "ca50f873-16e6-426e-b760-9ab0566df028", "value": "6144:hyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmL:VTwr03pdf8vhhOKJET5ByL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640697, "uuid": "17b446fd-b6e0-4bee-8fd7-1d63cdb682dd", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640697, "uuid": "91b77858-5cd7-4f65-9c24-7f3a7170be5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640697, "uuid": "3e2839ba-b8ad-4c45-aa2f-7899659c0484", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1472024-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619622097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622097, "uuid": "14f85b86-c63e-4281-8108-6ae100e63a14", "comment": "Malware payload (Dridex)", "value": "50266c5a5cbf394d836ee7a70a030f29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622097, "uuid": "45920266-0c99-46ba-8e4d-133f4913715b", "comment": "Malware payload (Dridex)", "value": "11fabc5f83df8d238814fd735dff72e9ab234b3551071cafbfc56f9805384fd8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622097, "uuid": "af5186b2-47e2-42ab-9855-dad56e7e1936", "comment": "Malware payload (Dridex)", "value": "03b75b72e2a22822223b9d130a1836d4a63c9515", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622097, "uuid": "ef643869-1783-4387-a6ef-124e71b0f835", "comment": "Malware payload (Dridex)", "value": "0f639063a2d584924f1a9aeb0589b3e03d3f6c59492669eb1c93d13a4f45ec4726f2a9def500cbe60f5ce8d03ad572b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622097, "uuid": "0bf7a5fb-523d-4e4e-a094-fa155dd140db", "value": "D5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622097, "uuid": "dad9db55-5165-4913-b22c-fd881649ccbf", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622097, "uuid": "5effba37-b286-47f3-bb5f-25feb7b22cce", "value": "3072:Ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622097, "uuid": "756ef8ab-fae0-4a44-afed-0c5a06d19500", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622097, "uuid": "46adccbe-d537-4fea-a883-b497a2f9afc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622097, "uuid": "0494bce4-88b7-414f-ab4e-4f782cebf273", "value": "50266c5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e3dc28-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622499, "uuid": "94aa4d41-3e2c-474a-9e0c-369c595ae4e0", "comment": "Malware payload", "value": "5b1caf287f43f7a0c281c4be991f9afc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622499, "uuid": "d545069d-116a-4629-9c1f-1749255090a3", "comment": "Malware payload", "value": "11fc944af44b3eef377c2144b12a6895685b8f81a2a7ad679618cc98a6b3cfcd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622499, "uuid": "70a179de-fc00-4f20-a204-599c81afedc0", "comment": "Malware payload", "value": "fb127355ef044e0a47f0b3691267adbdcbfb4e9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622499, "uuid": "d5bf08f9-3c46-4373-94f2-594b9e596d1c", "comment": "Malware payload", "value": "9623276f4e36f474d8458cafca82694053d1d13a367f601859a75a30e5c2ef9684a373b7622170e1997ea57b0df6e3f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622499, "uuid": "608cca6d-93ed-412d-bf7f-879f80a96d67", "value": "9283028C7538C5DF37BE6A08E3DC887BBE09D5B93504395EC089655FAD86EAB0C5B060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622499, "uuid": "d8a9af0d-f069-45ef-8cba-0f8502e3826a", "value": "1536:rG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZds+RKYFxQ3d+pk4:rGEhrHJoEsBMG7qzkOQxOD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622499, "uuid": "540a388c-b318-4050-b5a0-a75e1027af65", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622499, "uuid": "6744fd7b-45ec-47c9-afd1-0fecb9e1c68f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622499, "uuid": "8ac5c97d-10d6-4beb-881d-9e531e7bd000", "value": "diagram-1419561068.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ad30ed-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619653, "uuid": "3989914e-4e36-4877-86aa-80f2691490c9", "comment": "Malware payload", "value": "f5eeaa814914cde6b7f4c9d87530bbb5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619653, "uuid": "f46a5217-85e9-46df-80b8-af8aaf2674cc", "comment": "Malware payload", "value": "120439e17200dc71c6c4f8b3823fef941e546774f579f4d53e51bfe54630638a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619653, "uuid": "114f99a5-3e01-492e-a6a8-f66de1f20424", "comment": "Malware payload", "value": "05b6412abdd96d7a0d0a0f47c52b72a60bd8b04a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619653, "uuid": "5aedc4a6-ed08-4001-9bbf-e6c855be2093", "comment": "Malware payload", "value": "1fe6007a86a93bab3996c4ed9193c6c5e5737b7accdc2d386e40cb8f560a2f8f2be6f3a185746f71a1d9ab17317a3ffa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619653, "uuid": "a6c00620-454d-4cd1-9198-aab5d751c8ff", "value": "8A83027103AE8B1D74CE5A3958D22E8F3F97E8B82D195992541904E4E327C629F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619653, "uuid": "870e8d45-c60a-41cf-90c3-5f140cf93772", "value": "1536:BQDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVRx4:SDAysJADlV378P3RPVJLdtDsMU0dRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619653, "uuid": "4b096dde-7e50-45de-baf3-60d90df8896b", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619653, "uuid": "11b47498-5264-4f7c-8535-d08c15515a85", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619653, "uuid": "2b0dce26-74e6-4bfe-9b3d-a11c6622d67f", "value": "catalog-1407115344.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac3a23a-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647158, "uuid": "7d1b3a10-1675-4ea4-b690-a8aad0dd07d2", "comment": "Malware payload (Dridex)", "value": "8b855e33762e50cca4c4d401ca4bf017", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647158, "uuid": "f2ae9050-c9f5-4ca2-9ba4-6786475e42d4", "comment": "Malware payload (Dridex)", "value": "12154bcb5dbfb7025896038909c95c5ea138d7e5a219ac8ac9c83e381b6d422b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647158, "uuid": "ccdbe8d4-2c9f-4e28-a5d3-50e498c4dac1", "comment": "Malware payload (Dridex)", "value": "adeb5c0a0519ee65e27cf58131d9b53aa634b56a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647158, "uuid": "33115ffd-22b9-41f8-854d-255c39ebb949", "comment": "Malware payload (Dridex)", "value": "e53bddf43e92e4986182ae8ae46a9e10d847913fbb6e1ba8b3f5c3aa13c534d7981b9426c16194536b93a7c33eba47a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647158, "uuid": "8821d6e5-e0a1-4e2c-9b5a-928f0e3398ed", "value": "C7F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647158, "uuid": "b359d277-a527-4277-949f-c5eef7ebf3e7", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647158, "uuid": "b7a64208-6c58-4edd-8c8a-6a487ac577a3", "value": "3072:0xT2d85tleLD51fC5AHYEoefukoTFMpGmjY8D:ly5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647158, "uuid": "3d77a57b-f6e7-45cc-88c5-34126f91b20c", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647158, "uuid": "13730099-5ff1-45d1-96c2-5f99c6831012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647158, "uuid": "6029b165-4fc4-42a4-95b4-99c773308752", "value": "8b855e33_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1960104-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621695, "uuid": "c40f2919-46b3-4815-a464-3f4a97cd0425", "comment": "Malware payload", "value": "6e1751552e746e331aca199ab4951a7a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621695, "uuid": "17235042-96d1-44ca-a87e-f9016d5fc4be", "comment": "Malware payload", "value": "122a1b3c5e94dca2f51d96d0d83523214564ce44953d0da86693257c9d11cd9e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621695, "uuid": "e092830e-ffaf-4e4b-84e5-0a367e06ffd2", "comment": "Malware payload", "value": "68509718670111bf53b1b5a922b9fb7368ac37b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621695, "uuid": "9057d438-f0f0-469a-9bc1-eeaa8980e5cb", "comment": "Malware payload", "value": "2a1239f330c2881cf97414ff9c05054fa2e464e11d7789fd6dd1e2ce37d7d754c8e77dfcba7d4ff112e1ae9dcba9c990", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621695, "uuid": "2086abf5-9ea5-4c7b-a735-108494dd2343", "value": "8183027103AE8B5D74CE8A3954D21D8F3F87F8B82D195892542A04E4E32BC559F3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621695, "uuid": "dd277463-cc12-4961-ab50-49a20677f777", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRVIN7:4DAysJADlV378P3RPVJLdcDsMU0dRVIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621695, "uuid": "66944e96-e7d4-4843-b3af-58739f01b471", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621695, "uuid": "6ee64415-953d-45b3-a2b1-530ef2c7c808", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621695, "uuid": "73157b17-cd54-4472-9eca-22095ca89747", "value": "catalog-863329544.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bddf17-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640700, "uuid": "50abc012-185d-4de8-908c-85ad0e6cf42b", "comment": "Malware payload", "value": "fffe1de7639e95f824b4849abbebeaf4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640700, "uuid": "c8b5db21-32c0-4692-b527-45f794a78132", "comment": "Malware payload", "value": "122f1fa7275b90d927e80c04724642e85dbec40793ff32ac40ddd6d2fc66e9c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640700, "uuid": "e457f5f8-52a8-45a2-b07e-9869447936ec", "comment": "Malware payload", "value": "653b7426e5586bc01c6cee74c71183c00aed4511", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640700, "uuid": "dac3a8c4-2dff-4426-894a-08b0eeced242", "comment": "Malware payload", "value": "28ded642021ba424c36d2c1b5419f92ecdbe47ddf5cc72a156b6da9923ae68939b1229fe8b06aa5c4fabe8e6e530cb38", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640700, "uuid": "81ddcffb-d385-4771-b04c-04d66c793344", "value": "0B948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640700, "uuid": "9139857e-a997-412d-b372-cc7696257b29", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640700, "uuid": "a3819a19-ccff-40a3-bdb5-ce1016a769b7", "value": "6144:7VWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWrax:kFNmLKSVpJbPT+4xrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640700, "uuid": "a173519e-381c-4eb9-b9b6-867dc5573540", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640700, "uuid": "cfaf457d-2bb5-43fa-9e7a-f3d504a1f4db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640700, "uuid": "b7cd2f8e-f8e7-4185-a6a3-1ba477a0131d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b558f0e7-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623848, "uuid": "6337fdfa-4920-4e94-b5e2-2edb80c3718f", "comment": "Malware payload", "value": "e5740d752c6be8e38b038ca706f5b27e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623848, "uuid": "c83b3940-bca6-42b8-874b-864a642eb2bc", "comment": "Malware payload", "value": "123982805b87a08a254fd68282875e71ea078c1bc6a69cf8d5e9fe117dc4b981", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623848, "uuid": "ae03cbaf-167d-4992-940b-05a1f6d687ce", "comment": "Malware payload", "value": "84032229fa74419d400ea0d0edb56b1f2c937cf1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623848, "uuid": "bedbba1c-8045-41f5-835b-33d3a6965aa9", "comment": "Malware payload", "value": "b33151342056302fb2dba9dd0b649060b7f775619432e99252f4bb9044df820328ef1b61c9dcd8568301fb33f7600b52", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623848, "uuid": "00ab57b8-12d6-4769-901e-81a6eb599165", "value": "D383028DA638C6DF6A7D3E0D67DC893E780EECBD2044648DD4C8AA695C4DDE70C57160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623848, "uuid": "8919db5a-daf5-49de-b6f0-b61a88ce0af5", "value": "1536:ZG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttAHZTf7f/lRXqdq:ZGEhrHJoEsBMG7qzkWHdrlxqdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623848, "uuid": "8f3b114b-c6f8-4c68-b5b9-90e356fa6593", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623848, "uuid": "4ea64687-3b53-4ce3-86c7-e168694d9ae6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623848, "uuid": "3b839e6a-d976-4be6-bf55-07fdcd438e9a", "value": "diagram-449280596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d32720-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620058, "uuid": "0a5d45d2-5c06-4102-ade1-65249ff76347", "comment": "Malware payload", "value": "f26e314488026e505198d6a43064016a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620058, "uuid": "66548cec-a49b-4043-a8ef-5abe11831b93", "comment": "Malware payload", "value": "1239eb3e1fc9236bc21557ee709d8ed33f79ea28b55c2e2ba466d670e4098351", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620058, "uuid": "baf7e236-f341-43c4-8200-b0648ebe75a6", "comment": "Malware payload", "value": "6c34b7edbf00b6b08fa6190804d1ea27a33eeaa3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620058, "uuid": "4c946440-ac9d-4321-94cf-1a9d0c111540", "comment": "Malware payload", "value": "2a1c6d91fbf4fb6d3008ed33fccef920b755762cb4815f0e57e4ed5ce77a446b752f046118701d6476fe83b483152f5b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620058, "uuid": "dc0aa5f0-ea8c-4f1a-893b-25860c8d2c3a", "value": "0C83027103AE8B5DB4CE9A3954E21ECF2F46F8B82D195892541604E4E32BC665F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620058, "uuid": "d44ebeaa-bbe8-44e9-a332-c375fb4b26f9", "value": "1536:9DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd1DsMrbsTmHvVR3M:9DAysJADlV378P3RPVJLd1DsMU0dRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620058, "uuid": "27555fe0-078d-445d-a607-b09ef461e010", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620058, "uuid": "0be99adf-8107-447d-857a-d6b4a8c75ab9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620058, "uuid": "9c58ff9f-d728-4ed4-b770-4a2bee6c2228", "value": "catalog-1735044880.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001589fc-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625692, "uuid": "e9dade7e-4888-4cfc-adc4-eecbcc6fbce6", "comment": "Malware payload", "value": "7a2b567a825ac5f08ff6831c1d1d6b23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625692, "uuid": "16f31190-b4ca-4bde-841c-74d21cf88504", "comment": "Malware payload", "value": "123bebc8a6f172d3b2263dd7bed0bc6d9784dd0294f75d4995e0ec4190d6400d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625692, "uuid": "b09fa1cf-3bbe-4ed6-8ba0-ce325a6dc848", "comment": "Malware payload", "value": "0fa416b8ea4839705792d40e0a644cc2a439f477", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625692, "uuid": "6fdbb081-0e48-4a51-be55-94a76f995ce4", "comment": "Malware payload", "value": "f50e954340179047284454e4738b97e2094a0981358d5f1b058526d46d7b9416c298211735e1ddc1865f6507a5bb7e42", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625692, "uuid": "c2218ad3-2258-415b-a62c-62ed80fce965", "value": "A383026173B9C958F58DAE294CE30D8F3F42A5B42D1ED9B5621A01D9D327C920F3057E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625692, "uuid": "63178cac-492a-4433-8701-f6eb63366e7b", "value": "1536:3DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M24:3DAysJADlV378P3RPVJLdCqXjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625692, "uuid": "61374510-cb9f-4ad4-8eef-98195164add6", "value": 86109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625692, "uuid": "8d5a9ad2-755b-43a9-b02e-884eb6a73394", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625692, "uuid": "45674b8c-8599-46f5-9743-aeb7e7d685de", "value": "statistic-168246147.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe0dcb7-a861-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619642301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642301, "uuid": "3562f9bc-81c0-41f1-9a22-494ee99e9399", "comment": "Malware payload (Dridex)", "value": "655dacaefedb5f53e85d3ee12f29f6c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642301, "uuid": "904175d4-97b6-4c37-8880-11b0738f3651", "comment": "Malware payload (Dridex)", "value": "125f5ec612b6c1476bf3218a236303019e4dba5571686cf825550f4d6cd4d608", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642301, "uuid": "4d4fa09b-09ca-4907-8277-846b873101b7", "comment": "Malware payload (Dridex)", "value": "a12979fbaa0598517ee2e36da6b1c97da7df5bd9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642301, "uuid": "ac0a19df-ca0b-4423-b0da-4fe30e6e3fd2", "comment": "Malware payload (Dridex)", "value": "6d2dac91a309ee6dc5abc684301390b2beafe132c1b4733a4c35c682bf8f9bbb2f966d9b33caf64f9019e82edd3a4819", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642301, "uuid": "874f723e-c0a1-4f83-bea2-b397d1dcf983", "value": "DEF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642301, "uuid": "8235af6e-6eb7-4d15-a703-661b86fbc03b", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642301, "uuid": "b0700ead-f91b-4241-9d73-2d39d6ac6cc0", "value": "3072:OWSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2NGkFY:LnS62Fl+pkeJl3CvRStrFl+EYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619642301, "uuid": "bbc40d31-0df0-4ca3-aaf4-bf06c8bdaeed", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619642301, "uuid": "716d5bc3-493f-4c3d-9ac5-9aa8664e6cbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642301, "uuid": "f78a8136-6025-49cc-9e92-3a1337d31944", "value": "655dacae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a7f0d4-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626364, "uuid": "36a1bca4-8560-4d68-a5e4-16a30af9ee49", "comment": "Malware payload", "value": "eb6bac6d3a362ece1041568d943cbe76", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626364, "uuid": "da4df56e-e4d4-453e-a650-0c6bdf7bf8b1", "comment": "Malware payload", "value": "126492560da0eb85f4a7e91c64b9f97b0c31667b4dc279c5c31b4529e0cdc78d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626364, "uuid": "55c6ff3b-1979-4b97-9fa0-7bae06f03b11", "comment": "Malware payload", "value": "308e95b38961565f5123a15b423f071bfa2363b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626364, "uuid": "32a91fd4-94fc-4a02-891a-5f866bf9649e", "comment": "Malware payload", "value": "63b683cb005dadc3244c6af42eebdd78d561ec60664442e71fa3f9d33a61e578abefdb0a597c5a78a4a110b9d8d22136", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626364, "uuid": "e7e886d8-6814-4145-a5b5-788535ed90bc", "value": "9183020813BA5919B5CECA2D8CC31FCE3F57F8B815094862A55D0199F627C6B9F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626364, "uuid": "cca09301-287e-4e09-96d8-49b77a64d673", "value": "1536:UDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n1+u:UDAysJADlV378P3RPVJLdcKuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626364, "uuid": "d8893399-3296-47be-a068-63b78aec4eaf", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626364, "uuid": "76fc503b-8d9e-4891-90d0-2f41b423dc6c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626364, "uuid": "0c2fe5f4-35d5-45e5-9ad2-c6b57b062a96", "value": "statistic-225780676.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fb681c-a86b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646393, "uuid": "cb4bcb41-e952-4560-926b-48e1816e0d0b", "comment": "Malware payload (Dridex)", "value": "50f427efe24874c17656c0e2c15e3bb0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646393, "uuid": "c00b05a7-4334-490e-8f72-f8745b6bff9d", "comment": "Malware payload (Dridex)", "value": "1266490c310494af092accb03eb125bdd33ae384045795bbc5a0da675b655b35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646393, "uuid": "ce517885-99c7-494d-8bb1-f61d6cacf5b9", "comment": "Malware payload (Dridex)", "value": "178e0cb2aa122365fc0f3b5184def8d663f15e8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646393, "uuid": "f6dc31a4-179d-406b-890d-642a8514fc21", "comment": "Malware payload (Dridex)", "value": "250db68c860dc25442fa2d7f9ebb70e18051744c68e34a106438e291832bf87e81c00d7146acf2252a2ceda7e1892fdd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646393, "uuid": "389cdd5f-e70f-4f60-af34-bdfe3dd0fbbb", "value": "4BF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646393, "uuid": "200a7e0f-1b69-4cef-83c3-caaab127615d", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646393, "uuid": "02af0abc-1992-4848-bc0b-bbd2f1d67d9a", "value": "3072:qxT2d85tleLD51fC5AHYEoefukoTFMpGmjY8D:Dy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646393, "uuid": "c51c3479-0f33-4af6-9d12-544ff24ac80b", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646393, "uuid": "2dd63e21-4802-4da7-952b-f39bd6c6617d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646393, "uuid": "3eb4eae6-8fe2-4017-870b-f12b37ffaf19", "value": "50f427ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433ef04b-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625375, "uuid": "6c60d1e6-0b1f-46d4-9858-e0f5222f7cd8", "comment": "Malware payload", "value": "46e608d93107360b73472877359904c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625375, "uuid": "4039fe8b-3704-40de-8513-39cfeb8ede1e", "comment": "Malware payload", "value": "126881356bf151dd80c9a359eaab5b9f44258d4b008e646eec05fe975472c608", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625375, "uuid": "fa64ee22-7d6b-419d-8674-086bd27c6f00", "comment": "Malware payload", "value": "7382ec43a6961dce7050ed1ccfdf1c546c7264fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625375, "uuid": "2d811606-8dce-48b1-a99f-9d2774b6ff0c", "comment": "Malware payload", "value": "36ccc0bb2e697beb76313bd8abec92aef4ab788b89e414015db483f9205bf1a61aff995b3a8d793e8516f664b8341862", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625375, "uuid": "3cbf4128-32f3-4760-8b61-66650481e062", "value": "D883026443BE4A5DB84D4E29ACB20D4F3FA7B6743D0E68F1B92D0485A2318561B34A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625375, "uuid": "bc2285fb-cb2a-4e14-9898-767345dd73c5", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmtk:zDAysJADlV378P3RPVJLdBxpESk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625375, "uuid": "7da21ebc-1a75-4977-990d-875601c201e9", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625375, "uuid": "d4909eb4-81e6-4659-9f3c-524f4275d82e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625375, "uuid": "d0bb3604-c90e-4a48-8cbc-28f3424b1f52", "value": "statistic-1450317154.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546c9da5-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625833, "uuid": "a2f02c6d-ef15-43fc-9ac6-37fee18d7a7f", "comment": "Malware payload", "value": "f95c56215b2c581cf393dd55cb9fea8c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625833, "uuid": "bd57d570-fa5c-4cf7-8e3a-c6c9b54c4abd", "comment": "Malware payload", "value": "126a78ee44f6b7a483dcf18b01c6ba74a3eb58c020f2f8375f98bb663bca9696", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625833, "uuid": "cfc45ce3-eb50-4024-a1cd-376eaccc3697", "comment": "Malware payload", "value": "49b982002a7967601d434d41baf53f9acb8cb44d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625833, "uuid": "fb1cb70d-c7ec-4348-a63c-48f8029082fa", "comment": "Malware payload", "value": "0a95139f9e221d50e1f678e598dd64e26c69a1c4318b6616c8fbf5544e18eb5cf5a835c0da03157d4eb709d1113bd24f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625833, "uuid": "d9cb5330-26e0-4606-8dee-33df6d07c3b5", "value": "068302A443BE4A4DB98D4D2DACB20D4F3F66B6743D0A68F1B92D0485E231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625833, "uuid": "3d78d711-99d3-4b28-859a-8d37d146e8ae", "value": "1536:qDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTm0/:qDAysJADlV378P3RPVJLdBxpEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625833, "uuid": "adff4093-4f6f-4727-8843-119383c89685", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625833, "uuid": "6dea2afd-45f3-4149-ab19-b815a933c1b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625833, "uuid": "ad73ca41-e25a-4e14-b010-58dd5e7f4ec4", "value": "statistic-1783162874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a677f7-a850-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619635103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619635103, "uuid": "2db3cae0-6ea9-4289-8e55-22f99b4e8ec5", "comment": "Malware payload (Dridex)", "value": "583a0fbf5b66f9ee79c1ca965ca5b490", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619635103, "uuid": "299aef9c-ef49-4e3f-9ac7-db39d355ad18", "comment": "Malware payload (Dridex)", "value": "129421d7cf01d2e1a8daed392b4a066b0664833df1ce43170eb7be647f828b98", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619635103, "uuid": "44e77725-0819-4856-afe4-e867f42a4049", "comment": "Malware payload (Dridex)", "value": "b95614d5360ff7c99eb3cd26ca83869b2251ff72", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619635103, "uuid": "37206847-993d-4b57-9997-2fb8f52baff0", "comment": "Malware payload (Dridex)", "value": "e05333aceda7666809a73600c229d89b7a6528a56e89a62cc7b7422976d72e33b36bd9fc48cf5a5e89e5e704be912075", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619635103, "uuid": "b0892446-9d7a-41e7-b1e0-53aa62906e53", "value": "EFF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619635103, "uuid": "72fab501-5d81-4143-b445-22fb54ea7c4b", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619635103, "uuid": "de07dc9a-ec7a-4e5c-9da8-a278fec22087", "value": "3072:e+T2d85tleLD51fC5AHYEoefukoTFMpGmj28D:+y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619635103, "uuid": "3737d601-1c2a-4614-a2c2-c71a0b57f79a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619635103, "uuid": "a1872a4e-2c23-4e2f-938a-252b8c3e5eb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619635103, "uuid": "c45119d9-ec7f-4fce-baf2-842d7feb93f9", "value": "szxJKhlWUs4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11060dd9-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625291, "uuid": "4a43d373-04e0-447d-a743-611714cf2118", "comment": "Malware payload", "value": "e29cbcdc534cd1744b14aaa4abfe3655", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625291, "uuid": "e2849ebc-47a9-434b-a3b4-c49df0e9b7f2", "comment": "Malware payload", "value": "129a083a44538ce3eef67a0ba63711e34d332036291f89dff65c7826498409e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625291, "uuid": "50070ac3-d855-46b5-84e3-f1e1b3f230ba", "comment": "Malware payload", "value": "6591c0485ab08988f11bf1d7dbd56b61af68592b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625291, "uuid": "f2e5062e-30b4-46cd-90cb-75f0e3687988", "comment": "Malware payload", "value": "e4e5e98081605c005f360fbae20d39fee7b7a8d5690c1a251547f47a27d76ee7622fd8b6f3b8b0bad77a926fd1d292f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625291, "uuid": "994a1c4b-bf36-45db-97c4-69fec895d83e", "value": "ED8302A453BE4A5DB98E4E29ACB20D4F3F66B6743D0E18F1B91D0485A331C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625291, "uuid": "838dd496-d96f-4e6b-bb70-37f754b346e3", "value": "1536:fDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd+hsMnSEwJPTm3:fDAysJADlV378P3RPVJLdQxpEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625291, "uuid": "52fb433d-1745-4163-942e-35dcaecbd1f8", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625291, "uuid": "2754c1ab-becb-47ff-b22b-ba659a8b6b64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625291, "uuid": "3841dc81-a11c-406b-9b9b-b4e19553ef26", "value": "statistic-1367970897.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82093d35-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625051, "uuid": "50d92ff3-7253-4316-9c4e-c628807140ea", "comment": "Malware payload", "value": "2c5b9e9223fabcd9f8717a10c6065b46", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625051, "uuid": "d406644a-e0a1-4ea1-ad3f-6508acb43917", "comment": "Malware payload", "value": "12c670458bfe21c58a9ddde8fbb6ddf3ce52f08027dd6d6f218b7d89cc0e3905", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625051, "uuid": "6b2e9140-891b-40bb-adc7-d540683e08af", "comment": "Malware payload", "value": "684d2cbbc1bbb2b24e21d9966899053c9cd1f0fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625051, "uuid": "0ec355f1-9de7-425e-b7d1-9f6bc39013ff", "comment": "Malware payload", "value": "05c4cbc25cdc65fa8c5f47dda85607f20b60fb0b534d198fa91256a3e461f7f70dfb12abca7e507e66b981c26edb7a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625051, "uuid": "0cb6c0bc-d5e8-465a-bb00-e8accc6184d8", "value": "1D83129413BB8EADB58DC93A48D20D8F2F52B6702D1B5CF2B13D0494F1238961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625051, "uuid": "a618a231-80a5-4a42-8d9a-27aa534c27c4", "value": "1536:uDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7Jz:uDAysJADlV378P3RPVJLdw7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625051, "uuid": "dd9518a4-9559-4d98-bf3b-1a15d48f0fdb", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625051, "uuid": "431f1a83-1f92-4197-a352-1fb576aa5a63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625051, "uuid": "9696a254-8017-414f-b052-40f8ce623539", "value": "statistic-1189509227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b81c49-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619049, "uuid": "a95f5ead-8050-4c4c-a239-fcb8ed3a2430", "comment": "Malware payload", "value": "335becd68d08fcc587d1e1bb7258e749", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619049, "uuid": "4d6de173-5aa0-47c7-9f60-bdc5172f71fd", "comment": "Malware payload", "value": "12cbe33e13bd44aaba9d08f4bcaab27fc061a26b72d7bc5de0ab85a3d82f2007", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619049, "uuid": "8a409bf6-e08f-473f-844d-26ed7a426be6", "comment": "Malware payload", "value": "b5ac8126184ba38edd09f75cf8b698e0a3ade0cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619049, "uuid": "7f60906f-1642-4d2c-9a4a-13805256e528", "comment": "Malware payload", "value": "335ce952e66a2e64b973c8faae9a53ff08642427ce4bc81eee880fe8710f5774c83b7f55cf290ac3363e2cd38a1b5e12", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619049, "uuid": "764c74b0-53a1-462d-9abb-b7368f490b82", "value": "F483121023F7CF18B8CE5E2D98D20ECF3F57F8B8250CA6B1611904A9E626C560B2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619049, "uuid": "2909680f-fb0e-4df0-9766-8429cf95b322", "value": "1536:wHDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdUDpEDP9+jAJue/T:ODAysJADlV378P3RPVJLdUDps+jAJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619049, "uuid": "f25c672b-0d3a-45b5-ad33-302162adec8f", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619049, "uuid": "65af5887-ecfa-4fba-a706-36d4cfa2ea29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619049, "uuid": "c75b76a4-f0fe-4f19-9015-6545066974ba", "value": "catalog-1000384496.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36ebaba-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640703, "uuid": "d0784771-c2c0-4745-98f5-68bb5955acac", "comment": "Malware payload (Quakbot)", "value": "2bb0ce4f01760f4239159c756eb006a5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640703, "uuid": "17569084-194d-474d-a470-b9be638fe67b", "comment": "Malware payload (Quakbot)", "value": "1300d82b58df6559ab5fbf15865737b9930f2566f4677ad5909c389e60025fc9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640703, "uuid": "ac54d61f-df08-47d4-aeff-5516fb7682a4", "comment": "Malware payload (Quakbot)", "value": "f18b1a3209c2f0fca609b5732171fe109b40ead5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640703, "uuid": "37a8114e-2fcc-495d-aaa2-14608a6fff56", "comment": "Malware payload (Quakbot)", "value": "f2a83cec4264c80cc1bec2463459b18d539b36e2ea4a2bbc01f773cbf85d6ef577e3d4a3bd20ebcab20bc61eb72f19e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640703, "uuid": "548de964-ef11-42a7-8644-96fb2bbb820e", "value": "59948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640703, "uuid": "e4eb6722-2ba9-4c9a-8c10-0cbc4666b4b6", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640703, "uuid": "68e66d79-8e3b-4658-ba39-3c523268c8fc", "value": "6144:fWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmAz:fWrsTwr03pdf8vhhOKJETlByQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640703, "uuid": "41eff170-df2e-4e22-8334-26e51dd64dbf", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640703, "uuid": "5531e4c5-a6d2-4c5b-91b7-f39679a6e5e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640703, "uuid": "f4794f1b-592d-4bf0-b4f2-fcf6c2c9fec7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9612422e-a814-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619609193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609193, "uuid": "f2b62f25-c1a3-4762-8121-ba90c9c77720", "comment": "Malware payload (AgentTesla)", "value": "25d799f4d1296a6a9c27fe50126fa1c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609193, "uuid": "296d4d8e-817d-4ae4-8622-b7c68ed89b71", "comment": "Malware payload (AgentTesla)", "value": "1319505fc2472a04296b950737f465502e08e41d107679c7870da0ee3c3c8dc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609193, "uuid": "2cb07274-7b42-4b3d-a1a5-595c51814e6d", "comment": "Malware payload (AgentTesla)", "value": "920a4b1d1fa3a93cb8fbb93dbff1c0311864b66e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619609193, "uuid": "2a852036-ec9d-4fc1-a794-2eb5d8a76a1d", "comment": "Malware payload (AgentTesla)", "value": "49a80e230e956b42a39d5ea5843ef8658bf21c094f3d732c3dde7ff3df832cbc61c34b61e5483782f5febd3deb860992", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619609193, "uuid": "1b7ac229-e842-4b8c-acc1-59bb0ef90e8f", "value": "5AA5B99CC09742A88F89ABB86B1F2F85114C7B6EF744A6337234977527E2C7B501687C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619609193, "uuid": "f6df6c6e-12ec-42f2-9554-c64bcbd73cbd", "value": "6144:JGkQLuyzY9dGolmWqv2FZPuhUkdybZUZXz5pvoz8tWdZei0co1vtP/k7xELTgSOR:P9ejgcgEH3xMbaPMau8huwQzZF5YgtDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619609193, "uuid": "1862359e-415b-4e70-a46c-09256df27407", "value": 2070939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619609193, "uuid": "bbaceeac-8a66-4ee6-bda5-b0fe61821233", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619609193, "uuid": "a16eab19-13f4-4b53-a3e8-d90fdd7cb574", "value": "Signed Contract.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f503775e-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640706, "uuid": "40769ae8-c08f-4ff4-85f7-41086ad225d2", "comment": "Malware payload (Quakbot)", "value": "9656477c1dedb04a87da461d352a4623", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640706, "uuid": "20ea48d2-8b5c-4826-9124-e4ff1316683e", "comment": "Malware payload (Quakbot)", "value": "132bcf82fd36ed5abf5ba7ebe62f26608dfa218e80ac5df38890befe587e3d46", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640706, "uuid": "cf3e006b-e98e-4bff-af1d-249c201cf40f", "comment": "Malware payload (Quakbot)", "value": "386f1df5957a4950727d53e32881ec29fb928d87", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640706, "uuid": "0abf8086-9750-4825-98d3-3a1e0c2bdff1", "comment": "Malware payload (Quakbot)", "value": "81cea801044fdad30297e3849b306276f26602b1dd9e8336421d3ca3528c37077a33064e3d9b43d0b0de59d0741d00f2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640706, "uuid": "1b276541-4d58-4d3d-9c53-9127627078fe", "value": "92948D396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640706, "uuid": "f00c5c48-872c-48c9-bbcb-6768982ec671", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640706, "uuid": "043f15de-c81b-4c80-9e1c-3d7e352508c2", "value": "6144:UWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmB:UWrsTwr03pdf8vhhOKJETlByB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640706, "uuid": "6427ce25-8cb8-4807-a605-5d9f7cf76390", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640706, "uuid": "f03712b5-bd99-46c4-86c0-3dfde1c89cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640706, "uuid": "e7c518cf-b9ac-4b1c-985c-dfff6b9ffc19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6793734-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623958, "uuid": "6fbe4f2c-05a4-43ed-b7d0-5b6fe31d8cd1", "comment": "Malware payload", "value": "59e528eb29beebaa0d668052c9046931", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623958, "uuid": "9a122885-9c62-4d6e-9adb-5ecf8eecae71", "comment": "Malware payload", "value": "13377e57e8164ef5673d864a4992ff9e9d769808196eda6cfa43d31f4f183a72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623958, "uuid": "48d1f881-d800-430d-a236-139019d76f2d", "comment": "Malware payload", "value": "42d12fcbcb18b8fbc162ac4d885ac5ea14e3dfd6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623958, "uuid": "4229bf0d-38c5-43a7-b990-f5ccd5e5844e", "comment": "Malware payload", "value": "cd1d4658f515af06307109e53224db53066e38b5e47d9a6387d3e374c2ce2d08013ab50de43b1b7e43eb33f9fd5fab7f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623958, "uuid": "ac4af9af-8743-4276-b93e-1f931ace9668", "value": "9C8302CC653ED1DF767D2D08A2DC893E781EACB4210430CEE4C81A6B5D4EEE75897860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623958, "uuid": "7d810f1a-68c9-4d15-a9e3-c2edc3d379e1", "value": "1536:iG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttyhWgYkCxGcf1aSZ:iGEhrHJoEsBMG7qzkch12xGwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623958, "uuid": "4f0b0d28-b74d-481b-b48a-eda95fc14433", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623958, "uuid": "e5449e9d-06dc-472d-b3ac-aabe7d295e54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623958, "uuid": "d4c733c7-e2da-4523-bacc-53488269ebd8", "value": "diagram-525390727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f4f435-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622447, "uuid": "c6c1b097-12de-4aeb-80be-dcad69505d86", "comment": "Malware payload", "value": "ecd9416028939d27176f7218b9b9883c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622447, "uuid": "3f4fb893-77c4-48ec-bb9e-fa826bd363dd", "comment": "Malware payload", "value": "134141c0edda74d6c6658fc749c8b9c64eed2802291dd2b4c298b2cb6b4b5887", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622447, "uuid": "bd497184-ebdf-4f3b-babc-e7eee08eecad", "comment": "Malware payload", "value": "ad446398ecbed6297c8540f607a3ada755d3b263", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622447, "uuid": "be634427-6df9-433a-a1c9-8bb3156a508f", "comment": "Malware payload", "value": "2159489811322f8387c8f4032a08ace90fafecd2946fb952382798e20a131e314aa2aca07a2988ab17dc8352088d071f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622447, "uuid": "5c33c3c4-8ffb-4b69-8324-10b562e5d7db", "value": "4D83028C7538C1DF37BE6A08E3DC887BBA09D5B83504355EC089655FAD86FAB4C5B060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622447, "uuid": "594dfeff-2016-4929-8d17-974d553be12d", "value": "1536:AG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZds+RKYFxQ3d+pEo:AGEhrHJoEsBMG7qzkOQxOXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622447, "uuid": "eb87258a-09e8-41a6-b282-6bd1a65ca54b", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622447, "uuid": "9257d261-fe54-426a-a259-4e59dfd279f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622447, "uuid": "448484e0-48a7-4790-ae31-4d6d417e902f", "value": "diagram-1385012694.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28c1cbf-a859-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619638957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638957, "uuid": "86ed3eca-cd56-41a7-bebb-92c7e81fdb69", "comment": "Malware payload (Dridex)", "value": "65f65610a13210934f915fad5ed59fae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638957, "uuid": "092292d0-e03e-437a-aadb-71e476c118b6", "comment": "Malware payload (Dridex)", "value": "13680ddf23d2028757f728b97680535da89795db5ae754b18838ed7815b686a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638957, "uuid": "e40bdb7f-5e55-4bb6-960c-50b91e0d09d3", "comment": "Malware payload (Dridex)", "value": "971bbf82301319920f917fb4efddeb0d29d486b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638957, "uuid": "e5c14085-3824-4801-8443-3d2f1d096708", "comment": "Malware payload (Dridex)", "value": "271184914c4004918cd21dc34f34d8857441f16cd9252bd6c1b56ca62b7bc1ad0cb3881a460a0fe9bad8bcfedc06afda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638957, "uuid": "a6e3d7cd-826d-408f-b49f-7de6362c4aba", "value": "3CF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638957, "uuid": "7205619f-c0cc-426b-a97c-85f27e7f06f3", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638957, "uuid": "970e6043-7b73-43f5-8cb3-c97985318002", "value": "3072:KlSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd28GkFY:4nS62Fl+pkeJl3CvRStrFl+EYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619638957, "uuid": "f75be5ce-a439-4b18-9ebb-37a7e08b5079", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619638957, "uuid": "0e299ffe-e319-4ca6-8414-663c48f72a5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638957, "uuid": "793a3ffc-8625-45b7-92c0-e8cb87bbf999", "value": "65f65610_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd921dc2-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626922, "uuid": "8027836c-524f-4a62-b86d-4ca6d0c5bf66", "comment": "Malware payload", "value": "b3cb1a140e88b4eda827d3bbd61e4343", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626922, "uuid": "c3f49748-e841-4b45-9d94-a4fd1b002e80", "comment": "Malware payload", "value": "136f743fcec07df771b43a64eaa74685381517394421c518ec50a31a82782e94", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626922, "uuid": "eb5a5d64-ed64-41e2-a97f-6328d9715a33", "comment": "Malware payload", "value": "ccd0b1e6bc22f72404a50c32730df4aa3b8be96e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626922, "uuid": "194ba8c3-5d29-4584-9d00-8c1ef81f0ca1", "comment": "Malware payload", "value": "81668e8d8cce98bc7cb6e643c66ce1108a0b204ada9c62af32ee74266aff9a81c6d2694ea704fe7be4d15e80d30321b0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626922, "uuid": "6771545a-a58d-4de9-abec-469abc202714", "value": "098302A453BE4A5CB88D4E29ACA20D4F3FA7B6743D0E58F1B91D0485A335C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626922, "uuid": "4e706add-e9e0-4403-aef9-3c55ee00751e", "value": "1536:YDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9hsMnSEwJPTm9Hd:YDAysJADlV378P3RPVJLdLxpEWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626922, "uuid": "425ce886-8757-43c3-b04f-d846f144d4d8", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626922, "uuid": "744767d8-dd70-49db-a536-11c3d5cd7322", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626922, "uuid": "2a3c4f0b-e78b-4c15-8f3c-7418e6f6ea06", "value": "statistic-593919221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31c0b14-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626073, "uuid": "a774484d-ea96-41d1-8b25-03f07e5ff80e", "comment": "Malware payload", "value": "2e1c7975a5d4c953493c992ef637e50a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626073, "uuid": "ea6da616-ab42-4c2f-be44-0151ee0fdae5", "comment": "Malware payload", "value": "1390618803318a2221e86ff4af7c4c52392376b348f158c8a1d1d925303cf80a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626073, "uuid": "9bb9336f-5365-499d-b3d3-0afa24644750", "comment": "Malware payload", "value": "461fc5a5c6f364d2a2bf402360fc513d58de2839", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626073, "uuid": "3673dfab-1465-4b3a-a42e-68b36c9451d5", "comment": "Malware payload", "value": "7000ff4b1c988f222fe30a9650bf3adf574979eb977b119dcb12e58ac901ee5f8fcd56f74b11f5ab42ef406d3321f563", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626073, "uuid": "e06d470c-74e0-4357-9fff-3f14f6148f8a", "value": "B38302A453BE4A5D788D4E2DACA20D4F3F66B674390E18F1B92E0485A235C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626073, "uuid": "8a9e7f2c-2e9b-4498-b0c4-9c03f703c374", "value": "1536:xDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLddhsMnSEwJPTmQ7tKu:xDAysJADlV378P3RPVJLdrxpExsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626073, "uuid": "7746264f-8002-4a2a-889a-a86e7ded1097", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626073, "uuid": "2254f857-ec24-4695-b2cd-86eedd7fbb8e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626073, "uuid": "41666b57-15dc-43ca-b20a-42b7c2655674", "value": "statistic-1942822235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af81b15-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619619429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619429, "uuid": "e99e0c3d-a93e-4066-aff5-3e8b5376c2fa", "comment": "Malware payload (AgentTesla)", "value": "d3e5f802575eee446522f2341403d307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619429, "uuid": "7f9d3ec1-8660-44fb-a6fa-c0173d17e87b", "comment": "Malware payload (AgentTesla)", "value": "1397eab0270289529612e24e011c24bfdcff9b8a3ea2d58ea995f94a3a9cb730", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619429, "uuid": "00814a28-89d5-4042-b319-91844efc03fc", "comment": "Malware payload (AgentTesla)", "value": "e195d680c574491ed767b18d96eea371223a75e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619429, "uuid": "911df8e8-2058-451e-971c-14a7ce09b523", "comment": "Malware payload (AgentTesla)", "value": "6b23f737b2e2149bdfc31885b8d9dec73afd9e9abe8966e691ddfe7253789907e0142a3e2c3d31ee6ffe1b03d7e8aa4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619429, "uuid": "3cfc7656-cf40-489c-8e53-7f77fca4de18", "value": "23A42310C5E554489E840196913AADB71EC92B1D228FAFC3E04707718BEAAAD17FF68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619429, "uuid": "39d23c77-c392-4cfb-a73a-ea5ba50d260c", "value": "12288:zsTtbHz6M5ctUkGF0OavCwFDWlevdIz6vdgs:YJ6MPFQD9vdIO1gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619429, "uuid": "12244988-fcfc-48c3-85c6-bc41b6e21da2", "value": 476265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619429, "uuid": "2b591b72-65f4-4635-a9ee-a044888783b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619429, "uuid": "f3d58365-115b-4582-9472-54ba12fb0932", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee2d87e-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627086, "uuid": "3144a09c-fbd3-4a2f-80bd-30d1243f9d22", "comment": "Malware payload", "value": "447723f851534543eda7e7d60f728dda", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627086, "uuid": "4175080f-79d4-4c17-89f1-2b83bc01a71d", "comment": "Malware payload", "value": "13b6fcaaf93ccb12e6a91d34c26b16a47d645cecb68786f4d5b6b1a1e5557f97", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627086, "uuid": "4dd4992f-2df9-4f7c-b71c-45e80f097f35", "comment": "Malware payload", "value": "709fb46667e3ffd385b0bd7d7d027077b775125c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627086, "uuid": "1f611cfe-a3d3-4c18-be58-2d6999496b7e", "comment": "Malware payload", "value": "c4438a31bc647ce83944470d90287041b24a0b5d068c92ba00abb364869e0e55b26850fcb6826716833e909ead8c75d6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627086, "uuid": "44943101-35aa-4ce7-84e4-f396adcabf41", "value": "AB83021413FA8959F48E9E39ACE20DCF3F5AFAF43D0A58E1962E046563298511F3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627086, "uuid": "662dd7a2-0f37-4b81-9db7-f0c838192717", "value": "1536:BDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wBX1a:BDAysJADlV378P3RPVJLd+eh8wBFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627086, "uuid": "859e76a9-e5af-4fb2-b965-aba7b7faf55c", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627086, "uuid": "7dc55881-1984-4358-880d-33fc03ce1f02", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627086, "uuid": "a8d60ac2-c1a0-4e3e-8f6c-acc489f33af8", "value": "statistic-703280858.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1e5596-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626896, "uuid": "d6536346-ed6e-43fb-9245-0608a20a8482", "comment": "Malware payload", "value": "c47492b77dc430ca6cc7c60fc4a74328", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626896, "uuid": "e7da48e2-d644-4202-8a49-39c6496ccf7b", "comment": "Malware payload", "value": "13b97f1594f22a19d4e8e89fe280b80bbc7c1ef9780e00415d82876883180014", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626896, "uuid": "92e05f24-16f2-47f1-843a-b888ac020e54", "comment": "Malware payload", "value": "42c459727c2f080bd6b95489bb17ffa85b08ee96", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626896, "uuid": "cb3939f8-1756-4503-8985-a490cbe2e432", "comment": "Malware payload", "value": "4fcfbb02e4dbb67bf539d010ba3a3545b505103ca13a4ff59fcba0808765a6c83a3a82a0d441bbc8a70a4b2bc05017b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626896, "uuid": "679dee6d-c111-4c97-8a2a-f40ba2cce6aa", "value": "3E83020413BA4909B5CECA2D8DC31FCE3F57F8B415194862A65D0099F627C6B9F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626896, "uuid": "45f223d5-063c-4ee3-90b4-7c9c0f69552e", "value": "1536:BDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n19X:BDAysJADlV378P3RPVJLdcKu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626896, "uuid": "e585a026-76e6-4aec-8b11-d2cf8e40ecb0", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626896, "uuid": "840bcebb-dbd5-4b00-8ee0-a96c4d0a8f36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626896, "uuid": "f2b28157-7d9f-414c-b0e6-312c490403b8", "value": "statistic-578418635.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e825b81c-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619639, "uuid": "b223774e-9f86-4993-9b03-2542088d4b21", "comment": "Malware payload", "value": "4e3de40baa565a636cf1383597ae04c9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619639, "uuid": "c38a0c48-0a47-41b7-ac5a-f5ca989001a6", "comment": "Malware payload", "value": "13c808cb2b99e4bd75e22cc85e5a0c56ca04168b60c1f3365941a6597eb720e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619639, "uuid": "de71cd91-955e-4193-a408-5b2ee7844f0d", "comment": "Malware payload", "value": "186cb71e5abaa6cc1ae64bb06a99d39b1feeb4a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619639, "uuid": "5fa869d4-fe45-489f-8a25-b8578ab75f2e", "comment": "Malware payload", "value": "6782a441ed21c63b886a9fab4d1bcd25c501be60fe478c0b003eaeaaf11168a647d0859b7fc6d460c16569896611e707", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619639, "uuid": "36c89d96-0795-403f-8ee8-47b03c47f852", "value": "3E83021413B94A5EB8CE4E296CE31E4F2BDAB8F4192A54D1794D04E1F2378660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619639, "uuid": "eaec1fd1-547f-4d5d-a918-17f021b8189b", "value": "1536:5DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wO:5DAysJADlV378P3RPVJLdP8BX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619639, "uuid": "d2cc8b3a-9eb1-4840-b9e2-76feff53422c", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619639, "uuid": "bff55005-568d-44bb-899d-ee116bef703c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619639, "uuid": "850e191b-0093-4cb1-a2f3-fe76631e4087", "value": "catalog-1400895697.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69978a9-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640708, "uuid": "509c2a74-a654-4451-90d3-a370ffeb3258", "comment": "Malware payload (Quakbot)", "value": "f570e9fd85106cfc924a0cfb5b20845d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640708, "uuid": "0b125512-5add-45df-8418-eecee913a9d7", "comment": "Malware payload (Quakbot)", "value": "13d86549f5d1101f3f725b5d254343e18cf8271030f6f5a7a68467af45150ca5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640708, "uuid": "d874a3ce-84a9-40ad-b860-40713d10aee9", "comment": "Malware payload (Quakbot)", "value": "d0b9f25cd8a6ec2fd7d5894c10d044b9ba240686", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640708, "uuid": "87c55804-ff8f-45e1-9cbc-014f04be816b", "comment": "Malware payload (Quakbot)", "value": "426ee83cee945bdc109428ff6ef26e22578f571127b66acfdbcf65f02429f6c0114bb4295626b05cddcee65a44a61062", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640708, "uuid": "a15422ba-30e7-4f24-baaa-5041d6e91095", "value": "BF948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640708, "uuid": "d1a557ab-9bb5-4371-9e07-b605fcf381dd", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640708, "uuid": "69119e07-ed0a-4f1b-a5b0-1734b0cc73e6", "value": "6144:qVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraO:DFNmLKSVpJbPT+4xrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640708, "uuid": "945c1ad3-8ea9-4108-962a-1ec71e0c40ec", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640708, "uuid": "c7f147a9-3b27-472f-8567-1b379c74b0b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640708, "uuid": "99df040f-eaba-49e8-b317-b2b92c42afed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bedd19-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619615, "uuid": "24bc7a38-db4b-42ce-acf7-da055746fa28", "comment": "Malware payload", "value": "01be0b73c4500934d7baba7667ba60de", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619615, "uuid": "f0a9a289-f1b6-41f2-a528-1a54522f4160", "comment": "Malware payload", "value": "13dfc6ea0390619e6171823c48b1214c8d05c12f62f0ee40c820d96463f4f591", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619615, "uuid": "c4e69aad-a336-43b1-9447-d76fac654b69", "comment": "Malware payload", "value": "4c8f77f27fac241a55570658743610a6027f0e9d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619615, "uuid": "0d0afa5d-7650-420c-9cd4-ee1e8e708a10", "comment": "Malware payload", "value": "4301c5f795ef6789a64d6e84b4837b8d280b9cd2f15977592495302f22c917dcf9686e3196a9fc054f189a24adfc843e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619615, "uuid": "c6109a9c-a221-48a4-a0d9-008f61b60c67", "value": "CE83027043EA4F4D74CDCA3A5CF21DCF6B6AF9B43A1D48B0566E0452D227C962B2853E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619615, "uuid": "aadfe432-2745-4a72-8502-09b1c96fb2b3", "value": "1536:qDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdRE58VP0IsOzCy2BXcEnvuY:qDAysJADlV378P3RPVJLd258VnCy2BXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619615, "uuid": "cda44915-7c4e-46bb-ac0f-059c3567e5b5", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619615, "uuid": "c8ec7284-0581-4276-a532-a1cf90a1d7d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619615, "uuid": "fb5feca0-d2ee-491b-b380-ce3b384f212b", "value": "catalog-1383393849.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02bc34f-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627249, "uuid": "a63ecffd-a168-43d2-b9f1-15066e38212f", "comment": "Malware payload", "value": "31325e1a73d51393620d8c5e59f070c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627249, "uuid": "87c9abab-acda-41a3-9728-15428e77c0ee", "comment": "Malware payload", "value": "13f6c074c355212f7ffb1732254bea1d72a17bf49cc26ba21179a2025f8e7efa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627249, "uuid": "cdcd6e60-fb62-4ed9-a6b4-ed70436efb0c", "comment": "Malware payload", "value": "5c2dcee068bdce09abe669045ea2b07a89902570", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627249, "uuid": "4f53263e-251b-4493-baa9-649c854d9d3a", "comment": "Malware payload", "value": "eed9585fe41522fbfbd5bbd6e698c21c9a8e79cdc507ffb8080d91bc3afb6a3e8bbc75e6103198fbdb86d7e89e0f4804", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627249, "uuid": "fa7835be-4f1e-48eb-bc16-0a31ddd3626e", "value": "FB830220437ACB1DB58E9F2D9CE31D8F3E5AF5B02A1D98E1753D04A4F166C110A2467D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627249, "uuid": "23d1a4d9-10aa-4a2f-99af-45cf5d92d47d", "value": "1536:yDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdn8rZctFOLVVrCvI7w5:yDAysJADlV378P3RPVJLdn8rZc2xCvmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627249, "uuid": "ee07e18a-8464-4ef7-a37a-f7a46d2d003d", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627249, "uuid": "c0ab2e28-2295-464f-b72b-f37443be00db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627249, "uuid": "f8abcbea-a503-4918-9e3b-10b84dcf8783", "value": "statistic-796665476.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a38a1f2-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620555, "uuid": "5763cd20-285e-4687-a9b9-53f3e72957d9", "comment": "Malware payload", "value": "ecadf0fe33bb8b8daaf19e7b582d1769", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620555, "uuid": "fd6aa0e8-b1b7-40ea-8cd9-87f6c9110e1b", "comment": "Malware payload", "value": "140126c424fdba20e9837d7fd4fe39198b090bcc3e1d3dfaaa944c4500b207fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620555, "uuid": "8d596d33-dc40-4fd5-92e3-107bfd39d04a", "comment": "Malware payload", "value": "4839a633dee7af8d8b2b41dc303c07407c46c7ae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620555, "uuid": "53e09514-4a62-40d3-9ccf-579bf0f8d5a7", "comment": "Malware payload", "value": "75a5a0ca571eb884b74e69d945cbd709035b653641974480ef5295bc6ae54dc5fe746441ca6de7df424d6a54c66989e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620555, "uuid": "4d462ad7-7112-4775-a107-9bb2866a4f78", "value": "AC83122003B78F4970CD893EA8E31E8F7BAAF5B82C2E98E1556E0465E127C551B2447F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620555, "uuid": "ffafea38-1f8d-4486-babc-d8fc3370302d", "value": "1536:1DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd3cZ8VzpIsOKuyD:1DAysJADlV378P3RPVJLdsZ8VuyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620555, "uuid": "9941736f-976c-4eda-bd87-98e5ad231b8f", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620555, "uuid": "3f0e5934-f422-4856-808d-6900f8281ee4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620555, "uuid": "745d64a1-3964-4da7-bea5-a919a041ebf5", "value": "catalog-1996841094.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b79db3-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625938, "uuid": "0fb8b39b-1948-4f7f-979a-e00e5435b34f", "comment": "Malware payload", "value": "77ea7be5bbb681493578a1dc230759c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625938, "uuid": "470e133b-fe1e-40db-badc-4ea56b9fbe53", "comment": "Malware payload", "value": "1423028f5292ad1b045d3a6f3aed10011db9b219d77894ea55ac73ea7efcdb03", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625938, "uuid": "8808ad95-b1be-4d99-b80c-4f0e9d9fab42", "comment": "Malware payload", "value": "97ce400e6f981439cd2244a53fbde721896d8d73", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625938, "uuid": "aa3583ce-3284-4b25-8752-a2538873ffef", "comment": "Malware payload", "value": "b450802c9ca905144e14b03d728c9afab968c1d6e45f526e81bd8a7baaf34874d36847624fbd013b6a51fa15a688a628", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625938, "uuid": "be34cca4-aceb-40ab-9718-d8b3ca668c32", "value": "3183021563B9C998F58D9E2D4CE30D8F3F42B9781D1ED9F26229019AE227C560F2493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625938, "uuid": "ae9bdf2b-0b23-487e-8b62-cbb7f9ef6e46", "value": "1536:sDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYPqXT/WkO0B19M2l4:sDAysJADlV378P3RPVJLd8qXjN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625938, "uuid": "14ec0cb4-b410-4619-af4c-82698d1bbb6b", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625938, "uuid": "32e0a147-b105-4eaa-842a-75569d9bdd43", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625938, "uuid": "9c4034ca-42cc-4325-9180-c2220e84eaad", "value": "statistic-18564406.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800cc8d8-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623329, "uuid": "328a1184-d842-4f9f-a1ef-2279b7db0bdd", "comment": "Malware payload", "value": "8cfc0994fcc0b952d1e963c817777a5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623329, "uuid": "ebd394da-430d-4b3b-a7fa-af9a4968a006", "comment": "Malware payload", "value": "1429e5d00c349838109bc5afc777fc9eb178e4127ecda0bde16326cf67e6ce51", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623329, "uuid": "1c5d3658-b857-465d-9972-5f11b5f9af52", "comment": "Malware payload", "value": "29ff6c89ba283de9df2f49d14acbfc7a0a3bf9cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623329, "uuid": "081cfe61-6091-4d1a-9e0d-b4bc74f4b50a", "comment": "Malware payload", "value": "1612a1a0cd21fa6bb1104c75de9156eec1dfdc510e98eeed7aac5326f75b2aaf7ee4c84dca0b25247c89070de8a39d80", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623329, "uuid": "39d2080c-bd55-4c0b-be15-d9e328e199b6", "value": "0283029D653DCADFB1AD2F09A3CDC53FB61EEC623008148ED8C466A65C49AE70C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623329, "uuid": "15c8cf8a-688b-4215-8ec9-6f5007dd9e7c", "value": "1536:JG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5de6n6475e0NEnP6L:JGEhrHJoEsBMG7qzkZ4q/NEnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623329, "uuid": "0be3dfeb-8bc7-48d8-b1f0-9dc6084a073e", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623329, "uuid": "42aa71b4-d4c4-4c03-888a-5571047e3bbe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623329, "uuid": "48a29f87-6c3e-47e9-8099-47f0cba21958", "value": "diagram-2017075107.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564efd25-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639151, "uuid": "3fd29f83-6362-4b2a-890e-fefda21ff678", "comment": "Malware payload (Dridex)", "value": "70a5b2aacf3aa14daa2937f8be3e9e30", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639151, "uuid": "dcf1c240-bc28-45e3-b7ff-3932d710158b", "comment": "Malware payload (Dridex)", "value": "1436a09c2d9aa4d669d8649c2b0a47f2ae070eaee8407d088e53571b35222cbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639151, "uuid": "b1f417b6-6461-491b-b76f-8bdef4612012", "comment": "Malware payload (Dridex)", "value": "153d5a4ee10a93dcbdd49db45751803453315fef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639151, "uuid": "5b50a7d7-a12e-4ced-8134-20d5a2567952", "comment": "Malware payload (Dridex)", "value": "3b52b818631808f77d5da2052723206f40bddcd7d34a6322c4410c9a99d65fdc611fe63cd7cde32858edc3c8c31f08bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639151, "uuid": "888eb245-2fee-4d3d-baf4-ae11a6cffd2f", "value": "43F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639151, "uuid": "12b43bb9-bcd4-44ce-b789-883a3b67cddf", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639151, "uuid": "710f3ab5-9455-4e17-a958-93c391359ec8", "value": "3072:MBT2d85tleLD51fC5AHYEoefukoTFMpGmj78D:py5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639151, "uuid": "67d084c6-10e0-4e26-9022-55fccf1ec15d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639151, "uuid": "5b054d58-994e-441e-888a-b9117d7d1402", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639151, "uuid": "9f81708d-a254-4815-9ead-3bd834db2cc8", "value": "70a5b2aa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cad38e-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620687, "uuid": "cb172f3d-0e76-40a2-94f6-976f73ded366", "comment": "Malware payload", "value": "b039b30e38998233cc7719e026d019d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620687, "uuid": "37f5b0e5-fba5-4558-bd08-7a58a1f718cd", "comment": "Malware payload", "value": "14427e15d78d76bfef88f21f6bb9de95197b8ab0302ebe85b0e38e4e381851ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620687, "uuid": "d0de8942-3810-4b3c-ae88-bc9ed7e07449", "comment": "Malware payload", "value": "bb8dad9e52c183a6303884caea4c7e8fa8d71232", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620687, "uuid": "bace41f6-db38-4b3c-8df7-ca499ebc4bd6", "comment": "Malware payload", "value": "2ad9244f32ccf9049eafeb2b7d447ae54d0b17c3d14817acb7d8c69471ba0ed59865cecb87860b174644e4274cd2c0c1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620687, "uuid": "eae79c25-030c-4f9f-80e2-eb63e0701b7a", "value": "1E83025413B94A4EB8CE8E196CE31D4F3B9EB8F41A2B55E1795D04E1B2334660B28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620687, "uuid": "fafc7189-87c9-4bbc-89a4-79a7dbbc664d", "value": "1536:mDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdnIkGV8BAY0w1c:mDAysJADlV378P3RPVJLd68BXPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620687, "uuid": "4f2bd0a9-1ad0-4f70-bc88-8e739680f541", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620687, "uuid": "84954325-c823-434c-b3f6-5f684091ddf7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620687, "uuid": "fea3a3be-4b94-41cd-b99a-f38f739c59e6", "value": "catalog-20698307.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90716967-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619062, "uuid": "7c024398-d53d-4ac7-8c47-010ad63ae5ff", "comment": "Malware payload", "value": "bf1cdc5705ba24578d64a65964c66b2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619062, "uuid": "8bdaf4ef-f45b-403b-a751-8666b840a12f", "comment": "Malware payload", "value": "145f0962b146f0f017171b075eab78aa12b56e5d63b3b8ed69a8ceda6abdaa23", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619062, "uuid": "7d54f554-ad20-4c7f-8e93-5fd0f49a0a74", "comment": "Malware payload", "value": "8bad15c59c5c6dd5738bfd55b7ce9e11799e6e08", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619062, "uuid": "18238499-f387-41bb-9a0c-6da3209df99f", "comment": "Malware payload", "value": "63817722a8995a33916576aeaff3ee6c8649e312c229b5585b79762866e2c5d966527004ba126ebce2024d0d968d5630", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619062, "uuid": "a0197326-89c7-411b-85bf-4738d7dbeb6f", "value": "0183021013B58E4CB9CE9F295CE21ACF2FA7F9B4160D69F565280894E722C474B14A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619062, "uuid": "d476db84-886e-4488-9ceb-e346c5ee0647", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJc1:4DAysJADlV378P3RPVJLdlDpH+jAJc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619062, "uuid": "15896974-4f43-4fc8-9315-f5afcb6f850b", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619062, "uuid": "7f21e851-8f0e-463d-a337-dfa571e914f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619062, "uuid": "9a4aaa76-ab2c-4877-944f-661919771d4e", "value": "catalog-1009007485.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9528e8-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619915, "uuid": "370215c7-d5d4-4f18-8a53-43ec47638208", "comment": "Malware payload", "value": "0fd8cd32bc17d1810af727019fa5f65d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619915, "uuid": "e40116e6-9ab8-4345-ad3e-c1c82e7c8a61", "comment": "Malware payload", "value": "146992cf0d92cdbc7bfb53e64344d84aaf155305c9ef4e3f8813ecf9be674a0c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619915, "uuid": "f889988c-1449-4b74-bc44-85572c15006b", "comment": "Malware payload", "value": "bb3eb85962d191098f018a06e6ab77c1a537e5d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619915, "uuid": "b38175aa-7a0f-408e-a62b-320c0832648f", "comment": "Malware payload", "value": "d045e3efe450afa8f630dd8314e4f190c12ead28eda7c426b69bb9dfc23cf85c824190abb29c00784eeb6ba262388f2d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619915, "uuid": "8c273031-007e-48fb-b9f2-e2b329874517", "value": "AC83028093FF4A1DB98D8E3894E21ECB1E56F975280DACF164BE18A0D6368461F3457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619915, "uuid": "0b87aac7-b1fd-417f-ae4f-b6239533914e", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd+eJMFaAfblTrLXx:CDAysJADlV378P3RPVJLd+eJsfbl31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619915, "uuid": "d0fbc29c-4a4d-4040-8915-170207f75c91", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619915, "uuid": "c24397b9-175b-4180-ba12-ca18f02bd216", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619915, "uuid": "40fdfea8-cee1-4073-b3af-39ae6f839ce1", "value": "catalog-1623894913.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f1c57f-a808-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619604046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604046, "uuid": "edd0f8eb-dd89-4578-b2a9-ca6753885171", "comment": "Malware payload (Dridex)", "value": "0ee186f44b84d2bb5a1b946bd7af7161", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604046, "uuid": "99af5b94-4ef5-4b08-a09b-e204a1be2515", "comment": "Malware payload (Dridex)", "value": "14706438b1e4c1f59b0cc37cf64b94bb5902c86578ef9388c1b58361c6657e1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604046, "uuid": "cc0fbd28-a4cd-481a-bb1c-890c3e335891", "comment": "Malware payload (Dridex)", "value": "e947aaacbbdd28d76604f51598922b3a86c93746", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604046, "uuid": "040e46f6-a30e-4c9d-bda8-1b17895d3cc6", "comment": "Malware payload (Dridex)", "value": "9fa540cd5971a70c5c506db2998442aa6f9e155c58f6f1749c6e3e7ff1627f40a09d9fe9a194a097af54678822f1e3f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604046, "uuid": "326cd128-9813-4390-b1a4-c3c1acd2658a", "value": "E3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604046, "uuid": "d9a0b519-28e5-4543-8e0c-3fe071708504", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604046, "uuid": "535efd60-020b-47ae-ac3a-115577b740f1", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619604046, "uuid": "e95486fa-3899-40a9-b377-6adfd3e8d08b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619604046, "uuid": "b122526b-39a6-407c-a483-1a97dfbe96bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604046, "uuid": "b859f092-021b-496f-b5ae-ef3b32003899", "value": "0ee186f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e35c8e1-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645150, "uuid": "9e168346-2be5-467a-b4d3-80b317fb0f29", "comment": "Malware payload (Dridex)", "value": "81335ad5910e735fceb810fceed50701", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645150, "uuid": "77c35ba3-07fb-4bb2-8056-83dab43e312d", "comment": "Malware payload (Dridex)", "value": "147e5b21981bf6d19f65f25833a547fc72c69a9e5b7cb0c244265ef395d70ae2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645150, "uuid": "33b5b112-8adb-4f4c-a4e7-2492f0832111", "comment": "Malware payload (Dridex)", "value": "82eabd14a482307785ca889ec87cc43fe6548bbf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645150, "uuid": "d5409a3d-36e4-482f-8dfb-faceae88dd2e", "comment": "Malware payload (Dridex)", "value": "3a4e38cbab1816f9d652c92ee825cc769aea9a4d8ddbe4f2dae63672d7579a759481e6e00d9a6a470c41dbf55bab42ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645150, "uuid": "683657fa-0317-451c-ad97-b84532659145", "value": "40F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645150, "uuid": "db397f01-4889-4edf-a271-4fedce767054", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645150, "uuid": "49445c3f-b546-4812-be0a-39a33825ba4d", "value": "3072:Xs8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYXZwd:rnClX8WZ7/HrRCADTR0VldZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645150, "uuid": "b4e2a6d5-21fa-4cfa-958b-b914f78c5043", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645150, "uuid": "392449dc-625c-4125-865a-72f4549b0a35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645150, "uuid": "274ebdee-e9e7-483b-b9db-4ea72b90d939", "value": "81335ad5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84b776e-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640711, "uuid": "01c9a126-346e-4594-b00a-9be69228d6ad", "comment": "Malware payload (Quakbot)", "value": "880c4d17996e18f1aa2b17ad63f51896", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640711, "uuid": "017c7816-4c99-4b01-af69-bfd3f871c8d8", "comment": "Malware payload (Quakbot)", "value": "1483bc3469d523d467a50744b90301ebc15745b1bed5d7b6230a4dc6aba9aa15", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640711, "uuid": "217494fa-3bd9-4b7f-98aa-258190d13711", "comment": "Malware payload (Quakbot)", "value": "68a44e54a7398a727ce14f9501a2593393c17218", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640711, "uuid": "7679c063-b8f5-4e7f-b663-889765af7e12", "comment": "Malware payload (Quakbot)", "value": "2f8dbada56b1c32b0578324ed93fbad4460c8caf0f822c096dbf4c721c58529dc7be2d249fc812382416037aaf69b5df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640711, "uuid": "550b25c2-9774-449e-b04a-258bb29da5fb", "value": "EE948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640711, "uuid": "9fc6208e-2b78-418e-998b-84b02e8400f2", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640711, "uuid": "a6bbdf14-6df9-46de-a8fc-017cf2fa2518", "value": "6144:yVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraP:bFNmLKSVpJbPT+4xrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640711, "uuid": "a9c7cb68-8519-4dfe-bafe-34ecab67952d", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640711, "uuid": "354ac8f3-ac81-48f6-b7df-c51be56dc3ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640711, "uuid": "57274e63-a2f1-4114-bc75-6b6286088f60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a72877b-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622944, "uuid": "a854ff8c-93b0-4d59-a165-626a61df778f", "comment": "Malware payload", "value": "1bf6700ecd885cf4e8da2c99206bb841", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622944, "uuid": "2a3c448c-79f6-4232-b9dc-742ccc3f5f72", "comment": "Malware payload", "value": "148673dba026e86a8a3f3a4632ad333a23aa9099ea7dea783f177e337df15002", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622944, "uuid": "679dd7f0-2182-4192-b11b-fa61763593bd", "comment": "Malware payload", "value": "1b7f16d9e423e63f9d2710304dfa7868d3eaeb97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622944, "uuid": "b0c53f62-e7c0-4968-b640-17abf7b8a66e", "comment": "Malware payload", "value": "d698b727e5ed36441a4fa7e93eedda505c7fc01056c99058b7a0f2bb9d1b42f94db5769bdbcad66668663f86f66c5df2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622944, "uuid": "86648439-a60e-490b-9498-61c65ef71f19", "value": "6283029C653DC6DFB0AD3E0952ACCC2BF50DB8B93004748CD8C46567CD99ADB58EB590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622944, "uuid": "fa9d58e2-f9f2-4acd-a7d0-672c019c514c", "value": "1536:HG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttrrjMw:HGEhrHJoEsBMG7qzkxrjMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622944, "uuid": "5212f7ca-dd9a-45fb-bf61-ca4def1af14c", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622944, "uuid": "c1ec1190-5cbe-48e6-aed5-bc44d9485118", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622944, "uuid": "c2a5f366-22c2-4fb7-8d22-240ef89f7a1b", "value": "diagram-1751740225.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7651c777-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621166, "uuid": "5ed735ae-7e9e-4256-ab98-de28a9add5e7", "comment": "Malware payload", "value": "99f179b6895f44d7a13924acef254821", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621166, "uuid": "cd106fdd-9799-43e3-9a1b-04542b664641", "comment": "Malware payload", "value": "1487bdbeb76aa78b2d17e9b8fb281e86065642620ccf8f4c6296a60f6939b303", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621166, "uuid": "ba9f1956-172f-4892-bb1b-387d6c0cc990", "comment": "Malware payload", "value": "43083f33d77a7a26e1a8a9b2ab51b3ab4be9d245", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621166, "uuid": "506310bc-ae03-4611-98e0-24bfb9405733", "comment": "Malware payload", "value": "ad82276d1cfe3cadf4d66eff41f5aee21f0fbd5cba5e989b59599e9b7ee946430d57b5d74c81c7b7ca1336a36a2b2e57", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621166, "uuid": "cdc7b4b0-cd47-4e1b-a3cf-3846614d19ad", "value": "DF83025413B94A4EB8CE4E1D6CE31D4F2B9AB8F4192B55E1795D00E1B6374660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621166, "uuid": "4783bab1-264d-4fd7-b462-b75888501c41", "value": "1536:+DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdnIkGV8BAY0woq:+DAysJADlV378P3RPVJLd68BXSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621166, "uuid": "b60edfeb-8b88-4245-b522-0e9276926a34", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621166, "uuid": "87d0a03c-d238-4d0c-b616-119e8e06b1ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621166, "uuid": "81872df8-7aef-4b83-8c34-6d73cb33ccb0", "value": "catalog-441038436.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e1a6b9-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622906, "uuid": "e05e00c8-e8f0-492e-9759-fa0fd5ad4ace", "comment": "Malware payload", "value": "5c06cb3da969c26ee018d06843c9447e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622906, "uuid": "a6ae959d-be44-48c3-b546-a58f5a8d469d", "comment": "Malware payload", "value": "1488da83de809a27d4e41fc385a0b9bc3b979234679ed01c78b51431e7ea27a7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622906, "uuid": "f585061e-6871-4192-8244-cf0d8bdd4eab", "comment": "Malware payload", "value": "6304ef2be4f5278d3496c48647e52eb839ca27b4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622906, "uuid": "1d59eddb-82e3-476e-aa99-33286bb71509", "comment": "Malware payload", "value": "26214fa30adc90b54a12d88c61800d1f1266552cc7d6d9f3cbddbd4ede5907ac43a552b776a71807454cff622c9cb062", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622906, "uuid": "ec299814-ae21-45e3-942a-fcc3c858a03e", "value": "1C83028C653ED2DF767D2D08A2D8887E780DECB4614434CEE4C81A6B5D8EFE758A7460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622906, "uuid": "26035abe-a471-4069-ac6b-c0a21d79a876", "value": "1536:DG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSX:DGEhrHJoEsBMG7qzk6h12xGwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622906, "uuid": "bfd4e67b-0d7b-4973-9883-e53055a3ca45", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622906, "uuid": "0d27318b-1fb9-4fc0-b1ee-7720dea600a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622906, "uuid": "83d1e2b9-bb38-49b9-8b33-adb0068a7e76", "value": "diagram-1736695323.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab814b3e-a7c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619575299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575299, "uuid": "91d375a8-83c7-485d-a605-ae856e8c5ec4", "comment": "Malware payload (Dridex)", "value": "1dbb1d3f5291c9899bf4f33e1ec59008", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575299, "uuid": "dbb88a22-382d-4cbc-b1c5-eded431c4e78", "comment": "Malware payload (Dridex)", "value": "148b54ac52ec26ac3ba23416a771e7f761d5122abd6a04600c01a6e57c8c371c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575299, "uuid": "32881ba7-987b-4a4b-9681-dd055ae7f0c8", "comment": "Malware payload (Dridex)", "value": "de409da8bc8703adbfb3ea69826d4681c929c2fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575299, "uuid": "aba32a51-1e62-4f2d-8d83-1f779484fb1c", "comment": "Malware payload (Dridex)", "value": "d817f11cdf171eda6a341c2d547c55ee82c4823d2a2d422110b19814f5fe4f6eb668c7975f38add1fac9ff520f9eb0e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575299, "uuid": "a857fe00-9c03-452d-95e8-947b5dd236bb", "value": "B7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575299, "uuid": "1c0acbf2-4d68-401a-8713-da17ed194370", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575299, "uuid": "141eaa73-51d1-4c6f-b963-81c986841370", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619575299, "uuid": "c8c29e02-c869-4708-be14-949419c47b2a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619575299, "uuid": "26e30225-5ba2-4c01-bded-1d247968c8c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575299, "uuid": "5b2339ad-4b83-433a-a69a-72c9afa3ea77", "value": "1dbb1d3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be15372-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646140, "uuid": "719d46c0-3cf4-4362-bc2a-54f1e368533c", "comment": "Malware payload (Dridex)", "value": "bd56ed178d16e699398ca48da9bc82e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646140, "uuid": "aa86a688-1300-485f-918b-5973a1225176", "comment": "Malware payload (Dridex)", "value": "14a3884d4eb6b07187cdce28fa0b4f6e13aaebfd20dc7faee0aa24db36174614", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646140, "uuid": "2d144f73-53a2-47e9-8eeb-b3057c3d890c", "comment": "Malware payload (Dridex)", "value": "f3e15919944d6b31523011df78765bec7313b6b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646140, "uuid": "6d5f05fb-f959-42a3-bb34-07f8e1d8effa", "comment": "Malware payload (Dridex)", "value": "79fc7ba13785c9c4b6fb916be521ea979d972ea2c2dcf7dbb1b9a88d035ded7027d2ce17a18d3a2c6c9245c3d7ac8193", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646140, "uuid": "bfdab21d-91d8-4c4c-8b75-67a2fb5137b9", "value": "56F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646140, "uuid": "c9be1fe1-c66f-4b1f-82bf-bdd13c73f9e6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646140, "uuid": "b38c7d69-5ad6-41e9-a931-319ecb8b04f6", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646140, "uuid": "18fe7e14-1c0a-4a00-bcd8-1670df94d69e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646140, "uuid": "370b9c72-027d-4862-b8b7-a2260065da09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646140, "uuid": "22067944-9dd7-4655-8f33-0af1b1dc2ffb", "value": "bd56ed17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d353474-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625445, "uuid": "a181768c-12c1-4db3-968a-af2cf63da216", "comment": "Malware payload", "value": "a81736f96178a93eecc1e296836e203b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625445, "uuid": "91c583fa-16e3-4243-b370-a88907cd2901", "comment": "Malware payload", "value": "14b375b24dd8c2ec98931aaea9428edd99deffcea69275811017ab61e9b1b314", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625445, "uuid": "173a4f6d-0a9c-440b-82fa-7656beae0ad0", "comment": "Malware payload", "value": "96225d10240d201312a5e8f8f553088a21b2bfe5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625445, "uuid": "53a7d65f-dab2-4694-ac9b-757456148cbc", "comment": "Malware payload", "value": "a8de39a01b44631ec0d0db65df1b02979e7597ed9be7a857b83671a26e24c235b58acf84fc7b7091e7de54570ea09b24", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625445, "uuid": "b84d45d4-9bb9-4b67-9ad0-ae9fa2894cae", "value": "A283020813BA4909B5CDCA2D8DC31FCF7F57F8B415094862A65D0195B627CAB5F38D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625445, "uuid": "f9dda33b-3ced-4444-bbc5-bab22f3c7da7", "value": "1536:EDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n1MN:EDAysJADlV378P3RPVJLdcKuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625445, "uuid": "142f8d5e-1d6f-43a0-8300-423fef747da2", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625445, "uuid": "facfebb8-9633-46a2-8ded-71f346bc467d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625445, "uuid": "19ed8042-5e8f-4b06-8b33-ab9cf8fcc135", "value": "statistic-1517689558.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e0315a-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626206, "uuid": "7fb24bee-1516-4704-99fc-8aa82987b365", "comment": "Malware payload", "value": "69604904e121f63d238b2fad0454cf16", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626206, "uuid": "6f18a7b1-df2b-4f65-9715-39e4e52a0e42", "comment": "Malware payload", "value": "14de107d90ba98efbceffa3b740191950b75139f7c78b55ca3a2f2b5dc4e382e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626206, "uuid": "2fc44555-ad84-4190-bc70-e7a4af262645", "comment": "Malware payload", "value": "e4b6fd6e6e68a1bba85933efbde9fb6d7a60c0e9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626206, "uuid": "65ebeeac-7184-447c-b96d-1f9391ad9564", "comment": "Malware payload", "value": "05ebe84abb66215fa301a94c3aec0ba758c38b206b4ad04d7305235d222b42a3316a8d455d2e4f30432f56c84d5265d6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626206, "uuid": "a960724f-24df-4b5c-858e-fade04e0e1d7", "value": "EC83020813BA5919B5CECA3D8CC31FCE3F57F8B815094862A56D0199B627C6B5F38D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626206, "uuid": "dd5591f0-5afe-44e8-89a1-1400438ee7ec", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n1A:DDAysJADlV378P3RPVJLdcKuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626206, "uuid": "a5ad96f9-f9bc-489b-b78f-86620f886444", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626206, "uuid": "ffcd9813-945e-444f-9ebe-1e964f9ed66d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626206, "uuid": "9e8eb49b-1cef-42b2-9df4-1f9639ae10ea", "value": "statistic-2045581605.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f25394-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625591, "uuid": "1f7eca00-344e-4d4a-856e-a77408c292e9", "comment": "Malware payload", "value": "c2f5e11f681a22d6e0477fc6ec9f3100", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625591, "uuid": "49b982f3-ea54-4f09-a4cd-34a2efafecd3", "comment": "Malware payload", "value": "14df3d1dbed16eb976d2b280a7216cdcd0833be67080d547ce89ea444d8ed67a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625591, "uuid": "02c7fbcc-df01-43b3-9864-7efe0e775867", "comment": "Malware payload", "value": "e182c0f7461e808c4b1630f0d3df92017903e863", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625591, "uuid": "2997b11d-8bc9-475d-a5cd-dfd0499ef6c6", "comment": "Malware payload", "value": "193d26cbbb1f8242b1a13b145d020eb247cbdd501a07bcb5c02c895b6d594f252ab4906f298c7673957ff7cb294151b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625591, "uuid": "7d35240b-2759-4aa3-b311-016f9a49219d", "value": "7983021563B9C998F58D9E2D4CE30D8F3F43A9782C1ED5F26229019AE227C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625591, "uuid": "1d733410-8a06-4638-a2ea-ce0ccf1ee64a", "value": "1536:FDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYPqXT/WkO0B19M2L:FDAysJADlV378P3RPVJLd8qXjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625591, "uuid": "6ffae940-0935-49a7-be01-c1002f6735e7", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625591, "uuid": "6c25e577-6fc0-43f9-9153-7f20ea91bcea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625591, "uuid": "8698e567-ac5d-4bd9-996d-6e71fa9a6651", "value": "statistic-1621155859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7a51cf-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623911, "uuid": "248ac4e8-eaff-438e-aeb6-58e4c0bf014b", "comment": "Malware payload", "value": "c44a37095c01cd21d06f111cbb0c1192", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623911, "uuid": "6ef8f3d0-50f8-425d-8d57-5d169f9c8479", "comment": "Malware payload", "value": "14f2396a9e304deac38a79cecaabcc531e59e90745846548cbcfc45a51a576b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623911, "uuid": "89275339-f535-4a7e-938b-ee5784da92e6", "comment": "Malware payload", "value": "b208d4a45359994633f23d78553c70617e51536f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623911, "uuid": "a5f109c3-d224-449c-b0ed-560d39afb5bc", "comment": "Malware payload", "value": "89cab915b295d43cf33eb009701b1959807c551e5d1deb66e9ca3fed4162015d0f6130fb47b4e37983396c739733ec1f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623911, "uuid": "ec38da30-a67e-46aa-a0d4-69812542c589", "value": "A68302CC3538C1DF37BE6A08A29C887BBD09D5B93504385EC489655FAD8AFBA4C5B160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623911, "uuid": "60b4a326-246b-4f74-9af5-1cbecb2e99b7", "value": "1536:GG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+p6:GGEhrHJoEsBMG7qzkZQxOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623911, "uuid": "c04c9d96-e65f-4292-bf3c-89d9780f3487", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623911, "uuid": "7c81ee02-573a-4820-81c9-5fce71b76a75", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623911, "uuid": "f0d86233-8d48-4cba-b33c-037009b99f11", "value": "diagram-493080561.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b47660-a867-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619644873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644873, "uuid": "b1892669-33bd-4559-b06e-3771f12cbf9f", "comment": "Malware payload (Dridex)", "value": "0b4c31d7a3f31e2c2be20bec97105de8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644873, "uuid": "58ec8e7f-7bc5-48ff-a94d-ef824a33c09f", "comment": "Malware payload (Dridex)", "value": "14f4a71cd2c41b47f2d8059dd94b5636fccffe95b88e1be49879a7abee3106fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644873, "uuid": "2226d973-3f99-4348-865f-b6139d6a3339", "comment": "Malware payload (Dridex)", "value": "1add5e7fb64a43707770f50ba4abe4d85ddc33fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644873, "uuid": "a4e21b2d-1c74-4033-8cde-00ee1099ec7d", "comment": "Malware payload (Dridex)", "value": "302beaff2b1ddd4c1b97317520d8fdca9f20b3b60eece1a4f54d1f91cfb5bbbd2c2c0f7b1fcadf9f16bf2a512ed3356b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644873, "uuid": "01b94605-c64a-4804-af78-062516c63e5d", "value": "E2F3E0D2EA8BD390F5DFBC7E385B367063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644873, "uuid": "f67fd351-8357-468c-9343-43188f9141f1", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644873, "uuid": "b8f758f9-378e-4b5c-824d-58a78f86ba77", "value": "3072:88Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2FGkFY:bnS62Fl+pkeJl3CvRStrFl+EYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619644873, "uuid": "66b3164e-e69e-4927-be10-5eeeec0c4ab8", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619644873, "uuid": "cf3f4e2c-3c94-41a6-9ba2-84626fc30553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644873, "uuid": "23edc000-4b43-4806-bf87-0ce9fbfd3f7b", "value": "0b4c31d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8e7ae9-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646253, "uuid": "0eae8d25-7465-452b-8daf-79f3ee81cf0a", "comment": "Malware payload (Dridex)", "value": "aa5f30e533c47e521cc1d8c9d0d6170c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646253, "uuid": "cf939b27-512b-4c47-a81b-bc22b01d1397", "comment": "Malware payload (Dridex)", "value": "14f6b6fcb8cbb52a043dec81faca577921ab9f44ffc9e0fb113b49994b3ab3cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646253, "uuid": "c201f789-c93b-4fc7-8fd8-65e6fd5a0864", "comment": "Malware payload (Dridex)", "value": "f8423e555dd87ecfa0e082441492fbd30e6de58b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646253, "uuid": "7b74d988-03f1-414a-af3c-188625c1573a", "comment": "Malware payload (Dridex)", "value": "7d00ef852401e2b5788d7d944f9f6c225e041e978379d95ed032f9570fe8ef2127a6548dcc3813dcb1c0a9d05e395e15", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646253, "uuid": "893f50f6-c65a-4404-b7bd-6183304c8d6d", "value": "03F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646253, "uuid": "3df26cf5-c63f-4bb2-8b12-ca25bf15109c", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646253, "uuid": "f6bab991-0d94-4686-a483-5270abd87718", "value": "3072:FnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:0y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646253, "uuid": "16e64944-0080-43c0-93cc-a11537e2062e", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646253, "uuid": "e6a93e5f-21eb-4aeb-b78d-365686a9a0be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646253, "uuid": "d439496a-1e55-4db4-a0b2-e834e684250c", "value": "aa5f30e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef7451e-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625717, "uuid": "dc3f10e0-39d3-4d54-a95d-c76822de4f5f", "comment": "Malware payload", "value": "cb46c01d6527e23fef4626473d020209", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625717, "uuid": "7969f7b7-78cb-4756-87b0-05387739067d", "comment": "Malware payload", "value": "15052d8937cb9234b10a946c1493bb41e0527e5b716a96e23d0a3214ffc4037b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625717, "uuid": "62da5aa9-544c-48d6-a620-dd76c45c5dd4", "comment": "Malware payload", "value": "b469daf747a7ee01972032cf1063cc33bef63808", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625717, "uuid": "618b99f1-94ab-479c-9cfd-cafc4ed9b627", "comment": "Malware payload", "value": "5b815b26ca231b57589ccd7f49d19c385ae1c57fe91989b0860516cdff9369e60071f938e52a217f06b527fd5a2e16ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625717, "uuid": "ec6fa8aa-fe36-41b5-88cd-9b074b0362d3", "value": "AC83125163BACA48E8CE8E3D5CE30ECF3E12F9752E0DC8F161290056966AC621F2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625717, "uuid": "ab8046df-7e25-4af9-b2a3-46dbad3055bb", "value": "1536:hDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdl6q0T/2kOsMmP:hDAysJADlV378P3RPVJLdIq0DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625717, "uuid": "865536e5-699f-42ea-bedc-6c4f207ff5e2", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625717, "uuid": "40fe7993-cf64-4bf9-97eb-b2dc0480a6fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625717, "uuid": "32fae9d9-42d7-4e82-a6ae-81ac623540b6", "value": "statistic-1693833818.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acc4a40-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621495, "uuid": "39c4fd0b-ad16-4519-aa35-9c7e4ffba52c", "comment": "Malware payload", "value": "2808e7eb9591bf18b82b07b8c76b3d7d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621495, "uuid": "46ad94db-89d8-43b9-9c12-2d821113329d", "comment": "Malware payload", "value": "150b3b8453e3c189946a1ab82acd8b2de27bd8215b1c3309d52a92cb08c96a91", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621495, "uuid": "9c8468b5-0588-4d77-a150-22a7aeccb78a", "comment": "Malware payload", "value": "76faa3796477ac405075aa8822b9fc9d3dbb9a6c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621495, "uuid": "98fe0b46-8c8f-47a4-8266-bb49ea7e3491", "comment": "Malware payload", "value": "b051124eb94c01956ffc12b0acffbae36984527f800c72d02ae13da0e4773cde8769f01fc9e56a8421ba67002c60c68f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621495, "uuid": "658510cd-9564-4544-bcd5-6eb580a49573", "value": "8683021513BF464DB88DDF3D5CA30DCB2F5AB974251568F2A15D00E8F6338421B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621495, "uuid": "0778e990-f8bf-4bba-94f3-b217e801c0e4", "value": "1536:lDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdRRP6sCO0Py+J:lDAysJADlV378P3RPVJLdL6s90PyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621495, "uuid": "5876ffa3-a341-4ece-9163-38e2ab9a39e6", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621495, "uuid": "6495ce47-b726-4369-867c-31747ac634fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621495, "uuid": "2381f32e-8205-494f-8f81-00cbdba8ee61", "value": "catalog-708121546.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd158c6-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622947, "uuid": "9798f78b-ee69-4659-abd7-60330960f9c2", "comment": "Malware payload", "value": "7202dd6c01723cf9d75ddf072159b4c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622947, "uuid": "4337d935-7760-4789-ab93-543c8d38b23b", "comment": "Malware payload", "value": "151f471ff6eac11821d63dde37a3a6a79e6f9b4f29fdb43e68ae9d5ce7bd81af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622947, "uuid": "598e14a7-5ecd-4ae3-9f03-7c4d1550523c", "comment": "Malware payload", "value": "dc718fd8539e97400e1a0fd6b928d8fc59cbd523", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622947, "uuid": "186c19be-c31a-4a66-a9af-0c3006cc88a3", "comment": "Malware payload", "value": "0613e41810cbbdc491c851be88987431c4c125590fd92a4f8ba0fc8cf196b207412d24265fe0c960b3e435b347c0d8ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622947, "uuid": "05a6a2fb-c61b-49e7-bad0-6c59b8d4d8f0", "value": "EE83028C313DC5DF7ABE2E0951DC887E740EE8B43108154ED8C86A6B9E8BFE71857560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622947, "uuid": "73ae8a45-3070-4bde-afd9-281b8e9a0900", "value": "1536:nG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttMKkApVr6wo+RxXxN:nGEhrHJoEsBMG7qzkWxApxTXxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622947, "uuid": "42b82eb9-18f4-4ad8-97e8-40f984667d7e", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622947, "uuid": "3a09d383-86c8-4bec-8496-b6a35c882057", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622947, "uuid": "bddda024-b82c-4b52-9a84-25f38e13a6bd", "value": "diagram-1756095733.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edae0d17-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623943, "uuid": "84b35fce-3d2f-4970-a307-dfb4573b7204", "comment": "Malware payload", "value": "c646c0aa8f3b1c0d341eec3df8980a5f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623943, "uuid": "4d7337b6-ede4-43aa-85f0-70bf60d2a5eb", "comment": "Malware payload", "value": "152010a8f52f3c132f7931492493cf6fc7b324269cfc6f27968ac4b7aaf0f677", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623943, "uuid": "ea5ed25b-31ec-488e-9014-c1079d86c7ad", "comment": "Malware payload", "value": "d9c9133759683da34c033c8de0e33282df2f30bd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623943, "uuid": "796ad748-588e-4ed2-b3cd-0eb61569519c", "comment": "Malware payload", "value": "dc9cb22231c1d9228b3330e83322e5114f8900728a1eab644a6a0c8f5f03a53913ecc8a08f0cea9de57c4df04acd19a5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623943, "uuid": "61c0bcd6-66f4-49dc-b603-451b8e43cfa2", "value": "048302CC213DC5DF7ABE3A0951DC887E740EE9B42144194EE8C86A6F9E8BFE71856470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623943, "uuid": "1038f99a-4ce3-4592-893b-33f19968c375", "value": "1536:6G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZKkApVr6wo+RxN:6GEhrHJoEsBMG7qzk3xApxTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623943, "uuid": "9d80621c-2f30-4f11-8cc5-b24b111960ed", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623943, "uuid": "92657068-15a9-4d65-9b0c-f5d7ef31fc67", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623943, "uuid": "2562dd54-bf31-48c3-a7be-72fac7a66147", "value": "diagram-519460934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0021de76-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646737, "uuid": "ee2414dc-cb25-4642-a57a-dc45426a9f9c", "comment": "Malware payload (Dridex)", "value": "7aefecba01db1fd74d1d4f96896adf1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646737, "uuid": "85c46bc1-63d6-45e2-866e-80f08297cc00", "comment": "Malware payload (Dridex)", "value": "15280339b240af96c2489598a463b77f2f0119bcda20f59f3cbc25fbab826f00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646737, "uuid": "fc1e8bc6-adcb-4eef-9927-9cf49ea2ce40", "comment": "Malware payload (Dridex)", "value": "76dd1d08a1c14bfa6f47f41379ec290e9745580e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646737, "uuid": "94146491-3a71-4814-bc7b-f0bd9116d28c", "comment": "Malware payload (Dridex)", "value": "098c7bfda9183c92a749b69b0f32774a21e8159da67dbff90ed784e3801b9387dca7af1267792cc9689e96dee2099cb9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646737, "uuid": "95c51e01-766b-40fa-867d-ef3cddf83f25", "value": "8AF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646737, "uuid": "ce1f2784-50a8-4b16-b4c5-66ace4c248c5", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646737, "uuid": "83188be2-74f0-452b-8e88-7d10a1d3c48b", "value": "3072:knSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:UnS62Fl+pkeJl3CvRStrFl+EY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646737, "uuid": "9c0d015b-d850-4b8e-b85f-14c7c1da190b", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646737, "uuid": "53f328c7-6305-4be0-9ede-bf01a054d35b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646737, "uuid": "6a8abf77-68d5-4b2c-9cb4-380a33ea0e7b", "value": "7aefecba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6658c1-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621847, "uuid": "336377ff-8f32-466d-90f2-3d6a87f2dbe3", "comment": "Malware payload", "value": "ed610a3fb426e30e0a52de023a39b605", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621847, "uuid": "eff49b62-f434-432a-a0e4-a68462b6667b", "comment": "Malware payload", "value": "153b65315b312f6a50830ea04fc83445c1aa64fbcdc9a56f9d0986cc1abfb656", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621847, "uuid": "f33b7ea7-e31e-4bfb-800e-deeb9439fa7e", "comment": "Malware payload", "value": "8108b73fb73f583bdc38f35797104c1e674f3a87", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621847, "uuid": "8aa969c3-3047-4ff8-bae3-e8a8feacfb8f", "comment": "Malware payload", "value": "70b30763216cceb16b9f425623178030bbb857abb6daf07bb7bb9e9268e925eb1a2d2968a92620e3a8e8c7ce070d67d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621847, "uuid": "6805b025-2337-491c-a17a-a3b36d51c3a0", "value": "5483122013B78F4870CD8D399CE32ECF7BAAB9B82D1E99F1556D0855E123C961B1447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621847, "uuid": "4c9493aa-ae13-47c7-a9bf-1141829a56af", "value": "1536:+DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKy:+DAysJADlV378P3RPVJLd+Z8Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621847, "uuid": "838f2899-de9a-493b-84f5-49152a7158c4", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621847, "uuid": "f83ad4c1-7d0c-4128-9793-8fae6d36cded", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621847, "uuid": "efaffa98-3e98-4170-ba4b-f8247ac5404d", "value": "catalog-968697383.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8012a9ea-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619464, "uuid": "1210c282-bc42-489f-aa9c-49bb58573477", "comment": "Malware payload", "value": "ce1da2593ec608e2b40875304fddf4a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619464, "uuid": "92265069-19f1-405c-8020-46f6d8d26835", "comment": "Malware payload", "value": "155ec4e6bbeb00374e4e0ef5efcde43980e0ca16ebde6d97eddce0caea446eab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619464, "uuid": "78817417-eea7-4d48-b84d-24c316ad61aa", "comment": "Malware payload", "value": "8f9489b1f6227c86b7b31f3abc03451e62df227c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619464, "uuid": "abf7868d-a282-4fc5-b5d6-b58f29a05c22", "comment": "Malware payload", "value": "f6cddc8e6b024886ba26d58c7115c441ddf24bbe081c23e61358c860d6b386b235dad19d1ed250816243143620547d55", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619464, "uuid": "ffa3c9b1-85f5-4419-8f8a-5d292a4dd824", "value": "DD83122413B79F0870CD8A3E98E31ECF7B5AF8B42D2E98F1516E0466E127C561B2447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619464, "uuid": "a433d904-8855-419e-98ab-291507a25d8b", "value": "1536:ADXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKqX:ADAysJADlV378P3RPVJLd+Z8Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619464, "uuid": "cf469b2d-2309-4d20-95a6-bf7791bbc9bb", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619464, "uuid": "16c4f78c-7b0e-4642-92e5-35a037686777", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619464, "uuid": "ff1b12a2-a7ef-4971-a0ae-783e91402753", "value": "catalog-1279153855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1982ab-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622409, "uuid": "6c5246e8-3fe1-4f83-a09a-9497d07a9944", "comment": "Malware payload", "value": "fbb1babd887bb0d89ad240ee78e37cfd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622409, "uuid": "ceb320df-ab44-4449-b5bb-6dee42da0775", "comment": "Malware payload", "value": "1567d4151d194fd5fd8db6b65f5ba4bbdd7dfa63adc2f631e9d62274283335c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622409, "uuid": "75bb42ef-6376-4df7-b600-8c6790f0339b", "comment": "Malware payload", "value": "524e5df89dbfe698ceed71bb6b00a0c4b3ed2ec9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622409, "uuid": "5b487551-a91e-41bb-ac2f-abdea5f9f85b", "comment": "Malware payload", "value": "ebb0763451ec5ae7d29417c0788b1a9a0d5dad264e694a350b54420f4033bc70708d8bfb49a9ee1e2cdc59b3ed8e3490", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622409, "uuid": "c87c3bb1-9683-48e9-8d78-f4d46ee6169f", "value": "7F8302CC653DCADFB1AD2F09A3DDC57FB50EEC663044248ED8C866A65D49A970C6B070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622409, "uuid": "2aceac7a-4ad0-4ee2-b40a-79e9c4998c9f", "value": "1536:WG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttle6n6475e0NEnP6V:WGEhrHJoEsBMG7qzkj4q/NEnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622409, "uuid": "1dec4beb-0caa-44e0-bf78-1a9823667ff9", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622409, "uuid": "7d2a3207-008c-414a-9337-9a0f1ad29024", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622409, "uuid": "c2d7ca7a-2bb9-48bf-9be4-44a5c5ca8975", "value": "diagram-136420217.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f53aa45-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622523, "uuid": "f287e5df-fb82-48ba-98c7-4381e5664de3", "comment": "Malware payload", "value": "4613fdaf37db383bfb37fa6e4c07956b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622523, "uuid": "e170dcd9-55af-4717-877b-cd921b2e640f", "comment": "Malware payload", "value": "15686c0c2c177642eb54cac3417643f00475ebaf7652b8c9f3d61f1fc0675aa0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622523, "uuid": "bd13569e-bace-471f-a640-a21ac6e34ad6", "comment": "Malware payload", "value": "f9b727f18e6780fb1235527e3ea3bbe48b133a0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622523, "uuid": "0c85ab0b-422d-4f95-aeb9-3e1ffe3ab48e", "comment": "Malware payload", "value": "38bfd99ab366ed224bc9db427274e48c1f9e18964df57c442715675d235ce2930b0ea62d873ac16d05da4e4b1d1bab8a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622523, "uuid": "b19fedc1-be0a-4712-80dd-0f601f005014", "value": "8083028C653DC6EFB1AD2F09A3DEC47FB61EEC663044248DC8C866A65D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622523, "uuid": "0a59b171-abd2-4c84-b213-db546731f746", "value": "1536:+G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttie6n6475e0NEnP6+:+GEhrHJoEsBMG7qzkE4q/NEnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622523, "uuid": "f4ce58ee-b54f-402b-8436-44cf8bcb00f8", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622523, "uuid": "02a7a0e1-7aeb-43cd-9ed1-30e2ddae28f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622523, "uuid": "fcce8180-80ed-49e4-84f3-9905b15f35ca", "value": "diagram-1433268741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c9ea6a-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645349, "uuid": "5015357f-47d2-4f82-a650-6bd719de272e", "comment": "Malware payload (Dridex)", "value": "91fc5f968356c77ebbbe31a500551e06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645349, "uuid": "6282692f-4df0-4543-8798-84c083abc9db", "comment": "Malware payload (Dridex)", "value": "156b9dcc1877b93a08ca5c98859d3072febca0377e7051140de05852e3dec190", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645349, "uuid": "548cc7ea-b5c6-44a4-9123-a882253d8963", "comment": "Malware payload (Dridex)", "value": "b4b10b72935b6e9c4c01e2fe97977a9b64372d77", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645349, "uuid": "65873425-171b-4697-9ef5-cc597657d76f", "comment": "Malware payload (Dridex)", "value": "f458b75e1c9e3c9fc03d621fbb591c777282eb357f6629b8c3c73a91c91a569f9979e2ba0f677d2bff6103cfeb870bfa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645349, "uuid": "3d81f9de-12ee-4103-bf5b-c6e8ff1066f3", "value": "F4F3BFC6E7EFE0D6C02BB43385CDB036EF6069D88A3ACF35C104892E69D7D549A35469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645349, "uuid": "42c468e4-b655-4ae0-b480-31f8809389fd", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645349, "uuid": "9d0e1027-edb5-4e54-b7f7-ec550cdcae23", "value": "3072:a58CMtKJlXoDRl4epTGmoAc7iTRilfn6wlYYbZwd:/nClXSRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645349, "uuid": "e6fdb497-2743-4b81-a0ce-ccc26923ea03", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645349, "uuid": "8773dfb5-ed69-4be5-9735-a27680807657", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645349, "uuid": "221c6ea0-c8c6-4701-8f95-f38a5d251014", "value": "91fc5f96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b62056-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621562, "uuid": "ef4da902-73e6-46cb-b443-20c5ea17350c", "comment": "Malware payload", "value": "12a09f8a22bc09c688d6089ac778dd2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621562, "uuid": "f0e89681-2b8f-4eb7-9af8-fe125e52d25d", "comment": "Malware payload", "value": "1575df06fde3c7b663bb6c11021ae831713224345ada14ddbef99a39dbcc6c63", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621562, "uuid": "6423f995-e373-4ba0-a6c4-115e545f44dd", "comment": "Malware payload", "value": "7bb5dd6fd952a246f82b992c68d3e6aa1e7a14db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621562, "uuid": "48182e92-254e-4dcd-a48e-09fe8dfd4b86", "comment": "Malware payload", "value": "dbd0dfc2df1fd90574b43a600bb799d3f64c515160702bd9df0bb5af1bb5d12d533c87f95ff4bbe6083716fc6d545a5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621562, "uuid": "9d9a4461-b5d2-4df2-a247-1d42f6ea41d9", "value": "E283027103AE8B5DB4CE5E3954E21E8F2F46F8B42D595892511604A4E327C629F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621562, "uuid": "f0af036a-51c3-42f8-b406-5a6bceac63f9", "value": "1536:ODXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRaQ:ODAysJADlV378P3RPVJLdcDsMU0dR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621562, "uuid": "afb9751b-605d-4fef-8465-6283d8f496bc", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621562, "uuid": "01300db7-5ff6-451f-805c-fa90038c0b35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621562, "uuid": "1180380e-c8a8-43a8-ba42-c6fed44b2292", "value": "catalog-760044941.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4061bc4d-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627088, "uuid": "fd87dbe8-18e9-4d93-9c73-1386eb8473ed", "comment": "Malware payload", "value": "8c5758b0d0abf2c3f7a73a9f82c02129", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627088, "uuid": "47371a2b-42dc-4735-9e38-4e3d544312c3", "comment": "Malware payload", "value": "157877264566930cca5b742786f1bf577c144080cd30c113efb1abf5aeaa312c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627088, "uuid": "bfbe5bb6-be47-418e-9fb5-8d480e42e620", "comment": "Malware payload", "value": "f1edf0cb7291aa91b03cdd4a94d7045b4d060fe6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627088, "uuid": "41c4db24-ec70-4076-89ba-0e3aa2f0ae1b", "comment": "Malware payload", "value": "c09e9f7e2ffdf8fdbb56ee5766a9395177ef92097bd48dc2168b8b6a994e46dbafaedd29f80fe8d15345729a03fd9b3e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627088, "uuid": "55d523d1-1aeb-485e-a5ca-f17bddb57806", "value": "CA830250537ACB19B9CECF2D4CD3198B2E9BE9F42A0D5CF1652D00E5F76A8061B14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627088, "uuid": "8e77fd23-c7be-40f6-be62-f3579aa6e44f", "value": "1536:gDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd58oZePFOLVEr0xkvUztKi:gDAysJADlV378P3RPVJLd58oZeUM0eUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627088, "uuid": "ec10495c-87cd-43ce-b744-33fde1aff42f", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627088, "uuid": "8b1b1d95-0e0b-4c96-b41c-209b654afa94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627088, "uuid": "7ed4ddbe-342a-4229-95b1-8ad34c77b60e", "value": "statistic-705243743.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa011814-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640714, "uuid": "59297d76-6381-4fbb-bb78-91d10e9ef67e", "comment": "Malware payload (Quakbot)", "value": "9a7f2a40b03b956486a9cb3086f4bb29", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640714, "uuid": "5c59af81-6593-4b7b-89cc-2e70e10c7380", "comment": "Malware payload (Quakbot)", "value": "157c1a70ca64b15116cf8059366edba9cc6055dee4940f46fe239e8982675e4b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640714, "uuid": "0b5e654c-055d-4fff-8566-1cf78582c23e", "comment": "Malware payload (Quakbot)", "value": "789977e6362fb6781f03eda6304c4d85f1b087ce", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640714, "uuid": "1240a2c7-67c1-4ae5-a753-1d8ea63779b3", "comment": "Malware payload (Quakbot)", "value": "2053fc0241a781a35d6f728771d2564677ed5f4901c1dd0f1d6cd9b264323b56f3d6087a9076ed3c45b7bc23af7e8f41", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640714, "uuid": "6c7b16e8-2eb2-44c5-a02c-f2233263aa62", "value": "CD948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640714, "uuid": "7fcfddb0-7678-4a5c-a3fa-0be093cf6834", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640714, "uuid": "0f287b0b-f5c6-4cf8-935d-b8b0ffa4abcf", "value": "6144:sWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmE:sWrsTwr03pdf8vhhOKJETlByE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640714, "uuid": "4b3c03a8-beb5-43bf-b0eb-22f731a2c2f7", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640714, "uuid": "353a9bec-0117-4576-bc98-b1f041599567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640714, "uuid": "6e7f82ba-c965-4632-b366-595182bdf19a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17eaf154-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624873, "uuid": "825a16ac-c827-429b-aa46-739fafba09ce", "comment": "Malware payload", "value": "fb147bbf2579c9cffc45ef425d222298", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624873, "uuid": "dfda4f59-fe73-4aa6-852c-986f3771eeef", "comment": "Malware payload", "value": "15a3fc38759e89b493bae160801edc051d020bedac42490ed308a29f55033c00", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624873, "uuid": "4d3a0f6d-3e61-43c1-9fc0-b285bc8107d1", "comment": "Malware payload", "value": "3a2a8dc49aa15719a74a50747c79469e29f09f32", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624873, "uuid": "ffd37c39-c0eb-4c67-9bbd-7508f2add678", "comment": "Malware payload", "value": "ee2dd611d111c798b57ecc3f6e5589a6e1eae1a2b92856ac3b5af7fb022cdbe3538540d5b2e10c6abe070bd3df3f23c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624873, "uuid": "b5dc7e91-c98d-4a3d-a649-c67b056a2167", "value": "C483026923FA499978CE9A2E8CE11D8F3F4BF9F42D1958E0527E0061E627C511F1883F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624873, "uuid": "59532eee-a384-4ce3-b3d5-1a00ceb09da7", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdUb00T6B/tKY:zDAysJADlV378P3RPVJLdUIlB/sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624873, "uuid": "0b4c21e0-5bba-4596-8c0b-3d146a680d4b", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624873, "uuid": "7b686ca2-2f21-4688-bad1-0d80a63c1b2e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624873, "uuid": "c40a0bab-6d3c-49d1-95d0-bfe4d6aeaf67", "value": "statistic-1068011343.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e695654e-a7f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619596873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596873, "uuid": "d549505e-399b-4b09-addb-37cf04825429", "comment": "Malware payload (Dridex)", "value": "babf221e213da8248a4ac3aaa5d26895", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596873, "uuid": "8e93a007-6844-481b-ab86-d3b64b2f4762", "comment": "Malware payload (Dridex)", "value": "15b31b2387eb13d76d062a303db031b28ec4903945174147cff6033c535f86f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596873, "uuid": "c29a3ed0-1dd6-430f-a003-443ea4e5e921", "comment": "Malware payload (Dridex)", "value": "9325b22794a19675e50261b2065addc9cf5dc039", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619596873, "uuid": "496b8815-25e3-48e7-8d45-44d823ceb2e7", "comment": "Malware payload (Dridex)", "value": "85f0dbc76e9e8d48af097953e13d9594aae2ba29fdffff118306602dea65b3bffd41cb3695215e89ac94d2ac03870769", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619596873, "uuid": "933b9450-0ec1-4250-9802-ca6b2ac212ba", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619596873, "uuid": "b18c61f1-6f87-4c1c-9323-550c8acf916a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619596873, "uuid": "ac91fa28-c713-4e9d-954a-848afb1ac1dc", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619596873, "uuid": "1fef8103-6b03-419b-a965-0aa62a6a1d98", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619596873, "uuid": "d4c86e6c-8f6c-44c7-973b-72436f8877d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619596873, "uuid": "5e1f3f98-c501-4ac9-adab-f5a9da5faa40", "value": "babf221e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3d8e4c-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622758, "uuid": "cac82672-13a6-488c-8d1b-cf0260205e59", "comment": "Malware payload", "value": "255761df8ff53450e3abc918004a7a1f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622758, "uuid": "2085582c-bfb7-42f9-a116-e0f9f563c5cc", "comment": "Malware payload", "value": "15b9308533bb3e5b28c91d5cb1961ac05ee793a5d9408445c43efdcdf137b618", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622758, "uuid": "e57aa879-57da-44df-8581-61714e40bf6b", "comment": "Malware payload", "value": "6e1bb44664fb6c5c35b0b96a72f080076f2803af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622758, "uuid": "6712de31-a1e5-4e39-a686-dd1dc566d6f4", "comment": "Malware payload", "value": "9c6b780b966d417c0ce913625b350a8c7cc30d03162018a0827fc943a7abd2d16520075b0f65d39344cbe27562dc606d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622758, "uuid": "4ce6a7ea-23ff-4c34-a7a3-50486f5a3779", "value": "7483028C653DD2DFB67D2E08B2D8887E780DECB4214424CEE4C91A7B5D8EEE75897460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622758, "uuid": "c56d5631-f698-45e3-8769-c5d630480367", "value": "1536:jsG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSd/:oGEhrHJoEsBMG7qzk6h12xGwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622758, "uuid": "f126c856-e0d3-4081-94ce-f2f0f6a3fd8c", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622758, "uuid": "fa147ba7-40ef-4fd7-b67d-7c65190c9e64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622758, "uuid": "f7550a48-62b5-4da5-8743-e0f129c747fe", "value": "diagram-1627480057.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce79f18c-a877-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1619651808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651808, "uuid": "0d914d59-502d-457a-aa5d-5f088476c6a5", "comment": "Malware payload (FickerStealer)", "value": "dfb6f96342fc5ac3e57338c8bd2061ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651808, "uuid": "b9d00c41-a9b9-4bde-a36f-5c0518066c5e", "comment": "Malware payload (FickerStealer)", "value": "15c65f4a42518ca6cb19fbab258b09ed43f79d111e20af2efb69bf855637909b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651808, "uuid": "0d4bf7c9-4586-440e-b888-712f7ce19298", "comment": "Malware payload (FickerStealer)", "value": "b6c9d7cccf701c2c14c28ca2115feaf216c27ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651808, "uuid": "5c10b185-6634-4bfd-a4e9-1748a9afed4f", "comment": "Malware payload (FickerStealer)", "value": "068c3854884621d1ad2659d8bf6c994c2996bbcd00471ca5d16baca784b18fc58e5c9983e404f55e1d4604d1a10d228e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651808, "uuid": "d6e06372-892a-43b8-b903-6d2f52781c8d", "value": "1774CF0273E1C132D4933939852ADB714EBA787265669A4FBBD81B786F247C1E72130F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651808, "uuid": "50d5fe42-980e-4c1b-9e38-2d75a6ceb0ab", "value": "3e6d945d7fa4985dee2c942052a8b9bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651808, "uuid": "5486ba35-10e1-4540-b254-28a1799e27fa", "value": "6144:Tf3RzWgPCkdDu5OWrEHU/bN1p/wGT8DN7XlQD3eFGRR:TvRzWWCkNurvbNf/9TCtl23eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619651808, "uuid": "b3ff11fc-4031-4e66-9de7-e28e532024a5", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619651808, "uuid": "4488b16f-89c9-4728-8c44-30afce235382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651808, "uuid": "f453a5b9-69da-4825-8660-6d293771d955", "value": "DFB6F96342FC5AC3E57338C8BD2061AE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b7022b-a86b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646369, "uuid": "30e3bb2a-1c27-4e3a-827f-265b6d512f55", "comment": "Malware payload (Dridex)", "value": "6b0ebc95e769d01e36e14e49882ecaa3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646369, "uuid": "0039f4e7-a2e5-4040-8b62-2ffd3dd63761", "comment": "Malware payload (Dridex)", "value": "15d134576d73ee43544f5e4a5dc92b8e1841f398ec2dcab928ee20fff2977aab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646369, "uuid": "bd3bec94-7549-4afd-8073-57ac3321da65", "comment": "Malware payload (Dridex)", "value": "2d21104d27ffd37713135fedbf42eef2113b6530", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646369, "uuid": "fb4e1aaa-f994-4d14-978b-29789a57207e", "comment": "Malware payload (Dridex)", "value": "262fc425f0f19257b11cc3595287b49d15a72cd7ef4a7db7476d8f6acb75f6f56a84125ad2e3efbce02a5a0f29ba53ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646369, "uuid": "06f432be-a07e-4640-95f0-11eeac116a0b", "value": "5EF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646369, "uuid": "22c1738e-c14d-480a-83da-392153b107f0", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646369, "uuid": "fe439b06-3200-4fd8-924a-8279253775e2", "value": "3072:AnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:Ly5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646369, "uuid": "0466cf5b-9cd9-4c6e-8834-320745087256", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646369, "uuid": "09775eb6-cfa5-4d86-9737-3be205765ae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646369, "uuid": "88e33ac0-5daa-49bc-8e56-4561b7ba030c", "value": "6b0ebc95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1444dce-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626096, "uuid": "ec1a83d2-699b-459c-b6ca-771db2e65204", "comment": "Malware payload", "value": "cc7721a917f0a423d4dab46d838c3d78", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626096, "uuid": "645af564-48c3-4b76-94fd-b312e8e1a498", "comment": "Malware payload", "value": "15d332dd8c21d655d4989ffa27de4849bc5273b45cd9c2c58ad73befb18efa68", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626096, "uuid": "46f3defe-ae72-40a4-910a-137ca2163830", "comment": "Malware payload", "value": "53d8afcb8c922918f7b629a695210b26ebb3be54", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626096, "uuid": "055819ad-a915-4191-93a8-22c55290ff4b", "comment": "Malware payload", "value": "1ba6f3a4ba8248669a2b0bbb9f9ddd1369b902fbb31bcb638941b87b8792378736300bba63dc6128096f50bd12a1d3a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626096, "uuid": "4d31397e-e276-4d11-9547-c215bd023937", "value": "D683029013FA8B5AB4CFCE794CE30D8F2F52A5B4291A6CF1716D04A5E2214991F24E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626096, "uuid": "82e088b0-ed8d-42d4-ad56-feb466294330", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd28oZ+YSkxk7UY7G:0DAysJADlV378P3RPVJLd28oZ+UqUYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626096, "uuid": "964c1f5b-2634-45bc-b942-a77c85d4c1ae", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626096, "uuid": "b816f950-13dc-4742-933b-9445e6d6a01f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626096, "uuid": "ba0bce4e-34f4-4ba9-92c6-5757db023dc0", "value": "statistic-1954176059.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd396bc5-a840-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619628264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628264, "uuid": "7e54a78d-b942-48fb-a123-a1de3c517f05", "comment": "Malware payload", "value": "a18f57d718f2ed081ebcf1e019e9e729", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "Pandora rootkit", "colour": "#90A9B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628264, "uuid": "b4ab9456-2729-4ae5-94bd-38aa28198915", "comment": "Malware payload", "value": "15d404e03f1335a3e4a9e691a3f57b3765823249d5f28a23a728dab6f19cedc0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "Pandora rootkit", "colour": "#90A9B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628264, "uuid": "66e59376-8ff1-4ef7-9a8c-fad638c6efb9", "comment": "Malware payload", "value": "05bb4128c83593cb970308811aa3009105db98aa", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "Pandora rootkit", "colour": "#90A9B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619628264, "uuid": "9d43d023-5e7f-43b1-8f79-cb45b64a1855", "comment": "Malware payload", "value": "f0c1e72b0ffeab135753e1b7cf0b789075807364da074636696365652227308b2b929195e456309b696a240996e5d350", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "Pandora rootkit", "colour": "#90A9B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619628264, "uuid": "d1ca29cd-b377-49e1-abed-280ed1c03795", "value": "7613F10B7A36F4ED785FED58A938B81E6CA74D9730C6D006526941DA6FEAC070E17E30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619628264, "uuid": "39508754-4310-428e-a008-39f1f6d8e12d", "value": "768:2e5/cpK3qan0aO3mz8NZWSPcGG598USw+Tipw5Ljpmsr5qhpk80dKXMsbOAbyUde:kaDmmz8mSkD5WUS4u/pr55DdKXXZyU1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619628264, "uuid": "110cc8c8-b7e0-4a66-9cd2-aefe88ca49dc", "value": 43526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619628264, "uuid": "a64d97f9-b655-488b-bb3c-c8569d66516e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619628264, "uuid": "b59c4e6e-d8a0-4d40-a1db-78bad83b548e", "value": "15d404e03f1335a3e4a9e691a3f57b3765823249d5f28a23a728dab6f19cedc0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb5cdee-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640717, "uuid": "31796006-6fc7-40c0-a512-25391c0da35e", "comment": "Malware payload (Quakbot)", "value": "0c3e907eb54b2c83957481a46cb05104", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640717, "uuid": "07233d47-9349-4018-a932-7bc2de15222a", "comment": "Malware payload (Quakbot)", "value": "15f8406bc94b656f6d80122e3bb695a266ead1497af1f938266cfdef8261b953", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640717, "uuid": "a576bf0e-dd3a-4df5-bf11-59167dc70306", "comment": "Malware payload (Quakbot)", "value": "562c31c204d1a3fd7bc72a38c7c6fe4ef2256ea1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640717, "uuid": "be066082-9edc-4aaf-80dc-09f72e4b42b6", "comment": "Malware payload (Quakbot)", "value": "eb90ef33a920b97d39280263fbf5b8f9af74e0bfcfbfcc5cabbf8c876db3c13a56b6ad57bd48c11bfaa5bf378c4db653", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640717, "uuid": "83d7d688-7e8d-4dc4-a615-8b7863ee651b", "value": "E9947D396A26D063D2BC27B143C3EF580E67EAD57234540612A2DF183EB6395BE36F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640717, "uuid": "6db70ef4-9063-4bdb-bfc2-de025e2ff1d4", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640717, "uuid": "2373ae08-4199-4e90-86ad-1f2ff2c59e44", "value": "6144:GyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm5:qTwr03pdf8vhhOKJET5By5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640717, "uuid": "81434542-6034-401f-bef8-f5d0504d788f", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640717, "uuid": "01b99e71-06af-4319-acd3-26c3399a0039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640717, "uuid": "33ab048e-0904-4f74-b00e-6be8881b429e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69fac5e-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626911, "uuid": "4381f347-2e53-4e49-9a34-289f7d07d36c", "comment": "Malware payload", "value": "508dfee5512f5814b94def0636c1c3a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626911, "uuid": "f75cdd15-b287-463c-a3a9-70e246ffdbc1", "comment": "Malware payload", "value": "15f9be0da861de739eb24cf019f86c2b2512ce265a8b8cdf4a07ebf2e34b2884", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626911, "uuid": "695a6aca-a040-4a93-b616-42ca6b27b66d", "comment": "Malware payload", "value": "a0d0d4b1b1798a40c079e8912a3d21499b93547f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626911, "uuid": "095e9472-e568-4968-84ab-c1e1d890c99a", "comment": "Malware payload", "value": "5ed55c5453280ee437b50fdeffc26e39f3d00a0e7ff42a1015c1c94a0725607231e12c7aab178760ef2d9d137161d0fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626911, "uuid": "48020f58-484d-4d87-892f-50a1a40a6854", "value": "628302A453BE4A4DB98D4E2CACA20D4F3F67B6743D0E58F1B92D0481A231C561B34A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626911, "uuid": "f085049f-f9bb-4bcd-b7b3-3252d309672c", "value": "1536:yDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd8hsMnSEwJPTmWe:yDAysJADlV378P3RPVJLdyxpEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626911, "uuid": "58449983-7bcf-49f4-9490-01422e67aa99", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626911, "uuid": "687693d9-0099-4ff8-8a9c-704e7d4bce4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626911, "uuid": "2c5a811a-756d-446e-9269-f2a68d8299df", "value": "statistic-588144541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b78496-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626728, "uuid": "6fc3ad8f-0ee8-4633-8ce5-dc7318c1e938", "comment": "Malware payload", "value": "0c8df50bb5d5c5b01e6fd94df668552a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626728, "uuid": "83348aae-54f2-4c72-97b0-9ec4dbc13073", "comment": "Malware payload", "value": "161f32f6683c958d3a170dacf0865a69c892cd8eb54de317a00fccfdba9e2788", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626728, "uuid": "81cf8df9-fd03-42f8-a931-8a2bd924dd0d", "comment": "Malware payload", "value": "7aa455f4d097be95357ce40da3bcf75ebba38684", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626728, "uuid": "4e5b71cf-ed7e-4cbb-b6a7-09d62495b26a", "comment": "Malware payload", "value": "2ff30ca03b37ac673b19ead9cc2dfeb6d1519d2660c142044c03d646943a196fa83627b1d77d67750bb955504fcef30c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626728, "uuid": "861a2d58-3008-41eb-88ab-333ba9b23b3b", "value": "FB83025163BAC948E8CE8E3D5CE30ECF3E12F9752E0DC8F161290159966AC621F2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626728, "uuid": "5ad5cfba-29a0-4ce3-a1e5-c61342665bd7", "value": "1536:wDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdE6q0T/2kOsMmB:wDAysJADlV378P3RPVJLdxq0D3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626728, "uuid": "7e754ec4-cc71-4f14-9da1-df1e36ec07f0", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626728, "uuid": "896c31ca-bc47-4514-acc9-b4f43590ed84", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626728, "uuid": "429ec703-2dcf-4a36-b442-3af95eb12319", "value": "statistic-45295161.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3424b3f3-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620625, "uuid": "8f97e7db-b42e-4eb4-99a0-3375537b67ba", "comment": "Malware payload", "value": "839ddd14cecf1d872c4492adf6fd0c9d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620625, "uuid": "a5494735-a8a9-4244-baf1-47c556e197df", "comment": "Malware payload", "value": "16207b593c915428e25cc8d0dab4af32cfe6af2d0d4dd9775cd4b5d247b0550e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620625, "uuid": "a0bbb3e5-b449-429b-bf27-cc71a19195ec", "comment": "Malware payload", "value": "84fd8bca9fd634db26d6493fb95052f6806091cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620625, "uuid": "9d90b00c-993f-461e-8c80-cd38db9625ff", "comment": "Malware payload", "value": "4b8060f1576f926f9c2bea0954527441da6b7bb92980e47807c594005794696b78d090833b58049b3655ca94043f636a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620625, "uuid": "4822b48b-e3d2-48df-9e06-f9feecd6ee2e", "value": "3D83021013B58A4CB9CE9F295CE21ACF2FA7F9B4160D68F571290894E722C074B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620625, "uuid": "8fb53dc7-3af1-4cc3-9946-ce39eb170a5e", "value": "1536:bDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJjs:bDAysJADlV378P3RPVJLdlDpH+jAJjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620625, "uuid": "55968e2c-6fc7-46a0-87f6-f7a3ddb6f8be", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620625, "uuid": "2bacc0aa-857c-413e-9e0c-69022f9dd38f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620625, "uuid": "2a5e3048-6e30-4ed0-a6c6-ca21d6d3676c", "value": "catalog-203697621.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41488005-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639545, "uuid": "00afee73-4f3d-4e2e-8538-9b34c78abafd", "comment": "Malware payload (Dridex)", "value": "ce5158196216ddd19c18f70d7bbc7995", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639545, "uuid": "61ba09a7-fc21-4bcb-970b-1ea529028676", "comment": "Malware payload (Dridex)", "value": "1623ef2365897101ea516cd58b6cde8988a7d272cf4b00f07713de0209eb5f5a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639545, "uuid": "cb8cf26b-5ef6-4c70-b28f-acec1c6e9764", "comment": "Malware payload (Dridex)", "value": "2bf2302d71305e3d5da33a1611e5d15056f89a79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639545, "uuid": "438a0566-eb05-4b81-98eb-1c9eba09c5b2", "comment": "Malware payload (Dridex)", "value": "0b797df41cd6900f025995263b4ee889e7ff33a29d3291b297f928779350548383de60b71871268ba6b058955744552d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639545, "uuid": "9f5311af-f816-4eee-9659-4914aa19b40f", "value": "3BF3E0D2EA8BD390F5DFBC7E385B363063B999488603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639545, "uuid": "b7e24cd0-14e4-430d-8dc0-0212eec26558", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639545, "uuid": "11909faf-377e-4b25-ad05-9c863333a579", "value": "3072:LtSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2TGkFY:RnS62Fl+pkeJl3CvRStrFl+EYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639545, "uuid": "333b7990-cb75-4ca5-a5cf-27a4397e2a4a", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639545, "uuid": "16281abc-5ad9-4d4f-8877-c418e092fe51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639545, "uuid": "9f1e77d3-8e3d-424b-9c0c-cf559c87aab9", "value": "ce515819_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fac788-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621586, "uuid": "eb85c1af-9d42-4fdb-a2e7-df619941a06f", "comment": "Malware payload", "value": "dc6e4830fc5d83ac693d22db8209449e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621586, "uuid": "03c70d93-d23d-4248-9674-888dfec96e64", "comment": "Malware payload", "value": "16256e1323d30c72715b319160301642fbd1693d7290ddf559e5830832e7914b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621586, "uuid": "beacb247-cf72-4c9d-af88-451723829895", "comment": "Malware payload", "value": "75af88bd1f496276dfa7487beb3170ee08b27b7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621586, "uuid": "cdf7e66f-6db3-41d3-b9c1-eb0c02e68c29", "comment": "Malware payload", "value": "a827989b8bcd50a390291feb55d35f421c763d745bc7cf7d79d56dd6aa8f7f858d50cbfff8c21a3740a0f91fb879fd26", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621586, "uuid": "af8148ea-0e43-4bdd-adf0-25bf63502967", "value": "8983122413B74F0870CE493AD8E31E8F7B6AF9B43D1E98F1556D04A6E123C9A1B2447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621586, "uuid": "96abee90-8d45-4e92-99fc-bc7b164b6b26", "value": "1536:dDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9cZ8VzpIsOKgdc:dDAysJADlV378P3RPVJLdGZ8Vg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621586, "uuid": "17dd3d39-5fa4-4565-af5f-2e3bdbf819e3", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621586, "uuid": "8ad71475-9b81-4d90-aa70-8baa88ce987a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621586, "uuid": "ab2b5b49-6cab-40a6-88e3-8d76cdb3064a", "value": "catalog-776507674.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6df988-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640720, "uuid": "bdf3fd7f-8676-46a1-a8a2-0654cbe53741", "comment": "Malware payload (Quakbot)", "value": "e3b9d1770fb61f99a6b7ca01554b7eb7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640720, "uuid": "ec5b97e8-df59-4b60-80f5-c68f68b57360", "comment": "Malware payload (Quakbot)", "value": "16329c93d7a254f6498ca21b0b2ee70cf76c7c623284502d022df87f416af707", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640720, "uuid": "c3ecf2cf-5569-4251-9ea7-1ec83d48b8b2", "comment": "Malware payload (Quakbot)", "value": "2fe01a988085a35ec4c3d556e652513dbd9ad53a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640720, "uuid": "4d9cb055-5cf8-4d12-ab31-511f306999c2", "comment": "Malware payload (Quakbot)", "value": "de58b231f9224300ec0fbb7c5793dcfb5ccd20cb7e37b5056ff85fc08ae7349e10caa838232c6a6e376bacd96d143c0e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640720, "uuid": "4d1a54f0-5823-4dd4-a722-823c690ea1ad", "value": "C2948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640720, "uuid": "94cd6d4a-abdc-4ea3-8a93-29d1b2252196", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640720, "uuid": "537128ce-5b65-4663-b5fc-f46f78b64628", "value": "6144:/WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmy:/WrsTwr03pdf8vhhOKJETlByy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640720, "uuid": "f82129a8-09ff-4868-9050-9b0b3707d300", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640720, "uuid": "c6f681f1-288d-4eaf-b8f2-5d2657bf7f4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640720, "uuid": "1afe6667-e2c0-448c-ada0-cf82e4b7449a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cf73a7-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619740, "uuid": "23829006-5d8b-4e62-84a5-596dfc92cb5f", "comment": "Malware payload", "value": "7ba0103bd49dfbd664cc79cced2142b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619740, "uuid": "61b2d067-9176-4fd3-a694-9b15a9b7ba7f", "comment": "Malware payload", "value": "1633913d10abbaa44efdb0e15711c55778aabd5761a2dbdf5c220b7745778775", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619740, "uuid": "4dbb17be-6e54-4e43-992c-4e2162a76dcb", "comment": "Malware payload", "value": "50f5ee13c47134adadae16f0a22f4650d51ee113", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619740, "uuid": "ecc9b7a8-0b3a-48e7-b5eb-aed24b19b02d", "comment": "Malware payload", "value": "4be69f5d83166b0f4352411b86b16acb2864fb758c220bf7ec2fec86091ba2347dd0e71c23fb050d6f1d6238c6e7c7bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619740, "uuid": "1e4181e3-275e-43a0-af53-06fccc721c9f", "value": "2483121013B54E5CB8CE9F295CE20ACF2FA7F9B4160D69F5712908A4E726C174B2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619740, "uuid": "648e6b74-23e4-4e0c-b0ab-586124dd9b96", "value": "1536:jDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJ78j:jDAysJADlV378P3RPVJLdYDpH+jAJ76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619740, "uuid": "d1e9ef63-dad4-4791-aedb-a244e274050b", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619740, "uuid": "1603e0a3-e8a8-4a58-a268-48a735d2fba6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619740, "uuid": "a0d2c4d5-a591-4353-9916-e7c8740557fa", "value": "catalog-1474997594.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17ac91a-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627385, "uuid": "330640d5-237e-4493-bf92-0564c48d7747", "comment": "Malware payload", "value": "249232c61db13b1b50419b2af2b2475d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627385, "uuid": "cc80b489-2561-4fdf-ad41-8c52f3d5e0bf", "comment": "Malware payload", "value": "163f87f55fb09f33031833c57aaaa4cdacab183500e01619470f4629a4a896b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627385, "uuid": "4bd0bafa-e487-43f8-96e0-9bc6f4b466d6", "comment": "Malware payload", "value": "f02cd23df22ad7a5dcfd93ff49f88199c10d70db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627385, "uuid": "1494ab9c-2440-48b6-8af1-485e2dd2e50f", "comment": "Malware payload", "value": "5a45f8454c01fa23a5df9209aa7344ef4a26b695648f6e97658300ac49cfba32d72fbdc4e29725e3b8cf6296765d3b2c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627385, "uuid": "8758d5d3-6a6e-40bc-8c7d-d9cf4f37d36c", "value": "9D83025163BAC948E8CECA3D5CE30ECF3E12F9752E0EC8F1612D0556966AC621F2457B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627385, "uuid": "cc400371-6da1-4865-9529-8c68bc5894c6", "value": "1536:/DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdl6q0T/2kOsMm7:/DAysJADlV378P3RPVJLdIq0Dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627385, "uuid": "aef687f8-4fec-44f9-908d-e5685006392e", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627385, "uuid": "de7d8a3d-8c4f-4f20-9939-2be0bca67202", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627385, "uuid": "796457d9-2061-402e-9a40-3f74771cad80", "value": "statistic-907141218.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc334ace-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626920, "uuid": "524df8ac-bc83-4eeb-87e5-b1a2cd73c6e6", "comment": "Malware payload", "value": "4f1f1d34dde9133d9042bc913633ccf3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626920, "uuid": "05c25ad8-8a42-4f57-a730-bcfda7da4fd9", "comment": "Malware payload", "value": "16543707834a9bc75b950fc77e8985633519f237a743f0b1c141ee6e8dd0ff01", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626920, "uuid": "735745ef-2c61-4426-8d5d-61f0a13d3b98", "comment": "Malware payload", "value": "1e6b2c93259541c77c56d0e2956b2d815824a823", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626920, "uuid": "2c5893ac-f2d7-48c5-af4e-c76b0e2a4992", "comment": "Malware payload", "value": "6293c8daea84f5667abb7b4e43eeca0e300d848fcac7f7b44953e9266866b137286fdecc3d37f77ac2ec3d7c3497ca4d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626920, "uuid": "e6e92a24-c591-4a21-bd1f-d06d99fbc32b", "value": "6283020403FB9559F88E9E39ACE20D8F3F8AF6B53D0A58E1966D0455B7268510B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626920, "uuid": "bea5b731-7cb8-497c-8247-1e15e819deec", "value": "1536:6DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wB7c:6DAysJADlV378P3RPVJLd/eh8wB7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626920, "uuid": "d3de0e63-a3db-425a-9a0b-e44f6969be7b", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626920, "uuid": "04bc9536-00c9-4eda-995e-eb1f6c351fcc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626920, "uuid": "5f759103-22ec-4450-82e7-33d9cbf5b00b", "value": "statistic-59319785.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff249843-a85d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640723, "uuid": "fde0ef73-7efc-4fab-b261-d1e799e96682", "comment": "Malware payload (Quakbot)", "value": "b07d3a5af874cc95c4dee5a6e8b26830", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640723, "uuid": "49f3034e-ebc4-4ed5-a754-3338080b2077", "comment": "Malware payload (Quakbot)", "value": "1657174e9b8a64577bf69a8bcdd6a2de8266fd7f444bf404ce9704a9ca0981a8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640723, "uuid": "3527eeab-99e1-407c-8295-89633ffb70b6", "comment": "Malware payload (Quakbot)", "value": "b8d42c62ae88c45c72a48220f7f54b42846e4ef6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640723, "uuid": "5ee96d92-ddc6-49ce-a4d6-ba45c9d3e8bb", "comment": "Malware payload (Quakbot)", "value": "674cbbf8857811be0d3d460306f53d5300efd6119fde6b9877d900663cfb652dc0dd55295fcdb023cf379b819e56f2ec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640723, "uuid": "a2da31cf-5616-4491-9401-a3e85b6b7963", "value": "0D947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640723, "uuid": "175c0032-71f7-4b03-aca4-b660947de4aa", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640723, "uuid": "1eb27b9a-cc85-4c3e-b0a5-b9f5d0c1864e", "value": "6144:EyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmd:MTwr03pdf8vhhOKJET5Byd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640723, "uuid": "9a90deeb-cb8f-4677-aed1-b6c34bc47f15", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640723, "uuid": "eb45d211-45d9-4f0d-be4b-89338227933f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640723, "uuid": "d32003ab-c0da-4221-a7ec-30e749b94fe4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6724d2a-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621730, "uuid": "cbd0db03-f809-4eed-939b-bba3667dd8c4", "comment": "Malware payload", "value": "baec2f2290f3e1680cc6c4ad031e14a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621730, "uuid": "e7a1c58f-6025-48cd-a5b3-bb3ea92ade7a", "comment": "Malware payload", "value": "165dd3582562779deec4b18dd9c4f38c74656d93b561f3000178c06cde34dd52", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621730, "uuid": "fb4dd274-95a8-4f84-8969-1439e21c8255", "comment": "Malware payload", "value": "d533c70284ecde95bd0fc85ea212d02371cbfaae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621730, "uuid": "d5d4e1da-2276-4a2a-86ce-f1a53e85a6da", "comment": "Malware payload", "value": "200799447b621da9ae128146c8cb3eb60ef8a79abc918e68803cb36ce6115524b0422d5dd97395dad3a8c03bc5765baf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621730, "uuid": "bac73c14-5ed3-4fef-bc5c-663f136bc274", "value": "5283027103AE8B5D748E8A3D58D21D8F3F86F4B42D195992512604E4E32BC669F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621730, "uuid": "5c15f1f3-c107-4c16-8e22-ee5d070d809a", "value": "1536:/DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdKDsMrbsTmHvVR6G:/DAysJADlV378P3RPVJLdKDsMU0dR6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621730, "uuid": "8244c286-dd10-4509-a166-ff9321105fb7", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621730, "uuid": "6236256c-a116-4b5a-8aa2-ebc9f08eb03f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621730, "uuid": "e7d8682d-de4c-4fad-876a-fd65e9963ae8", "value": "catalog-880097291.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909cf120-a7c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619575254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575254, "uuid": "b50ca7af-78d5-462d-a75c-858a89fa5623", "comment": "Malware payload (Dridex)", "value": "079e8eddb660b3633437c69b2f1b6875", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575254, "uuid": "707f1b11-9ba3-4b90-a8b6-b38334b95527", "comment": "Malware payload (Dridex)", "value": "1677766e4a888de992d6bb816c4d38b2a239ec44f74a70613fec7a48067c2eef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575254, "uuid": "6511a6a7-e11c-45f9-93a1-9560c7e4aeed", "comment": "Malware payload (Dridex)", "value": "cae625660b519438c70cd3b7d596b79d36cb551f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619575254, "uuid": "8865a952-4dca-4c98-9d92-5fdcda2b3554", "comment": "Malware payload (Dridex)", "value": "ae2f51f9545d88051d325fb5aafcb0842f266790cc15db1437079757bb5ff122d10a1567e77e245a13a8c0d2c1b43476", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575254, "uuid": "d7f688f1-8ce2-4fee-a0c1-c226395ef63b", "value": "46F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575254, "uuid": "8eb915a5-9615-40d7-bc4a-da05b3651033", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575254, "uuid": "6bd25acf-e530-4f7d-be05-273a21de9bbc", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619575254, "uuid": "6b45d9a5-6b66-4e32-88c2-bceaa77a2cbd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619575254, "uuid": "80a31129-94a8-4137-b951-f9a284a4967b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619575254, "uuid": "e0a893a3-21d4-443f-8f59-6236e63a0f68", "value": "079e8edd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e641d1-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621299, "uuid": "4e090c23-3c31-4197-bfc6-afb2040fd65b", "comment": "Malware payload", "value": "bd941fa44a243eb5fa8b40b274217241", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621299, "uuid": "dbbf0393-a617-449d-86b0-c73d3e971b40", "comment": "Malware payload", "value": "1689d36aeb35a9048e507acd8acf35d3bd7593ece56b0c42a72c1733d4bb48d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621299, "uuid": "9a153137-e3a7-4e64-865f-7e75442a9ae1", "comment": "Malware payload", "value": "fe0c8399ca077c2a76b915f4e136e10d6d9c1dd9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621299, "uuid": "8f82bca8-6af8-4b3b-a61b-0d99cee29a79", "comment": "Malware payload", "value": "b110fdd40a5043dd9967512abc9d32861d735bb5ae977b32d5b35ee0ad8e88aed8f8eca6ff47ca23fda2f52f54f0b756", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621299, "uuid": "a2d1ceb5-54fa-4ec8-81c0-8d98c5e383b1", "value": "2C83021413B94A5EB8CE8E296CE31E4F2BDAB8F4191A64D1794D04E1F2374664F28D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621299, "uuid": "d77a3f45-d0c7-45b1-98eb-5ef774be8b20", "value": "1536:ODXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0w9:ODAysJADlV378P3RPVJLdP8BXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621299, "uuid": "43f5bce5-5e20-40c4-847e-f8c3f9f9e555", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621299, "uuid": "14f4f999-7662-4db1-8e0f-fda3da1440c1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621299, "uuid": "b2c65c3b-e82b-4083-8b23-3f477371b40b", "value": "catalog-543678875.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045c20c8-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625699, "uuid": "f9671057-58e1-4a8e-92b9-1835231cc328", "comment": "Malware payload", "value": "aae8ecc066fc794990c35e9e2f2ce43f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625699, "uuid": "1d0ad011-6db9-4f82-a0b1-b821a7a1eb44", "comment": "Malware payload", "value": "16ab3e0d550432330132e11e5514f0f240b6e662ff7c6624f0ecf426ab0c4d60", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625699, "uuid": "ab134db4-34c7-4598-a8f0-f1c0ae62a896", "comment": "Malware payload", "value": "13c549b16a88c32c95191ce29cfa39952f481d7c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625699, "uuid": "5273944a-7f6c-46df-ad36-bb9d9c77704d", "comment": "Malware payload", "value": "b1f44e0a217f0e186e5b351fe4d288de184a4d5748974d7be0b80f4726a4b0504488a22dca21f4ca53aee62c2f6fd17e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625699, "uuid": "7f5573c7-80cb-4659-ac50-ab6e331d2057", "value": "5583025013BB8EADB58DC93948E20D8F2F56B6B02D5B5CF2B12D0494F5338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625699, "uuid": "80d9bffc-3cff-4b91-94f4-fbe391d293db", "value": "1536:oDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7Ei:oDAysJADlV378P3RPVJLdw7Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625699, "uuid": "de90e7d9-42a7-49ac-b1d6-166dc430a9d5", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625699, "uuid": "d9fd0bac-32e2-40b0-80a7-f20ea37a9fda", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625699, "uuid": "c906f1ad-94da-4f6d-9aa8-1805f1ca522a", "value": "statistic-1686194514.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad217fdc-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619540, "uuid": "950670fe-d294-4e47-9abb-e8564bc20939", "comment": "Malware payload", "value": "feb2f77e9d94ad0f83112af020dabdb3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619540, "uuid": "9f75d89f-1224-4ee3-8a9f-b14107251a00", "comment": "Malware payload", "value": "16ac1670fc37b1f51ddcc91b7ed2c0129164175ed89946b5e013c8ea0e454152", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619540, "uuid": "b7daa268-4f6c-4eb5-8b2f-ff2f4f9fc2cd", "comment": "Malware payload", "value": "f1c3eab62f1762d40d8791a0cd95b0f7d168f02d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619540, "uuid": "dc1dbb8a-8317-4698-b18c-bd635f30a945", "comment": "Malware payload", "value": "55962a60cabb91f5617edc21a45dca71b41f1eab3ebce75a5bd9985c0e09bf5127a069aaa1d1d5921926baa5c52b808a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619540, "uuid": "fdf71c74-28d2-4abb-af39-89bb4aea16e7", "value": "0183121413B94A5EB8CE8E296CE31E4F2BDAB8F4192A54D1794D04E1F2374664F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619540, "uuid": "d4f132e5-1000-43ca-a871-997b8ea28ec8", "value": "1536:RDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0w4:RDAysJADlV378P3RPVJLdP8BXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619540, "uuid": "d9493e6a-39d8-4060-bcf6-165898afe66b", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619540, "uuid": "9bec7ff2-bbd5-44a9-9de4-af1075e4d7e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619540, "uuid": "096a6cb9-13b8-4877-b9c2-7092f437c7ea", "value": "catalog-1333745796.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cc43e7-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640725, "uuid": "83c0655b-a2f1-4842-b5e0-241490c3b5c8", "comment": "Malware payload (Quakbot)", "value": "3d101ba8fc58b51148bd4c1ca68f7d5f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640725, "uuid": "be42cb5d-d6a4-4d45-be4c-d602aba8d5cb", "comment": "Malware payload (Quakbot)", "value": "16aecff52e7fe84ec218f95f28ee417844363879c2a7f04f28d5659022a040d8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640725, "uuid": "dc06a9d6-246d-4e5f-b3b9-cb006d0298bd", "comment": "Malware payload (Quakbot)", "value": "790c0849de609d3513bb03b6db9b092335199945", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640725, "uuid": "7b5020ec-3af8-4588-84e4-11248969df08", "comment": "Malware payload (Quakbot)", "value": "0b8ae1db96e651fd1da9ef8f4fbc241b34bca553ddce40fab8d363ebe15c991207f1980a44197476da02d7c8f3193442", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640725, "uuid": "fd5eb298-e884-434a-8992-84d37e58f6bb", "value": "5B948D396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640725, "uuid": "dc4a84c8-f913-46fa-968e-b01562ba2b75", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640725, "uuid": "36778014-706c-4d67-8c5f-29ea3e966059", "value": "6144:MWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmm:MWrsTwr03pdf8vhhOKJETlBym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640725, "uuid": "b166b640-7fba-4190-a3f2-c6911fb30eb2", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640725, "uuid": "6e12d6ec-a733-4c75-af97-96e2f949bd57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640725, "uuid": "fc3c2fe3-3f6c-4e12-9606-cb8b1ba82384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3a200e-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645118, "uuid": "b4b2e2ba-78a6-4325-8216-61b77577c0fe", "comment": "Malware payload (Dridex)", "value": "98baf0bacb76560c867b2d251eaaf410", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645118, "uuid": "991a5c73-76ca-4020-86ae-141008f06ad0", "comment": "Malware payload (Dridex)", "value": "16b015e2dcef3e2ab2d85dcfa63221f6eb7b3c10aba3eb30fc52e4749b38028f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645118, "uuid": "833995b3-2a4f-4c6f-a9b1-e5c1f435f5fd", "comment": "Malware payload (Dridex)", "value": "7128eecee069a42e40e0287115d148d7d4e4fe13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645118, "uuid": "81659f22-9b76-4014-97c3-9120019f9f65", "comment": "Malware payload (Dridex)", "value": "6dba9344f59731627bd12fc4723749bc37ab51e02f86a02664203a2e46129fc260ad9151930027b2ca620efbaa11533f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645118, "uuid": "b68c7453-07e1-45cc-a4a8-b83105aefc9b", "value": "45F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645118, "uuid": "6da42cd0-98ba-4e76-ac11-189bda1dcff0", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645118, "uuid": "41eb6be2-7d4b-4a16-9858-54c237dc258f", "value": "3072:r38CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYVZwd:InClX8WZ7/HrRCADTR0VlvZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645118, "uuid": "9885af17-3ba2-4115-aef4-ea606ac79b84", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645118, "uuid": "1eace1f8-5c42-4659-b5f6-eba671197dae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645118, "uuid": "d797f81d-4fc7-435d-83ba-410909f37ab8", "value": "98baf0ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9b50c0-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627352, "uuid": "9a23782e-6922-4ac7-b369-d666b4bc4756", "comment": "Malware payload", "value": "4ea51cdacfd6e3b4fad025f23606849e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627352, "uuid": "c2dff6b2-88b0-40f0-912f-217e54281d52", "comment": "Malware payload", "value": "16b4374f3538fa7825c5af32df3a34c3e4e2e4524fbdb3ed519a2fcea8c58f04", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627352, "uuid": "283e2d71-96b5-4142-8779-2a92add5f964", "comment": "Malware payload", "value": "64af450589a5656a57c02008eb49693dd67974cd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627352, "uuid": "ddf659a0-35fb-4077-86d1-6a7966a3fae1", "comment": "Malware payload", "value": "5fe7cc143e1d8952451f9f2d563f43c75432a895d86d474674dc6f370b48044904778b632c7145c75f5f44978375251d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627352, "uuid": "3da2e86c-e527-40bd-8acd-3bfa545d29bf", "value": "0683021523BAC998F4CDDE2D4CE30D8F3F42A9782C1ED5B56229019AE327C964F2453B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627352, "uuid": "5e1ca7d6-36d7-4adc-ad82-3b0db6085c06", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdUPqXT/WkO0B19M2bL:4DAysJADlV378P3RPVJLdoqXjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627352, "uuid": "c2e86cef-f3fc-4ae2-bd8f-172f82fbb6f4", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627352, "uuid": "d2704f12-b627-498f-bb02-f06f7ce5b1be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627352, "uuid": "29cf11b6-af47-4dba-b4f0-dc6316563be1", "value": "statistic-881899810.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb47d38-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622014, "uuid": "24a73c0f-cd5d-4379-858a-ebea9c737c11", "comment": "Malware payload", "value": "ed5687bbd2c96574b4dc5b059cb1c250", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622014, "uuid": "7dc2af0f-1708-4872-b8e0-a2c248e0e1ed", "comment": "Malware payload", "value": "16b92ce24a4a30a66d8ade000cc7375e67eb1db4fe4d61d4d016903462bf3353", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622014, "uuid": "e439603c-e031-4917-90fb-5b59c9e38f2d", "comment": "Malware payload", "value": "3f02ed583812fd70e55942f840160cfa69b234e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622014, "uuid": "b8fe18bf-fff4-45e1-bd74-fc4dc2af7fa7", "comment": "Malware payload", "value": "59e32755461e29ba4cd08d4c6b580c39ae080c8681d064624e7b52c0a8af2f206f1589cb26add3ca034bceba97d47d50", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622014, "uuid": "5352c23e-a9c4-4cbb-9c85-a1af29df4402", "value": "5D8302D9213DC5DF717C6A09B6AC893EB94DACB4310464AED4C4366EAC8DAF79C93430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622014, "uuid": "425b6d20-ecf8-458e-b9a4-f70956938f7d", "value": "1536:KG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttUI5EzJKE9LfFSp7m82:KGEhrHJoEsBMG7qzkGI5AB5gpS82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622014, "uuid": "9fa2f03f-466f-4cee-b0b5-c5d5d84de4fd", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622014, "uuid": "b319e17b-5ce1-49a3-b237-c52911e09790", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622014, "uuid": "349134ac-0abb-4ed7-8575-6d7b17bad541", "value": "diagram-1070349212.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1528ad6d-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623580, "uuid": "37ceb7e0-f4c5-43a3-a270-bf88de5019c2", "comment": "Malware payload", "value": "f2b79a364401e873e9c7cfcf75e773b8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623580, "uuid": "18499c1d-24de-4862-b820-a191aeb755d8", "comment": "Malware payload", "value": "16c1bc145bf74eef09662a0f97f74f461a876bcb22c145651fd3a08cfe41cd9c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623580, "uuid": "7935e10e-27f9-416f-8cd2-8774e59bed3b", "comment": "Malware payload", "value": "59afa7f36f1921adc8d563e1a5742dc127e289ea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623580, "uuid": "9429ae68-18da-4850-87e2-b99ef2d09b5f", "comment": "Malware payload", "value": "d719f8c9466159ebe83c43364d5b3a85f9d86d7a40221ba14cee50119ebe544cbca7723176914823350ed288898d7a5b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623580, "uuid": "bee52ae1-3798-4f4c-8251-1297e7766a5f", "value": "8A8301CC663ED2DF763D2D08A6D8883E790DECB4610434DEE4C81A6B5D8EEE75897460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623580, "uuid": "80517f3b-7651-482f-8ca5-5ac5917b437e", "value": "1536:DG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aS+:DGEhrHJoEsBMG7qzk6h12xGw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623580, "uuid": "618488a4-6aa0-4b33-9827-564d8adf701f", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623580, "uuid": "4ba0e0b5-9efe-4df0-8eab-7872d7401cea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623580, "uuid": "83001817-b621-4d26-9f59-75d63c77dae5", "value": "diagram-267446788.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028afca8-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640728, "uuid": "60393d13-821e-4c8e-a6da-9ac7d73a109b", "comment": "Malware payload (Quakbot)", "value": "9f06473303f9176a95d1524bd7a24d4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640728, "uuid": "da49579e-19c9-46e1-95bd-049c85164474", "comment": "Malware payload (Quakbot)", "value": "16c5746903822d56b322f7dbe950600c6f2b7fc13c43d38cbe41ae355137bb06", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640728, "uuid": "e0261b6f-c910-433c-bfec-3082dae23e29", "comment": "Malware payload (Quakbot)", "value": "926b8ec4625e67e8d0503a6e1b6c6b8ce484b091", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640728, "uuid": "c0abe71c-197f-4428-93cd-ff957a7f989b", "comment": "Malware payload (Quakbot)", "value": "98609b6160103fb657a9ca0976d25e7db2c1a30f122bdc81bced3fe0d5f5dd9618bec0eb9d42906cb58f626bc7a58f0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640728, "uuid": "0360a047-58a4-4eb7-ae1f-0acfbd8eaff5", "value": "D1947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640728, "uuid": "c7d0df27-a630-474f-ac1a-768c07a73bbd", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640728, "uuid": "1d5cfbf7-b5ff-4247-a7ab-9be5626bf4e6", "value": "6144:4yPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmI:QTwr03pdf8vhhOKJET5ByI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640728, "uuid": "6c2f5a18-943d-47b1-9b7f-74d74fdec7c7", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640728, "uuid": "07d0a414-b5de-4025-bd39-87124ceb1a61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640728, "uuid": "91a69e93-a5bf-4e1b-b0bf-c0135c8996ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f7025d-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619769, "uuid": "7e728473-9200-4482-83dd-e1c7a66a6bd0", "comment": "Malware payload", "value": "3db7358ef1af6ea4819d0c37ccb36faf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619769, "uuid": "b07220fb-b9f2-4526-83ef-cc7921132d19", "comment": "Malware payload", "value": "16c7e77124a8eddc7113cddea164a0bd25ce5eb2b95404f2b642e43de3e01478", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619769, "uuid": "548e6545-9090-4b49-84da-effe7abb3812", "comment": "Malware payload", "value": "f8f578b941c5d971e7e124d3ba4d5dc7c354bd44", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619769, "uuid": "f5d5e8d6-5255-4b3b-9afb-720142c7650f", "comment": "Malware payload", "value": "0d28fb41e4df61521a382d9de4aa5a851177a8bf9aa08578aeda76ad63ce319e5bfb7fe548104b6e758fa89d3cad1624", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619769, "uuid": "3e5b8367-1adc-4499-8e22-03ebcdbd40f3", "value": "E183021413B94A5EB8CE8E296CE31E4F2BDAB8F4192A55D1794D04A1F2334664F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619769, "uuid": "e7cdd38e-9722-45eb-b705-291258d50486", "value": "1536:eDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0ws:eDAysJADlV378P3RPVJLdP8BX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619769, "uuid": "b27567bd-b3ac-4e5e-adfa-1d446d9dfeaa", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619769, "uuid": "3ad1fa56-b569-45e8-8880-131ca8dad38c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619769, "uuid": "84ce340d-e671-47f7-b95a-72fd1caad492", "value": "catalog-150116157.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bb1d65-a7e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1619590563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590563, "uuid": "5bf71d79-fb15-44f0-988d-1feeb0edbf59", "comment": "Malware payload (SnakeKeylogger)", "value": "d56013543a9bd1f5a4041c52d39a7b41", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590563, "uuid": "eb6b7df1-18f8-41e0-b438-381b0abba950", "comment": "Malware payload (SnakeKeylogger)", "value": "16ca88599a02f19c57cf9d2953276c404e6581bcb34ca4b7e5da78d0bacc7f89", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590563, "uuid": "93bdea97-7a3a-4494-af24-b89e2f8560c7", "comment": "Malware payload (SnakeKeylogger)", "value": "e93fdcd8bc0016e2de14a269fd2b7cad7bf38c33", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590563, "uuid": "710293da-7c75-406e-984f-ccf7b66712e6", "comment": "Malware payload (SnakeKeylogger)", "value": "3dab29d876e1a7a68dfcae7ee661853bb9d1e37e06d3670127df8de3e3caf4b0b902b303bcce62336b8494a1041d5c05", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590563, "uuid": "429cba98-79b5-41b6-86d8-620114c972bd", "value": "4425BFCE589485D3EEA61BBC20B7AD6103B77EC29D35EACC671C7245377B68E4026603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590563, "uuid": "caac9b09-2c15-4d28-9625-0bb67c073d92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590563, "uuid": "43980ba8-d67e-4d1e-bbe4-c4acf642bdb6", "value": "24576:4iJbaiJbxiJbCvPc1S7l5vLrx+84VbdBkUiJbd:4iJWiJNiJ8PIS7DvLrx+9dBkUiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619590563, "uuid": "54cb01da-3a64-4883-ab5e-a63fe3a70494", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619590563, "uuid": "b4ca47e5-270c-49a8-8d81-a060d47d6c01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590563, "uuid": "80454300-794a-4dca-91fe-17b24797e28b", "value": "SOA,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ef860c-a808-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619604067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604067, "uuid": "440668c2-dadd-47c1-abdb-8b3f8dcc766e", "comment": "Malware payload (Dridex)", "value": "9bd3f4756fe49718fdd16ae538d2cb10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604067, "uuid": "25332734-cbe2-499b-9a06-d8c047057aff", "comment": "Malware payload (Dridex)", "value": "16ce04755b85c3c4f1d727e650ac7a15fb9abb7df4f4bdbbcddf5ff838db9e36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604067, "uuid": "ebf1dd31-b823-4591-95f8-3642d2e8348f", "comment": "Malware payload (Dridex)", "value": "a9bd7680531182122167fbc5206dd58174666044", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604067, "uuid": "f4f146dc-178d-41bf-ad4c-a6bd41f8101a", "comment": "Malware payload (Dridex)", "value": "a3bc8d8efac95768f9932c3e80322811c0540473551e91978b7aac93ced9327104d491099cfada30b29ff70dddfb20e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604067, "uuid": "85b41e51-1be6-4ce0-9b1a-3fc85737278c", "value": "97F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604067, "uuid": "4b4bb74f-a0c1-4352-aa7f-802c5993e624", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604067, "uuid": "c04803c1-2f08-4c63-8fdc-bf0258c8be4b", "value": "3072:8lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:8lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619604067, "uuid": "957aa47b-1c1d-424f-91e2-ec7ac4d54b66", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619604067, "uuid": "34a23611-6e03-442a-a8cc-a5a505f9a06b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604067, "uuid": "a56b5073-e4bc-466a-bda4-b66cf57f1bea", "value": "9bd3f475_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce80eff-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621391, "uuid": "df071172-e3b6-45db-b1f0-9c814648dc9a", "comment": "Malware payload", "value": "cbdae222504af980c21071c2ed0e7c43", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621391, "uuid": "dbe73bb8-02b6-4764-8a1a-c57d7acd8a62", "comment": "Malware payload", "value": "16d1fd48db024215f6bef3e3257ba34514d2c38d65f5995f8e2b6a320c8436af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621391, "uuid": "b05a4263-0b2d-447b-9181-68a1a5afd0fc", "comment": "Malware payload", "value": "ba6992b4a503a8b01bcc76440ff6f09e2fd41432", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621391, "uuid": "a14d09f2-a52d-4074-949c-3d38df4c5283", "comment": "Malware payload", "value": "daf419af44aaca2dfe8c377fa21d7856936447123befe0d7d18a15f1836e743bc40a6493314be1e87cbbf385c062e653", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621391, "uuid": "daaf538a-42cb-4908-8df7-0d536a5fcd65", "value": "5583025413B94A5EB8CE4E196CE31D4F2B9EB9F4191B55E1795D00E1B2334660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621391, "uuid": "76fbe8be-3a50-4b1c-be66-f388b5872a4f", "value": "1536:IDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdnIkGV8BAY0wIf:IDAysJADlV378P3RPVJLd68BXyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621391, "uuid": "6305139b-d74f-48f6-824a-31a50ffad598", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621391, "uuid": "1ce4fe18-8b09-425b-9689-1660d5bf072d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621391, "uuid": "ab04187f-fc20-472a-acbb-285768bbdcf9", "value": "catalog-632045157.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86735959-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639661, "uuid": "a6c3e8c8-3f19-407d-bcf3-0ada4b6067bb", "comment": "Malware payload (Dridex)", "value": "eb97904a39175cba0460d8f5a0bb614c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639661, "uuid": "62b4ce14-1e3e-42fc-91a7-f71ab3878005", "comment": "Malware payload (Dridex)", "value": "16e090e386acd5677226e8899347b91f7e21352c72530a36e824ae6f84f756c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639661, "uuid": "338e4d77-2c45-4772-a171-c1cc69d11c49", "comment": "Malware payload (Dridex)", "value": "b07a84d963d7168bcf7976c768a2d78ccf3ca0a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639661, "uuid": "3ce87d62-9764-4d43-827b-c66efbab5d46", "comment": "Malware payload (Dridex)", "value": "ddabc0811bddbb609dbaffb9a0bd8b49e77a5aa0af5dc1b4bd07b9d65c76d44fd392038390533421c65ab5d11670e8b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639661, "uuid": "420c2979-ce03-489f-9210-90e83eb09a90", "value": "A0F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639661, "uuid": "8f41da32-f628-410a-b1f1-ad09f4910692", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639661, "uuid": "e75d1bab-7352-4bd4-9d8c-0ec06094f654", "value": "3072:fZSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd21GkFY:BnS62Fl+pkeJl3CvRStrFl+EY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639661, "uuid": "68f927ca-afb1-4af7-a251-14a854e46179", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639661, "uuid": "b76d1dbe-50a7-416d-9aa4-46e7e75bfbe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639661, "uuid": "698555dc-1fd7-4dd7-82aa-762d4681e669", "value": "eb97904a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e33b51-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624339, "uuid": "2fe6c04e-6cb2-42c3-81ba-f0b6be4feb03", "comment": "Malware payload", "value": "f880b84aa72955ca8a2930ee49b391be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624339, "uuid": "2a872d24-b35b-4b67-b953-d81a763d3877", "comment": "Malware payload", "value": "170b14737f2578cb088c4af50bd733b2434872e7726fb7ef4ed04fad50758978", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624339, "uuid": "7c0002f5-9858-4941-abca-7c1d11d324a8", "comment": "Malware payload", "value": "5d1fe2fc8a8ef4045d67e08c4b2fe7dbf1c9b02a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624339, "uuid": "40a88b1e-3730-4fc4-bc35-dee0e3d3ebe2", "comment": "Malware payload", "value": "187cc0108cfe3de077c01c17103fdf2b5aed5a83c82a0c4f78ba5d7194e8a57436028627945c1aa972542048ceae3fe3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624339, "uuid": "871158a0-9fed-4b49-b065-4c13f898f3ec", "value": "CF83029C363AC2EF757D6E0961A88C3F6A0EE9793004749DE4C07E679849FA70E57530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624339, "uuid": "b532c171-600f-4e9d-9f8d-d60bd9a82a73", "value": "1536:CG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttcsujryI8bFu:CGEhrHJoEsBMG7qzkDI8bFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624339, "uuid": "7a778985-e461-4413-95b1-2a104bdafb76", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624339, "uuid": "4dac821d-3a1b-4326-a0fa-ed85cff66e1b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624339, "uuid": "240c6206-4836-454d-9ace-994ec666365e", "value": "diagram-701206503.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0744c67-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620055, "uuid": "9d553860-534a-4f1b-a4d9-77bfafcb7b73", "comment": "Malware payload", "value": "4adcdf1df628c91dbf8fe4ce22883cc6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620055, "uuid": "857046b7-ce6e-4525-89fc-1158d11b89f3", "comment": "Malware payload", "value": "1717793fe11e85de840376da30d83c96ef05976bfe3e5e5c0a4d9493fdf78fe3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620055, "uuid": "f8ec0fe8-4d4e-4570-837c-56a4923182be", "comment": "Malware payload", "value": "5c36a632c992f8e21e6f9cd2050c61b6dad5a6a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620055, "uuid": "77c9f979-11c7-4a95-8add-11fbef273165", "comment": "Malware payload", "value": "387cb6e0ecd107c3973c2875f1819d202c0f5ca7f2f6fc5c2bcd5ebfa579ff5d3fb20a616772d694ec49c46a80440454", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620055, "uuid": "4c5d8576-cc01-4391-b86b-befed42b05b5", "value": "D483021013F68B48B4CE5F2DA8D21ECF3E97F8B9150D6AB5612804A9E626C570B2097F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620055, "uuid": "4a12ac37-4a83-4464-9a4b-ae245dbe28df", "value": "1536:uDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdLDpEDP9+jAJui:uDAysJADlV378P3RPVJLdLDps+jAJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620055, "uuid": "08b16b50-d5a7-40b5-b191-fd6c25ed2b2e", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620055, "uuid": "068f139a-d8d5-4d6e-a023-3ea05db3adeb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620055, "uuid": "d6fe8795-9185-43a6-93ca-fb687cbabe95", "value": "catalog-1733846253.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cca826-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626701, "uuid": "fe0ff3ec-a7ea-4f54-a296-5f5eb0aa2f06", "comment": "Malware payload", "value": "3865515df7cd50f1db64e9685c5e69ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626701, "uuid": "18587fae-4afa-4589-a201-6c55eee5e1ae", "comment": "Malware payload", "value": "172778eebd8c208edc0dc15b7455cbcc4a539eda39a05d81d5385f226c1b859b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626701, "uuid": "18b6df52-ebb8-4084-9e1d-17b30e920f5d", "comment": "Malware payload", "value": "5e3f21ceb03f23b1fc34e56930c08e82be676db5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626701, "uuid": "075d7978-b69b-4ccb-96d9-84d930fecf66", "comment": "Malware payload", "value": "e5cd4eb2521df9de8f768b6658e5432c523ceae48f696f28b9bdae24f8494414812e80e41e126532588819fa9c339728", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626701, "uuid": "d4267d30-b297-4bac-9327-bea4ff490616", "value": "9E83129413BB8EADB58DC93A48D20D8F2F56B6702D5B5CF2B13D0494F1238961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626701, "uuid": "b447765b-6f22-46da-ba98-d02cd807ceaa", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7KK:XDAysJADlV378P3RPVJLd47r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626701, "uuid": "487e0943-e235-42d0-93a1-772731a54f00", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626701, "uuid": "b52f81be-ab5e-4177-8418-b448e1aff8f5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626701, "uuid": "8aedb7dd-87e5-4053-87c0-42ae4ca2e0bc", "value": "statistic-434925309.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863b05ad-a828-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619617756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617756, "uuid": "2b914970-538d-4c8f-8748-f3ae12a60e58", "comment": "Malware payload (Loki)", "value": "9990e0199097bb588c1acbba35ede1e7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617756, "uuid": "20d17b30-26d3-4e77-9971-3ea6d0133a64", "comment": "Malware payload (Loki)", "value": "1728580833e391421d94b877334d676cdc65c24c8bf3fdd4fc7611daec9cc7eb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617756, "uuid": "4d16b5c9-5248-41b5-bae5-4418d1f20982", "comment": "Malware payload (Loki)", "value": "06cee4ba58e9ac3f7a991c40ac660032e5f8ea41", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617756, "uuid": "0a0bc1ac-b71d-4a0a-ac80-9a44756b9bf8", "comment": "Malware payload (Loki)", "value": "eba8bd2a178fd768c25e087f9b5e7ad2cea10e632aa8c87b950387539cf70f81dfff55cb316812a6fe6e3ab98e0703f7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619617756, "uuid": "6e8d2366-805b-48fc-9f36-0348a70c8d86", "value": "32F37B9D766072DFC86BC8768AA92C64EA607477470F8303A45312EDDA0D99BCF191F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619617756, "uuid": "b9350e61-29c0-4fd1-ae30-4e363b23feea", "value": "3072:SIzl6R9XXSxBLB4tjFnn6qLUNz4kyOiPktN8rdKZ2F5SvgAM0:nY7HSitjhKxny/Pa2kZ2CvgAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619617756, "uuid": "3b1953ec-6f65-49d0-8753-0cf8c0296b7b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619617756, "uuid": "5cf6a907-6e88-4d8f-ad65-0c21cfbfa6cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619617756, "uuid": "c4b61fbe-bbce-437a-ad5c-e376ecdc9254", "value": "REQUEST QUOTATION MAY 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4497de20-a7f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619594024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619594024, "uuid": "4fc5d674-c91f-47c1-a99c-7fc7ed983803", "comment": "Malware payload", "value": "17da9c9f6617334b1934dc9527a3b071", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619594024, "uuid": "8b03b37b-615e-47df-86e3-ebb2d150a66d", "comment": "Malware payload", "value": "1730da6bbda8300eca3cc4ebd072fbeba77dc964e86af7c672dd02f4034dcc74", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619594024, "uuid": "fb1425f0-6a2b-4a45-a793-2080f52853bd", "comment": "Malware payload", "value": "96035e135c66894eb15d7419a0dd4be8d8a497a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619594024, "uuid": "7ba1f053-0e9f-455b-a9d0-55a84b53dbb5", "comment": "Malware payload", "value": "0521059eba219db040f79a06ffe6518237d11877bb6a7aaf4f2ef59ee16e13af4e5840f22b8379776e5429a2aee5769c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619594024, "uuid": "e7631932-8c74-4672-934c-07c984e98696", "value": "A284236F5233B0E14A47D0F983CF5D72A3016F9C0C89E1A780AB764795A795A13FF229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619594024, "uuid": "da64f6ba-b1ab-4e15-adfd-074e50499165", "value": "6144:8EbjrxnuCcu3W447NlJC/50Ypk8WgCFSrv1BQKyE7nuI/YS4+uzj/YBd9r8hY3IT:8EbjrVKJ4MTMbWErvTQBE7uI/t43DYvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619594024, "uuid": "000efdb5-0b1b-49fe-af46-7308279811ba", "value": 383990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619594024, "uuid": "c2fea9f9-61ca-4b12-a595-786ef9be091b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619594024, "uuid": "8b3a0e22-d441-43a1-bf79-f744ae52f924", "value": "VESSEL PARTICULARS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5cda7d-a83f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627462, "uuid": "b0eb2a16-ffe9-43c2-8de2-ce7191a38b7e", "comment": "Malware payload", "value": "409432867bba2945955354932c76d330", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627462, "uuid": "f482c671-d80f-47ca-b605-867943f777e8", "comment": "Malware payload", "value": "174f5a99504b8410b085e650f2d9ef039ad21d598d744cdf2c782d3ef1f5051a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627462, "uuid": "2ad98c80-47a5-45ae-adba-1d4dc9cbbb22", "comment": "Malware payload", "value": "7c9d67f303ac3888e563a28fc6206cbddb6e9f48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627462, "uuid": "002f7429-5b87-454b-bb4b-3ff7ba6df761", "comment": "Malware payload", "value": "bde15db1bf3f4140d3fbb22d4cbed3fbdb80724a0c8a00f4656b7f8fa297c222b9ca2820e1d030043d13f9548b1d7f55", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627462, "uuid": "ba939514-6bba-40ff-af0c-be5011d01df2", "value": "0C83021523B9C998F98D9E2C4CE30D8F3F42B9741D1ED9F66229019AE327C560F2497E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627462, "uuid": "83c772ef-1d05-4aa1-bce8-e41e2f378dce", "value": "1536:TDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdpPqXT/WkO0B19M29D:TDAysJADlV378P3RPVJLdVqXjlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627462, "uuid": "c75830e0-37d3-4d03-9d7d-f51c3a5064d5", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627462, "uuid": "f2d338a8-42b9-457a-9daa-3a6d6c430950", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627462, "uuid": "174dd2b0-5b29-4e41-bd8c-8e6a785910a8", "value": "statistic-95747158.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c6b7fe-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623047, "uuid": "2aa06755-7aac-4e72-9e75-db47219287b8", "comment": "Malware payload", "value": "773daef0fa6e4fa1f032e670184fa416", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623047, "uuid": "34e3eac6-da4a-4868-ab66-6963c8592e0b", "comment": "Malware payload", "value": "177239d565ada3826eb05af8120ec63f95884c521383ec456276c116817faa70", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623047, "uuid": "8f9e6484-8d5b-4c09-86a3-ec4f6613f4c1", "comment": "Malware payload", "value": "d8759837dc57476d9d9a03e924b873f58f681c93", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623047, "uuid": "401c79e9-a786-4b2a-a2a0-679b7ebac4b6", "comment": "Malware payload", "value": "12f69cff21d48cfd0de4efaf32c13ae98d2abb5beb6ee0988dfaa03e62f3f9be5bc4bcd27de66ea4181a556296f4e167", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623047, "uuid": "e2439740-e33c-47fa-9b64-9bfc2a6a0293", "value": "AA83028C363AC2EF717D6D0865E88C3F6A0EED792044349DE4C06A67D949FA70E57530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623047, "uuid": "5d84b2e5-581a-457a-939c-b3e902d972ae", "value": "1536:VG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttBsujryI8bFc:VGEhrHJoEsBMG7qzkSI8bFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623047, "uuid": "0639442a-7c15-4aca-b66b-103be026eb28", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623047, "uuid": "3bf1cfdc-c3e2-47df-9ebf-59906e56c076", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623047, "uuid": "f64535e1-664d-4106-bd24-a18aee5f403d", "value": "diagram-1811093037.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02068c4d-a83f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627413, "uuid": "01af6e49-3346-4117-ad7d-ee9c7a9a9d76", "comment": "Malware payload", "value": "e3d9cae56f7cf445e17106d9e31f6116", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627413, "uuid": "5d76e0fa-6b9a-41eb-be0b-8f9492046b48", "comment": "Malware payload", "value": "178bbfed3d92f5f3b4d06a28792feaccd17eb7bef6161441b9ab18a994546b04", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627413, "uuid": "e143dd5a-5ebd-43c4-b297-57ead1fce917", "comment": "Malware payload", "value": "2673496d990aadc8a0e14a987d06c0cd668ee429", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627413, "uuid": "1c29f46f-217e-4aac-aaf8-c82f2ade996a", "comment": "Malware payload", "value": "fc3583067a51f0eab50976a34dba9f6eb79fedd3bb2591396b4ff16d22d532cad30392d73bd0fe10e751bb17b3f333f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627413, "uuid": "cc195b75-77ea-400f-8990-166bb5084bbb", "value": "8683025163B9C648E8CE8E3D5CE30ECF3E12F9752E0DC8B161290156962AC621F2457B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627413, "uuid": "0be9a802-fdca-460e-a531-3d3d41aa5ad8", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdl6q0T/2kOsMmp:DDAysJADlV378P3RPVJLdIq0D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627413, "uuid": "2e1b5132-2423-4c00-adeb-1d4afbc2e4cd", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627413, "uuid": "195e342e-481d-4605-8d5a-17b88e986ab8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627413, "uuid": "1b6bb063-3dcd-43f4-bfec-cfa5d4207096", "value": "statistic-92097910.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f870071-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621476, "uuid": "101f5b84-5aa6-4db1-a249-0774be625c8e", "comment": "Malware payload", "value": "3b3147a9d7e81f31e7b6bb5a174c042c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621476, "uuid": "c5f3172b-477b-426f-9aee-6e46e5eba7e5", "comment": "Malware payload", "value": "179de0cc2dfd36abb5d0bfaa1a89acf163b736655cc45e290c0f95084591d060", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621476, "uuid": "b7e6224b-0a03-4f52-9f4f-837f4530f2e5", "comment": "Malware payload", "value": "ba08429346fe419855dd0ddc0e044e138d36a1a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621476, "uuid": "9e68303a-4cf6-4c97-9fb4-8dd9c2c36ab1", "comment": "Malware payload", "value": "52c74e90a4d683a4eb603a7d65382085790f25ea2db0d3474bdcaea40c23546ec00eba20c42a9ad835eb9514b03a7ed0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621476, "uuid": "033bb757-747a-4ed2-8502-94fb087c42a7", "value": "EF83025453B94A4E788E8E2DACE31D4F2B9AB8F41A2B55D1795D04E1A2334660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621476, "uuid": "788a4c7c-bccc-457c-8b4f-b950779bcf91", "value": "1536:MDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIIkGV8BAY0wh/:MDAysJADlV378P3RPVJLd98BXr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621476, "uuid": "b85c43a2-38c6-437b-bc0f-0fe4104ca256", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621476, "uuid": "b775c3bc-01dd-493a-8e8b-0b785363df6f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621476, "uuid": "2a8bb858-965d-4bdd-b35e-4cb7ac3c5871", "value": "catalog-693791367.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffb0a88-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623544, "uuid": "8731b47c-224c-47a5-814c-76efdb6985a8", "comment": "Malware payload", "value": "580fcb2f8ef233a28c9ba0c82f3893e1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623544, "uuid": "c704ea0b-2e12-49dc-8cfe-c862ffcbb461", "comment": "Malware payload", "value": "17a7762781ec8528c7e881e2da0a3f2be04d387601f9fba287a5c9c3162c420f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623544, "uuid": "d89943e0-5517-469a-a1b6-8624380f5d42", "comment": "Malware payload", "value": "10f975b5e6d813218effdbbdbdad9bce2443744d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623544, "uuid": "3e51748e-1636-4e19-a48a-59f209e5cf4f", "comment": "Malware payload", "value": "6dc35aa6db12e2e1be9f6999145fca6cdd0d0a0319d3b28cc33c1075596448077350f59343b0bf9848fca9b2558f4810", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623544, "uuid": "fbf41f8d-b1d9-418e-b6a6-81cd54933cd0", "value": "2383028C3138C5DF37BE6A04A2DC887BBD09D9B53514385EC489655FAD8AFAB0C9F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623544, "uuid": "5e8a8db1-4a7a-4ddb-89a3-f59dc9b0cb1f", "value": "1536:kG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+p9:kGEhrHJoEsBMG7qzkZQxO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623544, "uuid": "a379ba69-adea-48f4-b2c1-41d9ea1a79d6", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623544, "uuid": "fd331a89-2814-4260-94a3-eb8df93d9d73", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623544, "uuid": "84724cf2-cc1b-479d-a125-f81d28dd4c94", "value": "diagram-232559598.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375d7479-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619772, "uuid": "2f6709fb-05bc-4e73-b4f3-27a818b73788", "comment": "Malware payload", "value": "d095be1d5dd7218400318ac232feb5ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619772, "uuid": "9c534009-a3bb-4a62-a14b-d9eabed4de8e", "comment": "Malware payload", "value": "17dbc867a631c6c9116e9a818d937fdc86ea8c0ed9ae28ad3031ed13c8532fc5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619772, "uuid": "f288e647-97ba-48a7-8895-63e118e322b6", "comment": "Malware payload", "value": "a6ddd626b85af7e7de82647e3af8b5b1770ee788", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619772, "uuid": "26fdecfc-a525-4815-be1d-e429f493dc2b", "comment": "Malware payload", "value": "eb1400451c1cd06ec5ff0d962cb144e1f210532a6b7a8fea84fd20d1942c877cce2712cd159baa7cc11dc7827f419bc8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619772, "uuid": "000d2eb5-f721-40c3-a728-3b26f9011b24", "value": "A083125453B90A4E78CE8A196CE31E8F279AB8F41E2B55E1795D04E1B2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619772, "uuid": "15feaa67-0eb6-44ca-8d0b-c5b7fd6ce615", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdeIkGV8BAY0wr:XDAysJADlV378P3RPVJLdz8BXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619772, "uuid": "4f627540-9e33-443c-9c38-e36f8e7f2f80", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619772, "uuid": "d251450f-7791-48b8-8294-d0552bf34f6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619772, "uuid": "57ad3026-2ec8-4fea-906b-7ac879292984", "value": "catalog-1501945965.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1770bf08-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626590, "uuid": "f9a3979c-033b-49b0-b143-d67647823c23", "comment": "Malware payload", "value": "11bf42200ba329322cf4a847d849d49f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626590, "uuid": "48cd034f-3cd9-4dc7-a133-15b558659a7a", "comment": "Malware payload", "value": "17e9b6c91dc0d67490f4df6be4921e89a1397bf91e110ed8193b64fe8fcdfdda", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626590, "uuid": "3de92798-df45-4ea1-b1ea-581da2844473", "comment": "Malware payload", "value": "0154ac6a24d84e838f97f652c19412c0d84800d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626590, "uuid": "2952aa87-f0fe-43e3-86c0-093706ffb57c", "comment": "Malware payload", "value": "010299c827daa9335bf84ecf4327921cf89a7ee880df56f941ab6e6d51930683c9448624d535f7e654e59e6c70c89c73", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626590, "uuid": "4a97f1c0-2b84-4956-a849-c6ec943463d8", "value": "BF83021523BAC998F4CD9E2D4CE30D8F7F42A978281ED5F56229019AE326C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626590, "uuid": "5e353ad7-5ce3-48c7-aaf7-b85924a5e0e4", "value": "1536:8DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdUPqXT/WkO0B19M2I:8DAysJADlV378P3RPVJLdoqXjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626590, "uuid": "a7aa4073-a31f-405f-8fec-b57aaed765b4", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626590, "uuid": "82de7079-638f-4dbd-bf0a-4bccb0cebd65", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626590, "uuid": "0f20f18d-b6b8-4780-a262-90d85a7fd67b", "value": "statistic-368727538.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa69491d-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623401, "uuid": "67c0fe07-055c-43cf-aa8f-66bb2a332fdd", "comment": "Malware payload", "value": "bc7be91781921f9e7278ed2cc9ec875e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623401, "uuid": "57b94cd4-1746-41f4-8318-91e6058d4e6a", "comment": "Malware payload", "value": "17ecec51e501e93300b8d0093104139e0af1abb88ab2cd5f3e2bb8b8fb61f45d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623401, "uuid": "9f984fdd-0e1f-4eb9-af38-a78301d6d2ba", "comment": "Malware payload", "value": "46669430cf8c61acc5967418ce04d47dcdaa9af7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623401, "uuid": "045a1244-49d5-409c-ae2a-dbd7cb85b8ef", "comment": "Malware payload", "value": "96e43bba5224dbcba6497a1144b7a9754f2c60e1c44100774000948f7b662385174df9bd17549a454c94ed1c0f635398", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623401, "uuid": "9cba79ae-c919-440e-bbbb-3f3ae6864203", "value": "6C8302CC353DC9DF7AFE6A0952DC887E740EE8B43104144EE8C8566B9E8BFE71856560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623401, "uuid": "6779d89c-3ed6-4351-92fb-a66de1d3b79b", "value": "1536:rG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt9KkApVr6wo+RxoO:rGEhrHJoEsBMG7qzkDxApxToO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623401, "uuid": "80944e93-d7f6-4bf3-9ec2-539700982358", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623401, "uuid": "1fc612a8-820a-489a-bd83-b5e4e86f9fec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623401, "uuid": "6f57d0db-3841-4ddd-b21f-b7125770136f", "value": "diagram-2062320770.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044a5d42-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640731, "uuid": "dd3485ab-6b48-4e00-837f-d02c9a669fa3", "comment": "Malware payload (Quakbot)", "value": "eecc51a3e43a909aa63a2eda4f4203e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640731, "uuid": "5ce6f9e3-7c16-49f3-8567-e74cd6005bd6", "comment": "Malware payload (Quakbot)", "value": "17faa98b7ddd4cceabd1c925c6f35e36e5ff053e307349563f49beb477c428fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640731, "uuid": "781aa677-f242-43ab-9f83-28974b3107e0", "comment": "Malware payload (Quakbot)", "value": "5a20675d76a4afcef6d7bb7eb6e67677e0f9277f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640731, "uuid": "f8488411-2f2c-4076-90a2-d3ee42b3e09b", "comment": "Malware payload (Quakbot)", "value": "871b524e1e925b086ce990052fea420d2dbe891b13d7125e09d49a4c73b0a404d4cd5112ca4b6368931132af04259736", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640731, "uuid": "5d743df4-f2b9-4d28-99f8-75d51eb4e1dd", "value": "FC948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640731, "uuid": "f7c032ea-1a76-4d60-b116-409caefe0bc2", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640731, "uuid": "5fdf4803-2ddf-467d-94fc-55aea6730bad", "value": "6144:HWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmX:HWrsTwr03pdf8vhhOKJETlByX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640731, "uuid": "cbaa28a1-32ca-4343-97e8-12ce38f1ebe9", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640731, "uuid": "a187cb8e-ce76-44db-80cd-fa3f3cea20d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640731, "uuid": "6fce3baa-9778-4aa2-be59-897205dc4b38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c376d3-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622587, "uuid": "5c36a300-59c3-471d-9ff8-14019cbb08d4", "comment": "Malware payload", "value": "dcd510dfe6c88c9bcb51007d0a6bc9a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622587, "uuid": "9f58bd6d-3d65-4ab4-b49b-7cbbcee710c2", "comment": "Malware payload", "value": "1835443ff3139fbb19bdc567737ad3fd15176e2a2e57c4a7368849ac0bc55534", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622587, "uuid": "d07cb6c0-fc46-4af4-8fdf-d26a7821b6ab", "comment": "Malware payload", "value": "e14d113607521a428f4eb20df97b81fa0c46318d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622587, "uuid": "0184e818-b2e6-491f-bf15-75d0769b45e2", "comment": "Malware payload", "value": "35a28985e87dbdac4ff1a81b8373ba603db96547aa131d94a7ea188c0e1a47666b3abc4bb6a62284e7a581dd15648902", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622587, "uuid": "9ced9249-81a5-48c9-a85d-46dc24ed9fab", "value": "D0830289203DC5DF71B86B06B5AC893EBD4D6CB5210064AED4D8266FAD4DAFB9C93430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622587, "uuid": "3fed2137-89e8-43c4-8051-d39a5cdd292e", "value": "1536:JG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttcI5EzJKE9LfFSp7mq8:JGEhrHJoEsBMG7qzkeI5AB5gpSq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622587, "uuid": "603117d1-ad9e-4233-af51-e8290808ffdf", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622587, "uuid": "b408748f-b5b8-4289-b3f7-2ca84ce28704", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622587, "uuid": "bbb67ad3-3588-47df-8e57-dc1252c657e6", "value": "diagram-1487192571.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e92c43-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640734, "uuid": "ca0abef7-2b95-4f28-b053-0d7b8061766d", "comment": "Malware payload (Quakbot)", "value": "4e99c52a643fb2da5acce192171bfd61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640734, "uuid": "27ec49a5-9502-48cb-b998-4df3ea61fbb0", "comment": "Malware payload (Quakbot)", "value": "185c496ac49e5811d34c26b0deb494ece07ae88242c950888e2036b3031d69f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640734, "uuid": "7072eecc-826a-4e88-bb0c-c82c3b55e5c1", "comment": "Malware payload (Quakbot)", "value": "077305491d4ee5f80d9af1e0a034e9e51bec9079", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640734, "uuid": "849657b7-f9ac-4ccd-8a62-65d9c746d96e", "comment": "Malware payload (Quakbot)", "value": "8b6a22ec74bc5de0eff44bfcdc594240166040a6491866e8b2d58ae2c7b9446ff7724bf914fdcc8b9cbf90ce067c22fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640734, "uuid": "e310623a-a162-4501-b68d-8ba38eb2e7fd", "value": "34949E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640734, "uuid": "47d70dcf-3f75-4b3f-bec3-cd94234d6ee7", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640734, "uuid": "8b23a24c-1b2e-42e2-9a9a-3dd5cc95952c", "value": "6144:5VWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraY:WFNmLKSVpJbPT+4xrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640734, "uuid": "629adaf2-059f-4cb2-b9a3-b31cdba91436", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640734, "uuid": "55e2f06b-6d48-4859-a84c-513eea9da3a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640734, "uuid": "6c006a89-ef1f-4bfd-8207-0f3d31a7c6e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812e2c9f-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645236, "uuid": "f2682e57-aa53-4817-8776-65670ed50cfe", "comment": "Malware payload (Dridex)", "value": "d8782b88fdf7346f6db7aac57df7f4e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645236, "uuid": "e95b8f22-2e8c-49f3-8048-1fc45c497758", "comment": "Malware payload (Dridex)", "value": "188359d562752e418f70e36c214baae529813567847cf920b1c3ba00779556c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645236, "uuid": "09b2c591-4b3e-47e3-af62-c5dae5ab1181", "comment": "Malware payload (Dridex)", "value": "8b01c1e46bd874233d5c95cb09a19bc89db04b6f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645236, "uuid": "d0d367bf-2eb7-48ff-a7d5-529f9d3f9270", "comment": "Malware payload (Dridex)", "value": "7471b6fd6370575be4e18647e3b5bf43c4605b8d115d8be1d54e75d0307b62485c25ca887629789af76a8534d8be2c3c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645236, "uuid": "aeb358ab-7ee9-400c-b67f-7d5f27979c23", "value": "2DF3E0D2EA8BD390F5DFBC7E385B367063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645236, "uuid": "c88361bf-2d88-46de-a4a8-6c21fa26daf3", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645236, "uuid": "1e62eb33-b28a-40d0-a4dc-bdecad77c2a2", "value": "3072:L8Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2FGkFY:InS62Fl+pkeJl3CvRStrFl+EYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645236, "uuid": "463ce417-4246-48cf-a343-1cbcf929e339", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645236, "uuid": "d5f97db8-99d4-4048-9e3c-411fb001d080", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645236, "uuid": "10bbe7b1-028d-41a4-b443-0690196640de", "value": "d8782b88_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278ec228-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623611, "uuid": "a7f94c25-1019-4cff-b4e4-213f7d0dcbe9", "comment": "Malware payload", "value": "7636c1bfa17bcec35ba921306e2b2cc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623611, "uuid": "64f0cda8-d291-4033-9ac0-a8a863d9e2d8", "comment": "Malware payload", "value": "188385e106d0322772734bc34bc2404bf0cc09b604f7fcde942955560b110f46", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623611, "uuid": "21e38f0c-1350-4548-80f9-bdd7e27628ef", "comment": "Malware payload", "value": "bbd0ced5e49e8fd9a114d37233648adac0d6803c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623611, "uuid": "2bfd4e00-6623-4490-902c-338e3aabe026", "comment": "Malware payload", "value": "a531163a5a6283c7d3dfc9b27394ee3d9cb5c16622f207baace92efe17ad09702549896985f2eb6b0da65beee781a8f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623611, "uuid": "ef92733f-a098-427b-8941-fadcdef27764", "value": "AB83028C363AC6EF75796E08A5EC8C3F690EE9742044649DE8C07E67E846BE70E57530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623611, "uuid": "e7865aa2-29f4-4540-a6c2-49fc28b623ba", "value": "1536:yG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttAsujryI8bFx:yGEhrHJoEsBMG7qzkjI8bFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623611, "uuid": "68cc81cd-d9aa-4c29-9a3a-9d378b944a7a", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623611, "uuid": "dee5dc64-6d4e-4dc9-be4b-4be732491184", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623611, "uuid": "a939b9df-05e1-44d2-bdec-0a47d088d5c9", "value": "diagram-286892869.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8475901e-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623337, "uuid": "980b3fb1-e71a-4d5a-b1ec-13b5948384e9", "comment": "Malware payload", "value": "801f21ed195514514e9f35f4b50febed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623337, "uuid": "61e7559a-6669-488b-b3f4-f9cf2c1e67eb", "comment": "Malware payload", "value": "1883fb5e7f3d5ecf1de68c9f71def73567589a2b82157ae6e67510f0a132839a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623337, "uuid": "bc36af42-4b26-47c0-9a90-a38d7cf39301", "comment": "Malware payload", "value": "4910e9eacc1c60b752dd7f4aeb67faabbc44fd82", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623337, "uuid": "19e4ae95-1695-4d28-bfe6-8989382d5c75", "comment": "Malware payload", "value": "1bb719357764cd15997b146a932001ccaff02188943fe308813d860de78a042ebb7d058f6c9afd0d9ec8eeddc3cdee4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623337, "uuid": "f9cd496d-1720-4ee3-814c-d103d0964bd2", "value": "E583028C313DC5DF7ABE6A0951DC887E740EE8B43108154EE8C85A6F9E8BFE71857560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623337, "uuid": "bea92ca0-f6a5-4c08-824b-64519e4a80ad", "value": "1536:ZG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttMKkApVr6wo+RxniK:ZGEhrHJoEsBMG7qzkWxApxTniK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623337, "uuid": "62c8ff71-b1ef-4c73-bbb2-07ad948c7cbc", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623337, "uuid": "38670ceb-2ec0-4757-9069-8698afed03d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623337, "uuid": "be48a91b-753e-4916-ac9f-96a956b501b8", "value": "diagram-2019727310.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e84ff37-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621555, "uuid": "e394256d-c4c5-4dd5-a53e-96868964c7b1", "comment": "Malware payload", "value": "15a96b773fdaafddcdce5a2c7f92acc9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621555, "uuid": "9851b5a2-5ed9-4c3b-8a5b-5bcb2f87b895", "comment": "Malware payload", "value": "18915559626dc9c3d7e4f41f05827411b2df255487538aeffdfcffe2aab66940", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621555, "uuid": "ebf14608-4c30-48fd-84f6-db11a6f9b4ae", "comment": "Malware payload", "value": "1f7bd52bf68eb6002eaa85b29da34364517352c3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621555, "uuid": "8bd8a83b-be29-46a4-b2e4-3ab6dd6febed", "comment": "Malware payload", "value": "c14cf2492f5b7d3c90511aab3a5df2f065af6298b7016971b9911c098cdf2c47817ff09efe908828aea2abbd3e3c8672", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621555, "uuid": "3e9f4cf0-205d-4d64-8892-cb9005dfc92b", "value": "F583021513BF464CB88D9F3D5CA30DCB2F5BB974291968F2A16D04E8F6338521B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621555, "uuid": "96998c63-c572-452c-9b53-85464b917db0", "value": "1536:SDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdRRP6sCO0Pyrq:SDAysJADlV378P3RPVJLdL6s90Py+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621555, "uuid": "24c55b23-98e9-4995-aa3a-75fa47f61c3c", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621555, "uuid": "2a0f6a19-3d1f-4d56-a66a-e535da7fc943", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621555, "uuid": "4e462e36-75dc-47c7-9ad0-09a8bb59115f", "value": "catalog-754634113.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b131eb9-a867-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619644823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644823, "uuid": "d13b7fa3-4c30-4bee-9e2f-aef46e2a909e", "comment": "Malware payload (Dridex)", "value": "61817711b36d0622d7aced84acc1138d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644823, "uuid": "3844b8b4-8a39-4354-9a9a-6752ad7de3d2", "comment": "Malware payload (Dridex)", "value": "18a1d4af6b4a0eb19f3a3bcc100376b2a330712dad3e335a839380e3a3e6a52e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644823, "uuid": "6f810d0f-72a7-4336-a422-8c186c30cfa3", "comment": "Malware payload (Dridex)", "value": "8eae1092879a7abf87f54394e600a89603b2dea7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619644823, "uuid": "38dc8e89-ba81-43cc-bcac-4869e4d21f7b", "comment": "Malware payload (Dridex)", "value": "22038a9bbee60beba63ca18e89f60d75ad04fc8061cf0f888498d69bc4c5f30fa420104bc718a6dd6ce29e532ed9488d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644823, "uuid": "20433cc0-7913-4c81-9177-856c01e4e59f", "value": "D9F3E0D2EA8BD390F5DFBC7E385B367063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644823, "uuid": "d79887fe-7891-43de-820f-e0e4bf91099e", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644823, "uuid": "d7e6174d-9bf5-44bb-bd0e-bbc0fafb7820", "value": "3072:C8Suywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2FGkFY:tnS62Fl+pkeJl3CvRStrFl+EYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619644823, "uuid": "920348dc-0120-4907-bfa2-b69052f58054", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619644823, "uuid": "b9994cb9-754a-4da1-a3fd-569b05c3a18e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619644823, "uuid": "68d44b7b-d690-46af-84c8-2cb812609a3d", "value": "61817711_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e097d82-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621474, "uuid": "f33dd698-6c38-4207-9a0d-f1eb01a5dfc8", "comment": "Malware payload", "value": "b3a298af963fe3b6c1e07c9031845339", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621474, "uuid": "96382331-1f83-42c0-a89c-f56b7d5f93ad", "comment": "Malware payload", "value": "18a9b85a4245b20acc896d3015adb16f35136c9a99ee283b9cb68a685fcd1b50", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621474, "uuid": "e04b837c-9dc6-4176-8bbb-bde733d06978", "comment": "Malware payload", "value": "d0a0af31ec19e5fd04ec001e534f5a69b9f5370e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621474, "uuid": "af357f37-400d-41d8-bc72-ced18a0c4dcc", "comment": "Malware payload", "value": "451421ffc548dc94f03a8efba23f840fb4787068ff7f7a8bd8d937726d6246abd6a796a52375a56f7814dca588ce1893", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621474, "uuid": "fd4b4815-a16e-4e05-96b2-5bb48d631254", "value": "5A83022513BF564DB88D8F3D9CA30DCB2F5BB974291968F2A55D00D8F6338425B28D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621474, "uuid": "cbf62353-b560-4f05-9d17-825287ddb85e", "value": "1536:KDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsRP6sCO0Pyx:KDAysJADlV378P3RPVJLdC6s90Pyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621474, "uuid": "268b7d13-fae4-40fa-ba92-11429eb68c5e", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621474, "uuid": "25a6cca6-ba4d-4302-b7b6-237997230c5d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621474, "uuid": "d92f7b79-43d6-4f8b-a013-93fcea268bc3", "value": "catalog-693264082.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1124a617-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621425, "uuid": "8445c767-bfe2-4bde-9f9d-9e75997a501b", "comment": "Malware payload", "value": "6c2090ee9ffd8103f0027b66c95a8b3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621425, "uuid": "75b57540-689a-4bd3-876a-529e43e4bcce", "comment": "Malware payload", "value": "18b425fb7536df15140bbd35fe5de6493fbb7d21f0621e0f1b2a464f6d3a0e8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621425, "uuid": "a37483d5-f52f-4194-8f9e-c6e9fe66ba26", "comment": "Malware payload", "value": "2c06e9bb6e586e0682b6e827a409fda352bebc6e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621425, "uuid": "fb2a6dac-b362-46db-994d-251fbc7d30fa", "comment": "Malware payload", "value": "f8aabf10a98438635c9798a49ae0fc8bf23bd25b987b72a287d5dac7d9a201543e25647f0dea719d17c23a91460584c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621425, "uuid": "703a67d3-fd21-4e22-af1f-76677f80f5fd", "value": "D283129073FE8E6DB4CD9E2855F20DCB2E5EF574290CADE165AE04A492358422F3493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621425, "uuid": "8c9bb97e-1423-4e53-9a10-e05893bde3b1", "value": "1536:cDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1HQdT:cDAysJADlV378P3RPVJLdIeJLOnleJw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621425, "uuid": "a7c7f2fb-2dd6-4c9e-8e10-7f2376c58b04", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621425, "uuid": "6aa79d85-555a-4f38-8537-e9ad7028d9a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621425, "uuid": "b2a01a48-0efa-456d-9ff6-5d08308c948a", "value": "catalog-65479839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa773fe-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622381, "uuid": "9d266baf-f7ec-4401-ae93-dbd9da3a8459", "comment": "Malware payload", "value": "56a60d4259eb69e0e93a4fcc7b5545fd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622381, "uuid": "39276358-0da5-46b2-a1f8-bf081626563d", "comment": "Malware payload", "value": "18b8771773c2504cdb384dda239aed398d02f4deecff9dc10a3d4c17bfb1d38d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622381, "uuid": "e7e5134c-ffc7-49c0-ba16-57b5cc735e2a", "comment": "Malware payload", "value": "28b97c24124d00dcccaf99218d2ce855b7378137", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622381, "uuid": "3fca96ab-8473-4dd3-be1d-0af1e79deb6e", "comment": "Malware payload", "value": "6154dab2e69d050a2d1a88e9a4f5091f82bc9078dcad11e19782e4cdbc083b08ceac89b127e38560a68677f6d7b4580b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622381, "uuid": "4d2e4507-6827-484d-8d92-74dd312f679b", "value": "2883028D653DCAEFB1AD2F09A3CDC53FB61EED613044248DD8C466A65D49AD30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622381, "uuid": "87b5a75c-a704-449b-8402-77706d160616", "value": "1536:OG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5de6n6475e0NEnP6A:OGEhrHJoEsBMG7qzkZ4q/NEn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622381, "uuid": "472e7edd-db25-40ae-b049-4be36c9e087c", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622381, "uuid": "9d023125-9ef2-46b2-a409-3ea8f4dd4005", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622381, "uuid": "3e785532-e393-4049-a082-fa3cdcd7febe", "value": "diagram-1339029512.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f378f5b5-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619658, "uuid": "585cae70-747f-4329-a4cc-a32d56c33b33", "comment": "Malware payload", "value": "7decd951d4c3a533dd74f1921cd8897b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619658, "uuid": "c746f2a3-bb98-46b9-98cf-6dc46a20e1db", "comment": "Malware payload", "value": "18c12fa1112f5e5f2effab159e7bfb2d2c9b3538f720b57bb26bc9363cd55731", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619658, "uuid": "33349f8b-4ef2-4e84-95a3-167e85ad96e9", "comment": "Malware payload", "value": "bdc28cb64716163809c670e16819a7c6539f37df", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619658, "uuid": "3184eaf3-c838-446d-9f0e-b041cb100d44", "comment": "Malware payload", "value": "04653280cf65b03ae8ae4adaf0e2dcc2f714bf26eee795eee6bcb80f98eb03247a3a413a63235130caba9202ef544775", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619658, "uuid": "bf3f1128-3d46-4a01-aa5a-fb33f285c8cd", "value": "0483027103AE8B1D74CE5A3958D22E8F3F97F8B42D095993551904E4E32BC629F3887E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619658, "uuid": "52bf7cb6-4992-4068-b322-af2e68d18ea6", "value": "1536:mDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVRq:mDAysJADlV378P3RPVJLdtDsMU0dRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619658, "uuid": "dcedde9d-e46b-47c9-82a3-8ca2cf81e2f3", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619658, "uuid": "bebf6cc7-aac4-4ae9-b4c6-a16e981bd0a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619658, "uuid": "7e8a5bcb-3d5e-4469-88c0-9a3ad1abe708", "value": "catalog-1409613126.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3191ea-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647137, "uuid": "ce403491-d179-4d35-ae15-dc61685fa420", "comment": "Malware payload (Dridex)", "value": "5c4f7e91ead94cbdcc6bfb5d2740adac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647137, "uuid": "58ba3dc3-c2bf-4f5b-abdb-46f26d317933", "comment": "Malware payload (Dridex)", "value": "18c5e983ca9dc7a0f76734da33e2fed525c1474a47d10985968331759db5af7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647137, "uuid": "460f6b5b-20b5-4ea4-9ade-f8be231f6819", "comment": "Malware payload (Dridex)", "value": "342f70d429521df48cbe60f491c2b1bf0d5e9136", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647137, "uuid": "0d7efdd8-fe05-4655-94cc-309cbdb74b89", "comment": "Malware payload (Dridex)", "value": "fdb0526cc037c296c7440f18c0403c1ec2fb38983159dd819344cf7031650519e3a9439b97cd6ccd612c312bdae62c25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647137, "uuid": "088b0ccc-3b04-446a-a24a-55ce4666d3c1", "value": "04F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647137, "uuid": "33f77145-49a7-4a7e-be64-0b638d94d799", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647137, "uuid": "45d58b38-2cb9-4922-b39c-594b243bedab", "value": "3072:LHT2d85tleLD51fC5AHYEoefukoTFMpGmj68D:+y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647137, "uuid": "32507c2c-6100-4ebf-8764-23769e608b69", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647137, "uuid": "c94a43d3-0b2b-456a-b5b3-8fbd96bf6001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647137, "uuid": "acf001fa-a747-451c-baa6-be850fbaa7f3", "value": "5c4f7e91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ac89c5-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619646268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646268, "uuid": "64acf3fc-3cfa-43dd-bcc6-eeb1332dcbfa", "comment": "Malware payload", "value": "f9df2269db571e71a8211e49dbdb083b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646268, "uuid": "0d3284ad-f516-4783-9714-dd1d338e22d4", "comment": "Malware payload", "value": "18c91c37ee76a6541209274bdd201b911f79622fad630e4f888e06573465674a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646268, "uuid": "7c761338-f74e-4c4f-adb0-4838a222a80f", "comment": "Malware payload", "value": "aab98fab46ac0c40ab727874a7f0607b084312cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646268, "uuid": "f3526a7a-e3c8-43b2-a3f7-942888f51a25", "comment": "Malware payload", "value": "dd96b0c9f9ea0b5bcd49d32e26a9f98bbc5d2dee4bbabc0499664876bfa0b83b057f379d281a84b95491ce4cd1794ef9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646268, "uuid": "638d6062-36e4-4d7b-a7b4-c618e0736884", "value": "9CF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646268, "uuid": "aa00bfe2-4946-4e9c-9692-96438278b1f4", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646268, "uuid": "d72f215d-9369-4ccd-a024-40d814a60067", "value": "3072:2nT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:Ny5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646268, "uuid": "068845b7-0266-41c6-8052-1cb604557af7", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646268, "uuid": "1302c85d-1c13-4af2-b668-13d6cc77cd6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646268, "uuid": "143dc0a0-d49d-494f-bdeb-79786941b6dd", "value": "f9df2269_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad723af6-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624265, "uuid": "47ab153d-7c55-4171-b10a-35cf8f93f4b3", "comment": "Malware payload", "value": "e0e6cbc2dce810af3032817098674b34", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624265, "uuid": "eecac632-1806-49bb-a3df-b85aaef25910", "comment": "Malware payload", "value": "18ca3c3819a335fa6d6d230e2169b4fb3decdb62ecc9b556d772bd18c3e43635", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624265, "uuid": "ae7189d8-934e-4746-adb3-87ec48a9389f", "comment": "Malware payload", "value": "262f465aa55e1944344adac4db080db0b70beb15", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624265, "uuid": "b282cb95-7505-4ed0-b59e-5d36cfda5a77", "comment": "Malware payload", "value": "617739f35bc6c2af404e023394dd0454840efbb737a278b2ef777f88aea7195d90c8fe5f4d430afd264f1a1f94983212", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624265, "uuid": "da7268a9-79ea-410c-8996-bfda93edff66", "value": "6B8302CC313DC5DF7ABE2E4952DC887E740EE8B43144154ED8C86A6B9E8BFEB1856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624265, "uuid": "663b09e8-c066-472f-b721-b3db57aa5c97", "value": "1536:CG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttEKkApVr6wo+Rxlww:CGEhrHJoEsBMG7qzkaxApxTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624265, "uuid": "49c10873-70b5-469e-b15b-38aa8bf3317b", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624265, "uuid": "d811138b-567c-48e1-b470-4c0e31a6c262", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624265, "uuid": "6c7e922f-95e9-418e-a20d-dd3191a21042", "value": "diagram-648306700.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b444194b-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620840, "uuid": "4f25954b-dbc5-4fe9-aa90-180984c20fbb", "comment": "Malware payload", "value": "3664aa87552f17319e9a0e3a7cdd163c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620840, "uuid": "7f01bf3e-a279-4daf-867b-2b80494385a5", "comment": "Malware payload", "value": "191eaeb1e7f1c28fab26e5598c4b9329f0847d85b015ba241b789fe8c534d997", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620840, "uuid": "4fdd12cb-2a33-49be-ad70-ce3ed59528c0", "comment": "Malware payload", "value": "3abab4d09f9f117f8a292d0e503d436ff374c0ba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620840, "uuid": "3b017718-43ee-4b7a-ab75-7808d8cb367a", "comment": "Malware payload", "value": "8220d073c559d80aee8b4e6964edfdf1a563045b5a90d702b7be1fdae9392a333a176a23f59c055d1295337265623dd0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620840, "uuid": "d2e3ba93-8a1a-49b9-98f0-3fc91aff3a4b", "value": "E783129073FE8E6DF4CD9E2855E20DCB1E5EF974290CADE165AE04A492358412F3493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620840, "uuid": "b3bfb522-9eaf-4487-9994-ad21b5a705ea", "value": "1536:QDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1HDd+:QDAysJADlV378P3RPVJLdIeJLOnleJjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620840, "uuid": "5a56b882-4b61-489e-b01a-e3c2f89bcf45", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620840, "uuid": "8b162358-2ae5-40b0-8f22-7cbf1efc4456", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620840, "uuid": "d8fa69c2-de89-4192-96a0-ee4fc280d0d8", "value": "catalog-216333402.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf6aec0-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624395, "uuid": "6c70043a-a2d5-4222-a7cb-35fec7adf308", "comment": "Malware payload", "value": "540280c0ea0c77e86bed5ddecd682954", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624395, "uuid": "5b467058-121c-48dc-9f41-dd87ee2bf0f8", "comment": "Malware payload", "value": "1924960c9646da6196196debc2e8b9b8ee2aab52f6e7beddea1c1709291805ba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624395, "uuid": "3e03c866-ea9c-41c3-a0ad-61496c4327e9", "comment": "Malware payload", "value": "562137a9c8db9a5ea4fbe527fec957bb6991cdae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624395, "uuid": "2c208ea6-53d0-4089-a202-699ba5b5f2ba", "comment": "Malware payload", "value": "012154c03e49db396d603769bd6d997dc274ed5a3b97ccc0b7cee5801e9a9297a7595240c687dadd13f1c280f285363b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624395, "uuid": "3401f8d0-a5ba-4e37-9229-6b60a3537fde", "value": "7683018C553EC2EFB67D2F44B2EDC83B660EECB46144245DD4C9267E4C49AA75C872E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624395, "uuid": "bcb95711-eae2-40c6-bf1b-ecfb40809da4", "value": "1536:mG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttUZKvCjFevNZIJldvRAg:mGEhrHJoEsBMG7qzkqZUOTJvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624395, "uuid": "0380cdc0-1f2b-4e74-a0ca-465644968113", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624395, "uuid": "4cf42b3f-e946-42b0-9226-5f6aa8306c3a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624395, "uuid": "65b3af68-d5c0-4b09-b82d-9c1044636be4", "value": "diagram-747156086.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1875c65-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619547, "uuid": "f951110a-9cea-4c35-933e-b1a37630b2ee", "comment": "Malware payload", "value": "82c5ae560044247c132e3d06567e7c70", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619547, "uuid": "784dce6b-70b9-4c61-934c-91b52a8baf36", "comment": "Malware payload", "value": "193d140d01cc4a1195f6bfcbedb53db1654cbbb5d1d864a992c9af9e82b28f05", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619547, "uuid": "cc89d250-8d53-482f-8573-c3c0a5f24528", "comment": "Malware payload", "value": "9d3d66aa92abf8cd2be489bbac5e3c67dd407c8a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619547, "uuid": "91227346-25b4-4299-8a05-23aa3c5ad2d9", "comment": "Malware payload", "value": "7a31e922ac55b4a2ab97c0372787fe2fe661479334e9fa68214c200cdaa1d905f5b503882504def381bb55d7602b22e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619547, "uuid": "96746e05-e122-4fec-b750-e615a0c6d923", "value": "9783129063FE8ABDB4CD9E2C55F20DCB192AF974190C9DE2A66E04A493314422F24D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619547, "uuid": "9c79b4c1-f1ea-4321-a9ab-71c3d036cb47", "value": "1536:oDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLddeJx9awOnleWI1HfR:oDAysJADlV378P3RPVJLddeJLOnleJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619547, "uuid": "4a2eac4e-cb5c-4551-9382-147a99975925", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619547, "uuid": "20380795-cc37-4ed5-a66d-2b4fb723c5ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619547, "uuid": "294be17b-ee21-47f9-ad89-fd609b853196", "value": "catalog-1338217703.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a25eb9-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640737, "uuid": "c868d441-ca88-490a-99a7-d8840788ac8e", "comment": "Malware payload (Quakbot)", "value": "f7e2ff11c009c6acb8b94b7339b2042a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640737, "uuid": "96cfb608-023a-4883-b964-3f0052a0920e", "comment": "Malware payload (Quakbot)", "value": "193f41e98a441a967e7926aa643fa943a3244560306c92978e827a38b5eef9d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640737, "uuid": "b2c4d293-0d13-40a1-9334-2f0eae446398", "comment": "Malware payload (Quakbot)", "value": "bae92241b70236c65d41f81e20e3c41de4a504a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640737, "uuid": "a659c7be-5fa4-45fa-8a97-b0e0e5b6668a", "comment": "Malware payload (Quakbot)", "value": "6699f3e0e0e3b1ad7a98bf78e80092a53599bb094cdb83fddeeaf21ae7c0871d036eb591054ecd650aabeb6a479eec9c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640737, "uuid": "95dbe6f0-3f82-43e9-b83b-2a4773686db8", "value": "52948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640737, "uuid": "b82021ac-7561-4135-816f-8981269dabac", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640737, "uuid": "960fc39b-13ba-46d0-9b6e-87a8bd773c5c", "value": "6144:yWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmg:yWrsTwr03pdf8vhhOKJETlByg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640737, "uuid": "d041a231-f411-4468-8b10-29b9fb477909", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640737, "uuid": "f1a98973-e5eb-4643-8ded-ed57c580f52b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640737, "uuid": "b75a6ec0-bd9b-42fe-9e9c-6518581d9f08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a627e83-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640741, "uuid": "4857cbcc-b436-4d7d-8f25-b707e6724875", "comment": "Malware payload (Quakbot)", "value": "695393964eef7ffc6219cfd084fa3ae4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640741, "uuid": "3dc9273c-2ee0-484c-9d15-28fd7feecac5", "comment": "Malware payload (Quakbot)", "value": "193fa0a25018014a6573204bff0f979df3f62b75b1187730b59d98a21ad36062", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640741, "uuid": "696c15ef-b542-4003-bdb7-f90acf4a06c2", "comment": "Malware payload (Quakbot)", "value": "bcb4a84b9260990fe9339fd2bf00cc0038d9f0d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640741, "uuid": "6146d0a4-e769-4781-af51-841139140b85", "comment": "Malware payload (Quakbot)", "value": "588aef4ff312620064bb53a50c5fbf45ed431630f7942f0195950740958a497f4a385b6e87e5377e5568f306a38487e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640741, "uuid": "72efe68d-4645-4cba-8cbd-5cbd697916a2", "value": "22948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640741, "uuid": "216637e7-e2aa-4d51-9d9a-8a36898d9c3b", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640741, "uuid": "a297cb58-a334-4d02-848f-27dbc90a1f4c", "value": "6144:kWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAm4:kWrsTwr03pdf8vhhOKJETlBy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640741, "uuid": "3c493afb-789c-47c9-bd19-50a2167f3c47", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640741, "uuid": "95b3c1f5-b2a0-4dee-8248-812c25f8c98a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640741, "uuid": "681deb70-0eba-438c-b26a-263cbe59e9c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab3e15a-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622542, "uuid": "8ae9accf-84fd-46ec-826c-34cb761918e0", "comment": "Malware payload", "value": "1ff24013717b1383845eaddf91765766", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622542, "uuid": "34085e72-1702-4c70-8180-dc801401e5f1", "comment": "Malware payload", "value": "194015018aaec440d17f6793e02c6d96aae74f411daecd181214e3520d502a00", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622542, "uuid": "089b98c9-13a3-4780-aaf2-597e5cd8a0c5", "comment": "Malware payload", "value": "fc7416a98217b6440dd0722be4ca0be09ae625b3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622542, "uuid": "f8be5a20-7280-4fee-ba9d-ca219e75fd8e", "comment": "Malware payload", "value": "2119a146a7ce40f8c14a17e864cb36001353f65c0920313fdf1f2e6680585b869333f2fd23dd969da030fe0bd2d0f065", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622542, "uuid": "6b6ef1ec-fccd-472e-8409-1b672829b4c7", "value": "8883028C3538C1DF36BE6A08A3DC887BB909E5B93504385EC489655FAD86FEB4C5F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622542, "uuid": "0ffbb561-5c64-4800-b48c-feb3cd560747", "value": "1536:fG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOds+RKYFxQ3d+pZA+:fGEhrHJoEsBMG7qzkLQxOaA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622542, "uuid": "d7f18abe-1eba-40a2-b44e-50e5e8e7e054", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622542, "uuid": "1f82792b-b3ae-4532-8997-5b600730317d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622542, "uuid": "2c523730-e551-4190-bbfe-873062e84423", "value": "diagram-1447892354.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4869d0e9-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639557, "uuid": "c9f18f28-4ebd-47af-85d2-2609fc43d771", "comment": "Malware payload (Dridex)", "value": "e7a438b8148cbb1b0e167bdd8b3df17a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639557, "uuid": "acdc4dc7-892b-4bee-8353-24d6ef367002", "comment": "Malware payload (Dridex)", "value": "1949db9d437ee6b6795be3dc86e58e490351d9f2fb6b71d6817d6bad022529dc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639557, "uuid": "7732f498-e57f-4f24-9c3a-4f05d61cafd6", "comment": "Malware payload (Dridex)", "value": "7b32ea441083bcd17c8f3f72f6a6f29eb7ea2f8f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639557, "uuid": "4170b6d1-6567-40d4-9b3c-4a162688fc0c", "comment": "Malware payload (Dridex)", "value": "bdf2c6a9de07679849d401d02f705ad5cd996224a4a877d2bfe8d1ca846ea2cf89890c076782ea18b2d126ef391b8065", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639557, "uuid": "eeb1cf96-d29d-44d8-9890-1af24d35270a", "value": "64F3CF41D5A6C458EBDB2870C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639557, "uuid": "cb9f2ecf-d188-4cc5-adc9-26cf4b6253c8", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639557, "uuid": "6b338495-2055-4137-9b1f-a2338fee7bde", "value": "3072:LZT2d85tleLD51fC5AHYEoefukoTFMpGmjG8D:wy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639557, "uuid": "1256283b-d7b6-494c-b8df-2e5a94a50cca", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639557, "uuid": "f4e6c1b5-88be-4096-915b-600cf64a2917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639557, "uuid": "dd80d0bf-43d5-4650-b59a-31db12222420", "value": "e7a438b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52834b0-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639739, "uuid": "50ca197f-10d3-4e97-8098-e47d939dd3fd", "comment": "Malware payload (Dridex)", "value": "5a1bff5ef840ea261d526c612d389b4b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639739, "uuid": "2e0c23ed-50a6-4b85-9e42-ac75c9d55203", "comment": "Malware payload (Dridex)", "value": "1959011e9f60f2f4605537d8e137ba981a772a1da773a348ad203f0845606a8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639739, "uuid": "452e11fc-f60b-47f1-80da-1d12f7806066", "comment": "Malware payload (Dridex)", "value": "85f3135e128e336c960c65c407dc4191b24a6d02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639739, "uuid": "0bebc899-05c7-4281-bc9f-7781009c1efd", "comment": "Malware payload (Dridex)", "value": "843491535f775f11faaddf22035705e50ab8c9405e94ecb0f106308cba6a2bbff5a763de0281ec5a2686acd9ef1ec2a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639739, "uuid": "2b7278e3-11f4-4872-9ebd-0e797f2cf07f", "value": "14F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639739, "uuid": "c452ccee-82ad-4d7e-9d30-29a761f666ca", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639739, "uuid": "6cdd9721-1ba8-43ae-899f-2d7733470f0f", "value": "3072:3nT2d85tleLD51fC5AHYEoefukoTFMpGmjY8D:ay5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639739, "uuid": "bdc93a95-9521-48ec-827a-16edac6c954d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639739, "uuid": "d5bb103e-5a08-4a66-9314-9b0f35f17d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639739, "uuid": "6ed496f5-c4e6-4a80-adfd-4eeb21d91b50", "value": "5a1bff5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf75f9a-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640744, "uuid": "584144bf-0364-40ac-9e37-b3cf6144ef12", "comment": "Malware payload (Quakbot)", "value": "825706c82cd6dffa5fdab6de83075623", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640744, "uuid": "a5202a76-efa4-4845-8f28-51a6c30ccb3a", "comment": "Malware payload (Quakbot)", "value": "196bb4a469bbbe1db6bfebcc9354becdb447246058f5c26a5babfbb21f4be160", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640744, "uuid": "60278f68-823c-43a6-8256-18bf4a280f1a", "comment": "Malware payload (Quakbot)", "value": "82520970f941c79891f30fcce390a6531e3903c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640744, "uuid": "635c0ceb-045a-4390-a518-1696f45b6208", "comment": "Malware payload (Quakbot)", "value": "6af2c486d0d6a0d7448ddc13cb0d964d58fdadb69d13e162368ed7b500ae88516027c6510476025539eea60bd3c56965", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640744, "uuid": "abf97b17-1c36-4233-ae96-9053a1e3101c", "value": "F1948D396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640744, "uuid": "619a3fa4-9f47-4f18-9f0b-ea2bc91a5bc8", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640744, "uuid": "a9bfaf0e-4ef9-496b-8f1c-482fb3b2c77f", "value": "6144:3WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmq:3WrsTwr03pdf8vhhOKJETlByq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640744, "uuid": "1703ae46-d149-452f-b9a7-15f740c2140c", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640744, "uuid": "aaa7d9fa-25a3-4e72-aa53-931af84840a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640744, "uuid": "e62d8e1c-4522-49a9-a22c-679988224688", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8ebb48-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640747, "uuid": "30f678cf-56d5-4bed-a4df-37ee267c1e91", "comment": "Malware payload (Quakbot)", "value": "2d4ec710fe0fc8fd777c3e7a8b9f3223", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640747, "uuid": "349b82a9-a4a0-4f5e-ba0c-66340a467ccb", "comment": "Malware payload (Quakbot)", "value": "19975c34df695f8c854f02503e41a327730aa39f1a67e2227274b956424b935c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640747, "uuid": "cd4ae7a1-016d-4692-91c5-1305c72fc8f3", "comment": "Malware payload (Quakbot)", "value": "f32926322a56dc666e7d9aafc5562819671a6f75", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640747, "uuid": "841b8d98-8874-4f73-bd29-869ab096d41c", "comment": "Malware payload (Quakbot)", "value": "0c7562ee555714d94022d893a31ae5382d171bd736eb419590cffcae3fee4ea90e3ea4a0b121460bd98ea30ad9d63266", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640747, "uuid": "28b3c7a9-94da-4512-8fc2-b4824f3fe5d0", "value": "E9948E396A26E063D27C27B183C3EF541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640747, "uuid": "b060a2ab-631e-4ccb-bf92-20113bccfe80", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640747, "uuid": "b5731bc1-0e0d-498c-8c49-4bc05a2255fe", "value": "6144:4WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmU:4WrsTwr03pdf8vhhOKJETlByU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640747, "uuid": "235859a3-1288-4bf0-954f-67559d9bcd94", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640747, "uuid": "66fb5535-6372-4904-a760-9dbcfe0e3d6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640747, "uuid": "19c1e1ce-c3bf-4329-8259-d52ca98a6dba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b277b5b7-a861-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619642312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642312, "uuid": "24de3aa8-50fe-4c6f-a772-cac0ac0fbae9", "comment": "Malware payload (Dridex)", "value": "7379830f5e0ab5e2fdbbbef82086f324", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642312, "uuid": "92a8c573-3576-4bc7-96a5-362bd62a3615", "comment": "Malware payload (Dridex)", "value": "19a3cf98e0878386679527daac1d01200f4eb4e96766da64b5969af05b7418cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642312, "uuid": "920d687d-656d-4faa-8a99-7f0d7944ca98", "comment": "Malware payload (Dridex)", "value": "78762a42685d939c6dbe75b9562a644ae9d563bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642312, "uuid": "0fe99d60-83ff-4c25-9c0c-4ce198663d33", "comment": "Malware payload (Dridex)", "value": "a6b26b5e31fb2e2d229a34510a5cf2500c59c00f97c9fce6cc8534b81bbcdc85247ceae519507d4ddd065f3a5775e23e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642312, "uuid": "e8db9400-aec1-4dbe-83cd-3aefa4a333d0", "value": "0CF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642312, "uuid": "bc923ce1-1291-4a1c-aa86-ae6d6d5562e3", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642312, "uuid": "64fe0c21-31ad-4b30-bddf-a8619efa9d64", "value": "3072:ns8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYXZwd:bnClX8WZ7/HrRCADTR0VldZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619642312, "uuid": "ff2382ad-6e95-4081-903f-4fe6fa36832b", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619642312, "uuid": "60370294-1f11-4b10-b0e6-d2580e39b104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642312, "uuid": "54f5330e-81c5-4c39-b1f8-39e26fa9ea4f", "value": "7379830f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fee900e-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640751, "uuid": "e53a1086-6e02-466c-b2ce-970ef286559d", "comment": "Malware payload (Quakbot)", "value": "8a2424930b1db689b6fcb06e11baade7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640751, "uuid": "bf08a875-5efe-4edb-a235-d1579888bf91", "comment": "Malware payload (Quakbot)", "value": "19a7366a9c34a31f732b63f512c41b2a840d544e01bee3ce314e9e3a3fb9e2e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640751, "uuid": "32bd85e7-9cf3-4ec1-9ee7-67651adf9d77", "comment": "Malware payload (Quakbot)", "value": "4907105f8080dd1740db22f8f739a0004e701b42", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640751, "uuid": "4ca68159-e8a9-43f4-ad8a-067f7aa84884", "comment": "Malware payload (Quakbot)", "value": "eabf5c5b946f226a0faa9730b452b57428622f0f245875541d527f1cf83a9a06a79e356145a2705cee895d87a4ffb7e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640751, "uuid": "2a7bd57c-5847-4250-83a4-c93defd75acd", "value": "FA947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640751, "uuid": "a44e61b9-49e4-4483-a249-af76796b0bb1", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640751, "uuid": "f7c46fb7-a796-4f9f-9b8f-c85579dacdc1", "value": "6144:uyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm+:iTwr03pdf8vhhOKJET5By+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640751, "uuid": "71f8a615-4595-4f0a-a93b-a70bd490cf38", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640751, "uuid": "a74877fd-3de5-4f5f-9a8d-0ef51c17ab29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640751, "uuid": "1e33eb0c-bd0b-470c-9b7d-c18333392183", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb475e81-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619134, "uuid": "a9263ede-7314-4060-b35c-46b70602906f", "comment": "Malware payload", "value": "aaf34597a03bf670760d59033457532c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619134, "uuid": "c2b629f8-5b3c-4341-b3f6-39781827e61b", "comment": "Malware payload", "value": "19b1c3b3308b36c90a1456a1d1e320282babb2f8ebf00b9389d847d8a4472253", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619134, "uuid": "80493b7d-4101-49cc-aef1-0b7932f2844d", "comment": "Malware payload", "value": "3a22689b74b4b9a9773c48536830f89034add9f9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619134, "uuid": "d526d643-70ff-4870-b15b-a4d9286338bf", "comment": "Malware payload", "value": "334eebbf64774760a10e38c4002dd0fa88a4aedb70cc08511d667cf88c1ebb4e3bb547999e0c51c7b52d8ada21a81994", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619134, "uuid": "6a0c520e-0352-424c-aeea-abf1c89639ad", "value": "5083121023F6CF0CB48E5F2D98D21ECF3F57F9B9251DA9B5212904A9E626C460B2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619134, "uuid": "fa5a6b70-14f9-42c2-a781-8bb9e310a45c", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGDpEDP9+jAJuWk:0DAysJADlV378P3RPVJLdGDps+jAJVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619134, "uuid": "729f192e-6ec1-4f6a-947a-736eef739dc1", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619134, "uuid": "22b20ef7-a395-45f6-b7e9-3141b95b97ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619134, "uuid": "47afdb37-5783-48fd-a1d4-ded8ebcf2ebc", "value": "catalog-1057129411.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f205408-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623355, "uuid": "baecbc10-f582-4dd7-8c13-c023d8830672", "comment": "Malware payload", "value": "7d7782633bec9235005ef2f18f4f8d8f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623355, "uuid": "f4f3565e-e367-4060-9ef2-3a7722b0547b", "comment": "Malware payload", "value": "19b3e7eb6f26c29930d85cf2cb764aacf4b198a72610d7d60d8ac79f4c6520cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623355, "uuid": "f78a9eb0-a41d-4ffb-b13e-444f0dbffc04", "comment": "Malware payload", "value": "63744ea32087bd0745b7f684e4b90d583f6f18dc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623355, "uuid": "f8bff9f1-0b65-40df-b602-b516edc97bee", "comment": "Malware payload", "value": "4303bf273e12d999a5625dc2d6d4d70114652a83b09ae78d05a7796ca4ec43a3f483559e7c939285f6a0f0b4b046db7e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623355, "uuid": "04788748-abf6-4493-ae58-9cfa68c5fba7", "value": "3A83028C3538C1DF37BE6A08A29C887BB909D9B93504385EC489655FAD86FEB4C5F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623355, "uuid": "6860254f-f32a-4b63-a77b-fc1064cf029a", "value": "1536:7G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOds+RKYFxQ3d+pNHO:7GEhrHJoEsBMG7qzkLQxOiHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623355, "uuid": "0cc3c930-8aec-4945-8b79-1598e79a42dc", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623355, "uuid": "13969628-559e-4707-9b22-373b16cd7d95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623355, "uuid": "b36686fe-684f-4cdb-ae62-274e0a024210", "value": "diagram-2035732841.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9a85e8-a869-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645632, "uuid": "2c638c5d-dc14-403c-8813-308e3f99272e", "comment": "Malware payload (Dridex)", "value": "fe6c9b0623ae851554bfc0147e913289", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645632, "uuid": "d6fe148a-451f-469b-bd4d-8e0fdd7d72dd", "comment": "Malware payload (Dridex)", "value": "19e04818f7916948be4243eb43f53f8591bd1785addad13b04f0b4c540d70cb6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645632, "uuid": "9739a170-89a3-428a-af00-abb6a7a43bcf", "comment": "Malware payload (Dridex)", "value": "cb75068aabf988b6340e77f715150b126fdfbe0b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645632, "uuid": "a2828a3d-8dde-4ee0-b2e8-0c47faf3d65b", "comment": "Malware payload (Dridex)", "value": "83424ce15cb8d9b6c9f542d7c53b02b90f130721dea9d282366c12d951b356a6c97cc4f095c61afd74e7a6bab6521c19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645632, "uuid": "8bb705d6-46d9-4f51-86fe-3ebfe5af39f9", "value": "F0F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645632, "uuid": "f68b7e03-56ed-49ba-b407-87fc36988d47", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645632, "uuid": "c1d73c7b-6a95-4011-a740-b5dcbd299dff", "value": "3072:iM8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYRZwd:WnClX8WZ7/HrRCADTR0VlDZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645632, "uuid": "f79cce55-266d-4106-a9fc-e0d632e710c1", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645632, "uuid": "79f79872-1c85-4f12-bb02-67b16b32fb10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645632, "uuid": "e7c081ee-7212-4f45-a897-a4fd8f64a343", "value": "fe6c9b06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06d1bc4-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623062, "uuid": "9334fccc-a340-414b-88d9-c55d550f5ba1", "comment": "Malware payload", "value": "db732729e480bc6c3963cd6fac9e66bd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623062, "uuid": "bc5217fe-f2fa-4665-83f8-1322e0f9ab79", "comment": "Malware payload", "value": "19eb89b158764404515f21b2ee6d9c531e5cf287e239cb045cd2d1d434f7d6e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623062, "uuid": "f967be6a-861e-4d90-91b0-cd10fb3b136d", "comment": "Malware payload", "value": "52405b843bbbfe2fb5098f038219f01c3ce623e3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623062, "uuid": "62969a87-da5a-47e4-ad82-00a82cef317b", "comment": "Malware payload", "value": "f8f9e9149538ecceda3b406c1483e79c06a0bb09d4fc374cd064153ba52978fe4c9ea61123db302cd84676a0cd580ea1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623062, "uuid": "7a1aad56-126f-42fd-baeb-3b3f6ce0d786", "value": "2F8302887A39C9DF37BE1E08B6DD887BB50DE5793808358DC4C4665F9C4AAEB085B160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623062, "uuid": "0333507b-03f1-4062-afd1-930e2c9895da", "value": "1536:uG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttyds/rjLOq6afsZ:uGEhrHJoEsBMG7qzkT/rjLOBfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623062, "uuid": "8d7ce9a5-7ce9-4d96-bef0-ce5054a1d936", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623062, "uuid": "6e83157b-6e95-460d-9ca3-8d6f505f4232", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623062, "uuid": "3174251d-ad4e-4160-8099-9828d2015568", "value": "diagram-1829048106.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a95d42-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624654, "uuid": "e4145940-11e1-4d93-b440-b268893ef01d", "comment": "Malware payload", "value": "d0533af9b1a4cbe7c21969cc03d0d851", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624654, "uuid": "ccc1d4dd-a8a5-47c6-95ba-79a7784c14c0", "comment": "Malware payload", "value": "19f1fd81985b92ddf3cdf306e1c505cdd71ce0fd6cfe243bf980375e4e2a391d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624654, "uuid": "a460517a-d5e8-4fa1-8d68-2b36b0eba7af", "comment": "Malware payload", "value": "c8b755ec81f7aaf5101d01c06153b800e04671ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624654, "uuid": "ff8b86b9-e191-4fd4-89aa-f489124fbd22", "comment": "Malware payload", "value": "8e82375166e925b26123cde941dcc9366987d62cd78127be810609718a4ab105e45bc194b007ac3ba1dff253ef92bf98", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624654, "uuid": "a3082437-b04f-4da2-bd08-7bc63615c62f", "value": "9C83028D653DCAEFB1AD2F09A3CDC53FB61EEC613004248DD8C566A65D49AE30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624654, "uuid": "d43d84d7-270b-4470-b4be-cec09010fd8f", "value": "1536:dG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOe6n6475e0NEnP6l:dGEhrHJoEsBMG7qzkQ4q/NEnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624654, "uuid": "656c8cc7-6528-4d96-810b-955d039c2221", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624654, "uuid": "24015cbc-f46f-480e-ae37-fa55ddbd01cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624654, "uuid": "e91a6086-e708-4eab-9471-9b3a7ee19931", "value": "diagram-912898998.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbbadce-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626894, "uuid": "0ea54812-5a64-42b7-b1e9-c1322fd8f892", "comment": "Malware payload", "value": "0af8b8d38aab894ec8e7945ccc7b31e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626894, "uuid": "d5500fb9-ce89-4561-b86e-533f3ebba960", "comment": "Malware payload", "value": "19f2d76183b458fccdde34eb9301fb1b8e5c6e5b29f625762912eb92e307b014", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626894, "uuid": "7a324918-919d-4f81-9e7e-04bcfd4df9f5", "comment": "Malware payload", "value": "19db3d1961fbe18288e88f0a52f9743311c20598", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626894, "uuid": "0c53aabd-fa6e-4a04-8ed7-bc712fd36c28", "comment": "Malware payload", "value": "5ab1c1cef09cb74c10ffef7ef221db25dff9d08488c4122ea04084121bf45060bed23f5dddfdc4190967bf77dc50f37b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626894, "uuid": "a5f12633-bc2f-4242-95e3-6365447668f5", "value": "4883021413FA8959F48F9E39ACE20DCB7F9AF6F43D0A58E1962E0465A329C510B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626894, "uuid": "37834152-cdb3-4efe-9aa7-3ed28762b455", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHgKXsth8wBYQA:PDAysJADlV378P3RPVJLdheh8wB1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626894, "uuid": "1bdbe476-3ef5-4fbf-b52c-361dd73719d7", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626894, "uuid": "9fa82f41-c209-4cc2-96bb-6c2ec9533b29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626894, "uuid": "1301a753-3744-4512-ab53-c03437d03253", "value": "statistic-576963680.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4dd9f8-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626999, "uuid": "2bebccdf-c18f-40bf-8a9d-1a86c357176c", "comment": "Malware payload", "value": "7ef8777a56cb39229a2d0375c2acd897", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626999, "uuid": "f4dc0902-29c1-42c1-af9c-0e0f09961fba", "comment": "Malware payload", "value": "1a13bf7a3e9d1b0a591c576853fb617752261d6670e564c53afd0726de07cd65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626999, "uuid": "6a8e3841-1e0a-4b9d-aa05-8bce5879738b", "comment": "Malware payload", "value": "a16a56819b31b908c038e08a7b5ba8187b4b6411", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626999, "uuid": "a8ce19eb-d99b-4fe3-ac9b-cbf8af747cdf", "comment": "Malware payload", "value": "ec5590111d3ef1ae7350d3780139a5bfcb41cb875a78c70f6818cdca91d1131bbf7296b7ba13720e7ce808dedc9b5cb6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626999, "uuid": "39514db6-da29-4b14-bd7a-bbbbf1b144cf", "value": "148302A453BE0A4CB94D4E29ACA20D4F3FA6B6743D0E5CF1B92D0485E235C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626999, "uuid": "1e60d587-ed30-4180-82f7-00ea598f5685", "value": "1536:UDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd+hsMnSEwJPTmF:UDAysJADlV378P3RPVJLdQxpE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626999, "uuid": "9c1c5a12-efb2-4eed-b310-a914b9f13da6", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626999, "uuid": "3069077d-ef76-4b37-8425-33f1000c96a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626999, "uuid": "e58252b0-64c2-4736-933d-fb35b0288a60", "value": "statistic-645804820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ef32eb-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622648, "uuid": "05dcb637-135d-4e86-a451-aadfbda7631f", "comment": "Malware payload", "value": "37d06bc14a87ec5debc12b0c153441d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622648, "uuid": "e6a2e11f-b087-4c02-b03e-6603ae337e01", "comment": "Malware payload", "value": "1a26a2c49da5f68e6ea6265dc4af4e32b418bf3420e20ec1fd87d99813fee3fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622648, "uuid": "9a04e2e2-6763-46d8-a3d8-2a9141bb2215", "comment": "Malware payload", "value": "9853544c166ba963daddca685565b378c7d17a7f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622648, "uuid": "efd81f6f-1063-4914-a171-f4b44d41a73d", "comment": "Malware payload", "value": "8ca8361aa01f8eb9ccd3cc50d46184ab23643872a3dcd1650e08157b56fc6faa3bfa6259b9954b6231c46264f241d88a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622648, "uuid": "a18a58ab-c31b-40e8-a651-83956008320b", "value": "F883024D253ECADFB56C3F09A59CC87EA50EDDB4204418CC98C477679E4E9AB4CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622648, "uuid": "b7dc0254-aaf3-4ca0-9cac-9f3763dc135b", "value": "1536:CG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttB0KKmo3zuUkbU:CGEhrHJoEsBMG7qzkf67KRbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622648, "uuid": "af11f029-c34e-4368-b356-db42b494193a", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622648, "uuid": "1cdc9545-6a61-41f5-9a30-57fde710e96d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622648, "uuid": "ec02dd26-5844-4ba6-b480-718423735493", "value": "diagram-1540200061.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a54d21-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620366, "uuid": "91c6cad2-eac0-4d7c-8064-7eb7321bb5d8", "comment": "Malware payload", "value": "fb81c3fb4f6fd4b6bb8f66bcdfbbc779", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620366, "uuid": "c3a5132f-b9b4-4bce-8c4f-a9ec5b0666d1", "comment": "Malware payload", "value": "1a36e91d795ecdd0df726285358f87c11512b55382ba4704e854206660574f7f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620366, "uuid": "6dbf3042-daa9-4071-835f-a161907cd271", "comment": "Malware payload", "value": "cad4ce3f301b1a5009acdc428c94e77631c9c875", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620366, "uuid": "21634d5f-f7aa-4373-8160-6aea1cfc5d84", "comment": "Malware payload", "value": "6488fdddf23e260a5f4a4345549ffcacbfbec3a68d44acd6dd8713e921103110b937b4b7f3165f8bbbeb2fcf90d8eaeb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620366, "uuid": "c286c5f0-0279-41ec-8d28-79f8c315bd66", "value": "AE83121023F69F0CB4CE5E2D98D21ECF3F57F9B9291DA9B5212904A9E616C460B2057F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620366, "uuid": "896a3020-b261-432e-9b81-f1b5bfaab9d9", "value": "1536:7DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGDpEDP9+jAJuP:7DAysJADlV378P3RPVJLdGDps+jAJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620366, "uuid": "5a14c675-45f5-40d5-95ce-aacf78ef126e", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620366, "uuid": "8ff1e372-7910-4d39-81a6-f907e381048a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620366, "uuid": "23eb0143-0def-4fba-a2cc-c71e6c75c683", "value": "catalog-1954215421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528816b9-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619388, "uuid": "dc836da6-e3ff-4aff-99ca-aff5692ec8c3", "comment": "Malware payload", "value": "6d7a771a61ff8f508f1b59d9e5ae20e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619388, "uuid": "546be28c-456a-41bc-a521-89f64e4de10d", "comment": "Malware payload", "value": "1a45cd502d848dd8eb65956dbe1938d0a049608c9e9ac4144fb3a71bfb577a08", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619388, "uuid": "2a6c3eda-136c-4147-8253-709e4acd3d09", "comment": "Malware payload", "value": "01893bdb992fc3693fba7bd7f6d34b7ad326af97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619388, "uuid": "8b62617e-96fe-4e92-b21b-4fbc49b8c00d", "comment": "Malware payload", "value": "0d594e8d8b677691150c5abbaa8fd24a23ab34bb4856d8fa09203a84513b08af7d61eacc3796c18d275e62d07507a153", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619388, "uuid": "7f630590-2c67-4642-ac6f-5600bcd30940", "value": "2783122013B78F5870CD8A3E98A35E8F7BAAF9B82C2E98F1515E0456F127C551B1447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619388, "uuid": "ff66b94e-2ec2-4c1f-9f39-fe2440fd3226", "value": "1536:sDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd3cZ8VzpIsOKunl:sDAysJADlV378P3RPVJLdsZ8Vunl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619388, "uuid": "ae07d8d1-4206-41b6-970f-20ad41440bce", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619388, "uuid": "fde0ec10-936f-4fe7-a6a4-0136d193cc92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619388, "uuid": "4c5eb0eb-bb3b-469d-a19e-025673d12eb6", "value": "catalog-123854148.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dea7fb-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620593, "uuid": "f8c0aaf0-2655-421d-9736-d83f4b3448c1", "comment": "Malware payload", "value": "5b8d5c5f15beb5b1f856dbc666a92a64", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620593, "uuid": "4e6fd52b-bb23-4846-9208-ce545ec830bf", "comment": "Malware payload", "value": "1a52d031573aa720811c35c9a957b3f7f4da969c85d83b5658a4f33a24d1650d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620593, "uuid": "705688d1-9346-47d7-b1fe-b0324d4ba51b", "comment": "Malware payload", "value": "265ac948d01e01bf6352af2d6dc081d854b771ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620593, "uuid": "4ba764a5-45b0-49bb-89a9-2d0c2bb30835", "comment": "Malware payload", "value": "781e69db44fa8d1318dc02a09598c73f01a1a3df0923ad6fb185a320241a9df889e4be83bb544857d327dea6757e1135", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620593, "uuid": "d05c0da8-c3c8-4610-a46d-540132ea38cb", "value": "4383027103AE8B5DB4CE4A3954E21E8F2F46F8B82D195892541604E4E32BC669F38D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620593, "uuid": "deb3da35-7694-4310-ad47-25415a699d1e", "value": "1536:vDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd1DsMrbsTmHvVRnj:vDAysJADlV378P3RPVJLd1DsMU0dRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620593, "uuid": "c6220d96-7802-45d6-a9af-4fc12aa8f6cb", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620593, "uuid": "93488354-7e9f-488b-b661-5a50cd73e07f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620593, "uuid": "3fd5dcf5-a92d-4188-949b-7efe6692e7d3", "value": "catalog-2015615846.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72ffca2-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626402, "uuid": "200148a6-a3fc-4bcb-8e73-ca7796fd384e", "comment": "Malware payload", "value": "343a4fa277e0fcad52d39bf434a11031", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626402, "uuid": "80f4aa20-0157-4b52-b657-b0f5b000871a", "comment": "Malware payload", "value": "1a7ac5042982c9134091b0082bbc1c8a968c6e2e50ce926f9f7fba8c5eb2743c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626402, "uuid": "13d052f9-ce3f-4823-a10e-682482af0deb", "comment": "Malware payload", "value": "052afd4d4a1e4d6168390d9c0bb605fdc0427b25", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626402, "uuid": "c2280116-323c-4be6-a2b5-0d1842c51015", "comment": "Malware payload", "value": "71904f3d60261c132d521118c80229fa536bd0fc3fd220d3844438d09e2189a827530bfb8146ccf95ee81c28ffef3334", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626402, "uuid": "99bea869-aed6-4122-931c-14c5acac33d6", "value": "B4830220037A864D74CE9D3D9CA31DCF3F66BAB4352E5DA2616905D8B636C420F3897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626402, "uuid": "e6c106d5-8597-4659-9059-41fc643182c3", "value": "1536:vDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdXNp7Ctdn77/hO:vDAysJADlV378P3RPVJLddp7mdnn/hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626402, "uuid": "63661aaa-d651-4dac-8f34-913e39c868c8", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626402, "uuid": "48b190a8-3c73-40c1-a64a-cea82e4f4665", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626402, "uuid": "071284cf-4a63-4dab-ba55-8628441f99e9", "value": "statistic-237250953.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2153a95-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626474, "uuid": "ba8967f3-9487-4e80-a00d-330b84f9d08b", "comment": "Malware payload", "value": "f5fffe558f31137f3b6982164135f420", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626474, "uuid": "7aaa725e-2d3f-4a4c-93da-bf4a5c5a0f74", "comment": "Malware payload", "value": "1a961f00e00ce016f3ff9806f07a69de8db0e37495d885b471040d5e6fe60bc9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626474, "uuid": "b1b0f16c-26ef-46e4-9cb0-fa8c686065e6", "comment": "Malware payload", "value": "5a335f154f382848f430977f87f7008137950447", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626474, "uuid": "9958ccf0-bdfa-4bc3-b68a-13428cf6fbd8", "comment": "Malware payload", "value": "b7fe06b75af94da79673af3c6f4eb36e91acee192727ee954dafccbcaf6d7514e1bbf6953f8e2bf8f2b5630c76b36d38", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626474, "uuid": "38a391d0-5ab2-4d57-b6e1-bc2e645de0d8", "value": "CA83021403FA8559F48E9E39ACE20D8F3F9BFAB43D0A58E1966E046563298511B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626474, "uuid": "9b69c82a-1e7f-42fc-9214-50a74df00574", "value": "1536:bDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHgKXsth8wBTSc:bDAysJADlV378P3RPVJLdheh8wBGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626474, "uuid": "8f678595-fd33-4841-93b9-ff11f86d5c1c", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626474, "uuid": "9b719656-cb29-4d96-abea-d55fad6657a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626474, "uuid": "17ad1e07-497b-48c6-99f3-2e64bb02b981", "value": "statistic-302812090.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56879ed2-a81f-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619613811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613811, "uuid": "038fa50b-05ed-4565-bb23-417dbf631bdc", "comment": "Malware payload (ArkeiStealer)", "value": "ff460e989e8db2de2f46516364ad8265", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613811, "uuid": "28e549ce-b772-4208-b81e-1d3ddf63135c", "comment": "Malware payload (ArkeiStealer)", "value": "1aa0d91d7f3e9f0eab0de23c5a8bd57d4ec6671777c39587cf8d95e74343e7cf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613811, "uuid": "fbd61092-0d93-44fb-a73d-412afd1a4407", "comment": "Malware payload (ArkeiStealer)", "value": "bba89567d5f7ca0422c19e87b04b661245a5d1db", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613811, "uuid": "8683ba69-d28a-41b3-ac69-a4070bc0a9e8", "comment": "Malware payload (ArkeiStealer)", "value": "270c0e9cb60359761e87e333b2e914170f58bc5a44a3655877259a244bd4b4a89e6c4cb9f8359b4271f940d3e6d37a80", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619613811, "uuid": "97fbc575-dca8-4c92-bffc-5491f2e489d1", "value": "17E3F2863BD4CD2AD0AAA5714CD7C086BB99BC4EAC54839B7B447B0E7DF53704A63348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619613811, "uuid": "77421af9-5b02-483a-b311-27916510333d", "value": "1536:AmMXH4g4gpA2M7KPDqq0qHXG0uODuKtQJSNT+VBWOo/BmO9x8P8vkwj5oLfpf2QO:WX4GpNXrq6uObF6VBWOckkvkwj0fpbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619613811, "uuid": "22c91752-0785-4f23-804d-6f86916bc3ab", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619613811, "uuid": "c189e6a3-6e9a-4c6f-b5c1-4cd01cf4068a", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619613811, "uuid": "f8108056-08b9-4f3f-b0a6-fe100422fd6f", "value": "HBS_5012306171.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad73a8b-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624448, "uuid": "abefac4c-90d6-4f39-a4c4-9d1b7ac1f854", "comment": "Malware payload", "value": "8bed25a7230114cc0b7a71d12eb95c90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624448, "uuid": "3effa10f-43f3-495e-acfd-a6d6826ae5e0", "comment": "Malware payload", "value": "1aa114dbcce2aff7f9c8ae6accca9144c33744818f1dcaff0be53810737ea4bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624448, "uuid": "4faa05cf-9c5c-430b-bf2e-ee21fac04eba", "comment": "Malware payload", "value": "dc309d77288a8a122870df5ba9d75a2384fe1af4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624448, "uuid": "c71471cb-0875-4500-b46d-3cc3b53a86b5", "comment": "Malware payload", "value": "2cc00e85b6aed8913663b714898e70c80c12059bc741fdf00931f2edeed425d3ed6b779b78ddbcf2c5e0b5604b879f8a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624448, "uuid": "89988679-08da-4998-b065-afdd760025e2", "value": "9583028C313DC5DF7ABA2E0951DC887E780EE8B43108154ED8C86A6B9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624448, "uuid": "334b9ae8-3f42-4b90-96f5-f3c5148f8ad4", "value": "1536:eG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttMKkApVr6wo+RxniW:eGEhrHJoEsBMG7qzkWxApxTniW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624448, "uuid": "fec280cf-67c8-4539-aa8d-a9b85cdd8491", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624448, "uuid": "cbf5e1d4-34f0-4ed4-b102-376c9b439006", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624448, "uuid": "805ae22c-af02-4382-8656-96e979e55c65", "value": "diagram-775832044.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e67a90-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627292, "uuid": "aef86bad-a145-4945-9804-7da45c1fb576", "comment": "Malware payload", "value": "b410459da2766d822ff2eb6be11c212f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627292, "uuid": "8e7fcd0a-918f-4da5-91a4-081f762524f9", "comment": "Malware payload", "value": "1ab0508ee82ae43eaeecf74be3570527914128d5567704077b73565e0e7f4f5b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627292, "uuid": "bca4cff7-1603-4b4b-adaa-0cdcac462627", "comment": "Malware payload", "value": "6104eccec750a5999458d6f8d00ce09ccf7b07c8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627292, "uuid": "7a4446bb-992f-406e-8ab0-d40de860e302", "comment": "Malware payload", "value": "3b76f0da8e6a552782ce1004d689cf744630b2abf158a2f110e78ab9e2aa4af028c59b9e46c455d462d33606b9b6b082", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627292, "uuid": "e348009c-3487-42a9-8362-3f74890a270f", "value": "2583125563BAC558F8CE9A2D0CE30DCF3F12BA782E1DC4B16229005AD66AC521F2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627292, "uuid": "fde60582-3b9d-4682-b4f1-ae732b16311f", "value": "1536:NDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdW6q0T/2kOsMmYtKA:NDAysJADlV378P3RPVJLdrq0DSsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627292, "uuid": "593816b3-ecb2-4494-8f54-8143ddf68491", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627292, "uuid": "824f2bb4-2e6b-4951-8bd3-ac8fff425c92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627292, "uuid": "c73cad95-b101-4191-8a6c-244e44aded64", "value": "statistic-82957703.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e16b12-a7e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619589677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589677, "uuid": "37f4c194-26db-4c65-b8f2-ec9f485b8680", "comment": "Malware payload (Dridex)", "value": "e609a857be831071c003760bf5bbf8c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589677, "uuid": "262b7843-c871-4f7d-901f-711660e74f4d", "comment": "Malware payload (Dridex)", "value": "1ab222237dee570edfaf249398a7446863ad5aad24897fd161bd688321f6e1b8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589677, "uuid": "4ebc33cb-4d5f-461f-95cc-c8dae98900e3", "comment": "Malware payload (Dridex)", "value": "203267d29538f0cd4ebdd4c69e1a2dd18a37b600", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589677, "uuid": "3f8a394b-0232-4cb2-8a41-e5fc805c74a5", "comment": "Malware payload (Dridex)", "value": "6fb2426ee1923ae3c7c07062bb555960b3fcb684b594616696734101825a4d650bf7edbeadab6e1dd6859177fbf416f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589677, "uuid": "96f300f8-7ab2-46ee-85a0-e65ae35b1dd8", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589677, "uuid": "064b8bc8-a778-462a-8161-3e584c84fc7f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589677, "uuid": "77566a6e-b9f0-43fa-b241-8a7f77286325", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619589677, "uuid": "2254d574-41ca-4bdb-8543-0b94447234bb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619589677, "uuid": "b3871d4e-d42c-4a22-b813-d9ad0300b6d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589677, "uuid": "052c144c-b977-4c9d-a5c8-a94c66543ad5", "value": "e609a857_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa5ca0d-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620046, "uuid": "de3a3bd6-5220-45a4-9e47-0df158a431e0", "comment": "Malware payload", "value": "6a30d20ed9a5183a4a6f91e62fbf4c1f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620046, "uuid": "947ee6a1-3d43-43de-af45-72be45b79601", "comment": "Malware payload", "value": "1abea6c712b0941ec07d10fbc1d2f8cbb7ce6594cbc5b1fffbd43f45106ea26c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620046, "uuid": "608b01cf-fcc8-4d10-92a6-7970a1a16611", "comment": "Malware payload", "value": "246b7b97b43062ab3980c76e4fa5c2369bfcace6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620046, "uuid": "57d81c15-e89e-4f85-9524-c758f85bb6be", "comment": "Malware payload", "value": "4d9b4f645ae4104c364dd0775e397eab02231ffaf3edb7c349cc3e00e9a19499b4ca538c275ffc19f65c11232465fa36", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620046, "uuid": "d7dfeb7f-f1fa-4beb-aae2-e7728af794ae", "value": "4183021513BF464CB88D9F2D5CA30ECB2F5BB9742915A8F2A56D04E8F6338411B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620046, "uuid": "3e2829f7-ee31-46f6-8812-5c05bb27284b", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdRRP6sCO0PyR:PDAysJADlV378P3RPVJLdL6s90PyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620046, "uuid": "d931e0ba-507d-4688-be15-5e42f81aa42d", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620046, "uuid": "7f1bffb1-b4fe-4cad-8b3e-04fabd495f8b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620046, "uuid": "bc7ccddf-e201-4b14-8672-f7716130dd5a", "value": "catalog-1729606834.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c164549d-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624298, "uuid": "bd7286d0-ae96-4129-a172-44de7a0eb06e", "comment": "Malware payload", "value": "b14634ff40c2d8d075e59201c9d72118", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624298, "uuid": "7d055167-f9f2-4e6e-a78a-93dafee0d579", "comment": "Malware payload", "value": "1abfcb61e634be39581e6acff400975b8e80e5065fad16c11d91add291d09f7d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624298, "uuid": "6aae5343-9334-424d-80d7-27226743b14c", "comment": "Malware payload", "value": "d708890a3696f49157ba0c7545ef6d24ae6cd5aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624298, "uuid": "1c841d4c-3968-45e1-97b3-3c3798efaa25", "comment": "Malware payload", "value": "39470d3742b336651ac61cd0964a9c4f161b3a69387cd588c4b66ee0035acb1fde2901c7da4c2cee381312f7bd7b5dc7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624298, "uuid": "4044452e-c967-42d4-b34a-326f66d12941", "value": "FB83028D653DCAEFB1AD2F09A3CDC53FB61EEC622004248DD8C466A65D49AD30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624298, "uuid": "9548a8b6-9014-4172-9836-001f3ee6590a", "value": "1536:fG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOe6n6475e0NEnP6T:fGEhrHJoEsBMG7qzkQ4q/NEnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624298, "uuid": "1dc771ed-5f71-46d0-afc3-263d416469e3", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624298, "uuid": "0261a144-8e25-4bc3-aea2-5e5b33eecd86", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624298, "uuid": "d922a12c-c2ee-49d7-8045-226e0df9658d", "value": "diagram-666838427.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b3ad03-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640754, "uuid": "acc5ea04-8f5b-40c9-8b32-cf442cd1f78e", "comment": "Malware payload (Quakbot)", "value": "b203c321ae4c4dfd215b2dd36314afe1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640754, "uuid": "81b53c11-1234-41ce-8e87-8dd5e31def4e", "comment": "Malware payload (Quakbot)", "value": "1ac911aba096ed10ebd4615050180912955df3db99a605bc466a79b49cb40b0b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640754, "uuid": "81f15e4e-bdda-456d-a2e7-75e5544ab729", "comment": "Malware payload (Quakbot)", "value": "7c09037364a04d8937f7e1c38c818245711f43da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640754, "uuid": "8a4a307f-4c52-4ab3-8887-4ee488793938", "comment": "Malware payload (Quakbot)", "value": "746ea86f856fcc05f63487459f6f4f206172308a77552536c280ec0f527c80c6d26e07c8aa21f93ac96a76d174f31be6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640754, "uuid": "5fff522f-cc25-4055-b685-2fcc246e7595", "value": "0F947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640754, "uuid": "18ad403b-1e71-43ad-84e9-d557e93452e3", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640754, "uuid": "ca1887c8-f842-4cea-86d1-9a85ef557a72", "value": "6144:KyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmR:uTwr03pdf8vhhOKJET5ByR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640754, "uuid": "e859e664-dcb9-41ee-806b-ec1e93769a8b", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640754, "uuid": "71202eb1-da42-4f3b-bf91-40e079005f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640754, "uuid": "ea9c74a9-b6e3-4187-b737-2775d12a2424", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13494d12-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640756, "uuid": "38277d32-eb59-4c3c-b40a-5fa76d83e609", "comment": "Malware payload", "value": "92eeeea2b8f1c03e78e58ce46e88228e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640756, "uuid": "3dab4494-98ab-44cc-90f0-027de5ebfa0e", "comment": "Malware payload", "value": "1ad572f997350edf6c8cdfaca8f2dd0d4378c38edcd0283ca5ae9aa6e54b8fae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640756, "uuid": "3672a90e-a5d7-460d-8ae3-43c3d6ae368f", "comment": "Malware payload", "value": "a892e03afdcfdb9cfe87897239e02925de1f4a35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640756, "uuid": "0a24dd23-6b7e-46b0-aae1-0fff3165c44d", "comment": "Malware payload", "value": "24b23448fc9e62bccf5b3cda5759da2aa6d88997856cb4dc436050500f0ca3298365178e13e20f8155ba072656bb743b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640756, "uuid": "6f84cc02-f0ed-4dc7-b23b-7317561f8d80", "value": "C5948D396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640756, "uuid": "8b00cc7f-6691-4ddf-b388-80c1d9a582e4", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640756, "uuid": "6f04aa74-d270-4cf5-b4e3-09460a5afe3b", "value": "6144:8WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmj:8WrsTwr03pdf8vhhOKJETlByj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640756, "uuid": "fe5ce6c2-2d33-481c-b857-89f03913f726", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640756, "uuid": "e9aa6fa6-2885-4782-a136-79540abf63a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640756, "uuid": "643d67bb-7dde-49be-ba9b-5886c474fdf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a458f83-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645278, "uuid": "6b9475c5-2a4c-4051-8e43-b718d5b84a9b", "comment": "Malware payload (Dridex)", "value": "a2621a06b8b0273e9d03b961a223031c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645278, "uuid": "26e37665-1155-4696-85b3-0817c5f6358f", "comment": "Malware payload (Dridex)", "value": "1aea76468f46891b98d97e4d6d9fab230dbe55ff405b74d05f1bb9032760d556", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645278, "uuid": "58416335-b1a6-4bb7-b43a-8f4be8e522f3", "comment": "Malware payload (Dridex)", "value": "cece140e8c67b33ab871b283ef279b0d285787e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645278, "uuid": "c3c873ff-54f2-451e-a70e-a2bdb3acc3cc", "comment": "Malware payload (Dridex)", "value": "097993a9082f5f99cf67a71377d87adaa082331328303ef79cbe47f38d3d97ec64f77c70db34240e2b5b066db5a67c34", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645278, "uuid": "526bd4bd-d769-4267-8b86-0a1019baf2ac", "value": "74F3BFC6E7EFE0D6C02BB43385CDB036EF6069D88A3ACF35C104892E69D7D549A35469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645278, "uuid": "14b334c0-faa0-4239-8a0a-f305e0ba093a", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645278, "uuid": "38866a75-a919-4d38-9804-68929608168c", "value": "3072:m58CMtKJlXoDRl4epTGmoAc7iTRilfn6wlYYbZwd:jnClXSRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645278, "uuid": "ae58a442-e021-4f43-a331-f09be718ab55", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645278, "uuid": "8d439afa-53c3-44d8-b80a-6dcbc9419a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645278, "uuid": "47ad4f2a-7269-41a7-afe4-b0bc666b0a82", "value": "a2621a06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e763da5-a840-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627917, "uuid": "d596d0b9-79c9-4397-93ec-a2864b839899", "comment": "Malware payload", "value": "bea93d0a13face4f55d224a8fc437895", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "HyperBro", "colour": "#90CDAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627917, "uuid": "34720875-b7de-4d88-90d6-1c8808bb8916", "comment": "Malware payload", "value": "1b07b070eeec2744c7be733590a5694cd1ee9e967249a8efa50d3243468aa7b1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "HyperBro", "colour": "#90CDAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627917, "uuid": "c700c310-b25c-45b6-a55e-25076cf62b00", "comment": "Malware payload", "value": "3a5d1fb37da6a41c677161dab568f7b8ac07bdda", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "HyperBro", "colour": "#90CDAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627917, "uuid": "18372586-656d-484b-a8d8-a764fe298773", "comment": "Malware payload", "value": "baf72f26d0e3252def0f173f15eec4784eb61abdece90679d3a5a2589ea532b95d0a7429567c59a4f137adced795de6a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT27", "colour": "#79A7A1", "exportable": true, "hide_tag": false }, { "name": "HyperBro", "colour": "#90CDAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627917, "uuid": "d2025387-3ae8-4e93-88aa-cf1065b19b7d", "value": "D76733E561AC16DCD0BFF27B56040A42E6362BBCA834DD579997B0CE633486B6F30613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627917, "uuid": "47a125a1-c822-46fb-b05a-648d4ead7d67", "value": "fa4d5c869351014d1ce952f2833a7558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627917, "uuid": "70e9cbda-9d32-4ac1-a82e-71d98e80d45c", "value": "393216:7wIrP5idz+Qtl0NanG3fKggR+iAxZHJebWlFeMHSbTnO/sybT4qH03NqxKXDnTFU:717ETJofBs+TpecFeM0Tjy4q1YTFhQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627917, "uuid": "5f7132c8-3cd3-4065-8506-3a43004ec82d", "value": 32540406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627917, "uuid": "5aaac63a-c37b-425a-85e6-80e5b16bd8a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627917, "uuid": "c921fd22-ff9a-43cd-8e84-9aeeab40ebd4", "value": "1b07b070eeec2744c7be733590a5694cd1ee9e967249a8efa50d3243468aa7b1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73d087c-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623422, "uuid": "4c14155c-d41f-4eb8-8ad9-20f7461f1e54", "comment": "Malware payload", "value": "3ae5b3828b1fefd91b46164fd4b64b9e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623422, "uuid": "9dd82522-ee5d-48aa-b243-022e57e26a34", "comment": "Malware payload", "value": "1b1e47bcd386d145634218612c94df2584f9d9bfa950909d753c18c53afab363", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623422, "uuid": "d60a3a28-ccdf-48bc-aae0-72667c7b2408", "comment": "Malware payload", "value": "4c3a5b2354e06d7b824f59bd1cf0265a2a8d7d45", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623422, "uuid": "5fe429df-ba72-44ac-b70b-3e247d8cb2a5", "comment": "Malware payload", "value": "f0cc318ae3c767b9654d9de883058589c5f548d3140e762085782d475a2a2aa47d7420538e37d5deb5bac6540d5bc42b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623422, "uuid": "06fabc33-a4fa-48ae-8e34-9311b4e592fe", "value": "93830299203DC5DF71786B0AB5AC893EBD4D6CB5210064ADD4D8266FAD4DAFB9C93030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623422, "uuid": "60e17be0-67ea-4ab3-be3a-ae5c6aa6b765", "value": "1536:1G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttcI5EzJKE9LfFSp7m76:1GEhrHJoEsBMG7qzkeI5AB5gpS76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623422, "uuid": "c20a71a9-b793-43ec-8b99-4cefe127d98f", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623422, "uuid": "0cec1de3-51ac-4d5c-adb0-5cd724555c1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623422, "uuid": "f68a5db8-da2d-4b64-9b08-f663a54c1b21", "value": "diagram-20743458.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f764e8-a7e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619589756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589756, "uuid": "5b8f85aa-1e42-4889-9fc5-99a02e168274", "comment": "Malware payload (Dridex)", "value": "22a8396d654d549fcf2619a0dc2ef8aa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589756, "uuid": "5e9877dc-fdb5-4cc9-b3ac-f3192c8b7f8b", "comment": "Malware payload (Dridex)", "value": "1b1e4a0379f52389a624e8c6c4296b82df11345334c8cea1bf4713fd129ddfe7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589756, "uuid": "63142a41-2b73-4f50-bcb6-c76a3c07bb08", "comment": "Malware payload (Dridex)", "value": "8ff4ff124c8443036c6dfaf61ac630e4fcd5404f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619589756, "uuid": "c2bd1f16-ac17-47df-a13a-4a4889d91ff6", "comment": "Malware payload (Dridex)", "value": "58a18acb2aed216d95877b54b7474a21ba3dc7994f665b9ed1225deadaed59dd0da90cd66c91f87f553bd28918efbe28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589756, "uuid": "fb5b78c5-83a6-4c77-82c6-0a3033bd50c8", "value": "FEF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589756, "uuid": "518cfc44-d39e-4d91-90b7-70ca30b5fe2c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589756, "uuid": "a5ed048a-7f8e-46d2-9eb1-3e79b0e18885", "value": "3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619589756, "uuid": "6e655e69-9b7c-4a80-8351-170056a18349", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619589756, "uuid": "ed75fb8b-35ca-4812-b1eb-9c42ad826723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619589756, "uuid": "740ee7f8-ab13-469c-b208-42cb6d1903bf", "value": "22a8396d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c104c2b-a808-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619604022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604022, "uuid": "4df45bb9-2e44-4d48-912e-bd21929e3642", "comment": "Malware payload (Dridex)", "value": "e7e12e0825ec5961520936bbe4155408", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604022, "uuid": "bce6e1d7-81d0-4f9c-a2f8-e3e85424cb85", "comment": "Malware payload (Dridex)", "value": "1b22d5570226f3958453b3b5e9327ccf3e01a0081ef7141a6e199915fcfd0322", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604022, "uuid": "ab2fb7e9-5c97-4dce-b2e0-17e2dcaaa35f", "comment": "Malware payload (Dridex)", "value": "a32083043b2ba23ffa98ed6b7b6c6e66fa76d50d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604022, "uuid": "eacdc29d-5a51-4a6e-9592-55b832bfffc4", "comment": "Malware payload (Dridex)", "value": "e6cae48043d5cbe28118e0f8a70e995b7638cd061e8fc58ae52598d8b4295e9790c8fff048269d9a0c097d293ae61068", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604022, "uuid": "bf6efc0e-c555-49b4-93cf-3d5498c59730", "value": "90F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604022, "uuid": "a753ef61-63b1-4c80-8a5b-ec8ec5f22801", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604022, "uuid": "60c32f74-b9bc-4f54-998a-1b5bba600771", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619604022, "uuid": "608625ae-480a-4c14-ac44-4e4e5528116a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619604022, "uuid": "5e490a55-8fe4-4251-9ca6-a02989de04a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604022, "uuid": "1235b787-7065-46e6-9d2d-e71eafa75b6f", "value": "e7e12e08_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b85dc6a-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620315, "uuid": "820fccd6-0944-4316-ba51-371e6e731972", "comment": "Malware payload", "value": "0584c215fd81415b566558972fdbf99b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620315, "uuid": "cf3120d5-31da-4584-ab9c-b37616b6c0f6", "comment": "Malware payload", "value": "1b4f5ca3ab5a13984855d29e0954cd0fa021fde38c766d45cb37750419fbb8fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620315, "uuid": "bf8aa9e2-a34d-44b6-a542-a040a1947d36", "comment": "Malware payload", "value": "b2b293cf1d3b82b952836f757c160fdd0d6fa355", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620315, "uuid": "bc46e46d-e5d1-44ca-9119-fc58e1a2476b", "comment": "Malware payload", "value": "bd35fddb06a3d7e7c32475e5afdf74180902f5730ce34cc2634cf03baf98d1e4fad38da5f4f02369802d9933800090f2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620315, "uuid": "3464cf53-a98f-4c20-bbee-a39ecc5c8322", "value": "4E83023103AE8B1DB4CE9A3954D22D8F3F97E4B82D195993551604E4E32BC629F38C7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620315, "uuid": "3333ef83-110e-47da-a670-298e39100641", "value": "1536:kDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRF:kDAysJADlV378P3RPVJLdcDsMU0dRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620315, "uuid": "7fe137ce-2729-4d2b-91d1-cc537422c71f", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620315, "uuid": "3ff236bb-13f8-44e6-a2e7-e26ae16c80c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620315, "uuid": "816d652c-c48c-4250-b5ae-5f187c0f3557", "value": "catalog-1917413790.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3a5606-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620125, "uuid": "8f79ce07-ec78-4aae-890f-827ad0e786f0", "comment": "Malware payload", "value": "d2ed312e8877493dffcff6cd7bf541a1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620125, "uuid": "e3ddb5b7-a6f1-4237-b235-94f10809a09d", "comment": "Malware payload", "value": "1b5cbf54bb3e39eafbb7165762ec9fbc99c5330b5cbc9d1dc69c9ad79618b2b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620125, "uuid": "ae95f147-f1e9-4ae7-a022-050c075f1d27", "comment": "Malware payload", "value": "28f7bad9601a5a235937e68ec2e535a8dc516445", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620125, "uuid": "8a21ea76-a054-4e84-bd15-8bdc94a74b94", "comment": "Malware payload", "value": "9593a84ac89059cadc7f258460653ae334549e641f5ed1853eb68f9cd1b885db91e0619427171aae786d469eb76788ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620125, "uuid": "cf1ffe8a-5d24-48d8-973d-cfee515ffab6", "value": "8783025453B94B1DB4CE8D2C6CE31E8F2B9BE5741A1F6DE1381D00A1B12B8660B28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620125, "uuid": "8d5a809f-51b3-4f8d-8f7b-117a2faa288e", "value": "1536:/DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdPN4WV8BAY6Hv7RI9V:/DAysJADlV378P3RPVJLdV8BXsjRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620125, "uuid": "6ef694cc-190c-4708-a94a-6545cbc73eac", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620125, "uuid": "86c4bfbf-d1bd-4cbb-8cfc-4705c8c3732a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620125, "uuid": "9f3e8ab4-4086-42cb-bc5f-a78a07c38438", "value": "catalog-1784433491.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee15872-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626576, "uuid": "ad4c35be-fc41-4307-9130-1db1688ade54", "comment": "Malware payload", "value": "52cf09baf8b9b076a8f4ae7dfd7fc2b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626576, "uuid": "7b1516aa-ec83-40f1-a5d9-8b118daa202f", "comment": "Malware payload", "value": "1b62a6fe99d2a008626d21a252d5678710b20a9b11603f82bfc3b8979af726d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626576, "uuid": "6e3448a8-b6ab-4f22-97e8-5824701dd1f7", "comment": "Malware payload", "value": "a8ed70ec182309e6bf479761de00ac02dcc3a27b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626576, "uuid": "fcfccee0-7d18-4855-be28-d2bdc99a9333", "comment": "Malware payload", "value": "aa86b238985987c671691438787f37aa784824bbc6f35fbff6f12f97f6ada517f616d25c655575556e1df62876971aab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626576, "uuid": "c385213e-b56a-4bc8-877a-e521d1d8b824", "value": "9483020403FB9959F48E9E38ACE20D8F3F8AF6B53D0A58E1976D0455B73A8910B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626576, "uuid": "06ed80ff-7044-4eb4-83bb-4e3c63eac703", "value": "1536:qDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBy7:qDAysJADlV378P3RPVJLd/eh8wBy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626576, "uuid": "4704737b-0bb1-42b5-b009-feda372eecd9", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626576, "uuid": "889a73e2-89f5-414d-8f16-455273436ba0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626576, "uuid": "e8ef43ef-0f5c-4684-835e-2db8ee27afc0", "value": "statistic-361353862.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a013b9aa-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626390, "uuid": "607dcf4e-58e5-4cf3-aa6e-d878e216aa5c", "comment": "Malware payload", "value": "19095097b2c5c3c49c5f3f7444d68a98", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626390, "uuid": "d7547df5-b83f-4937-ac6d-76459200755e", "comment": "Malware payload", "value": "1b7361c61e57cc950677d50234a7d1e264dfb872e5f6335e8874f38a8e307958", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626390, "uuid": "58d0aebf-db5c-4ede-aa0d-1870eacc4be7", "comment": "Malware payload", "value": "a819cc6db90fa7106ac1fda93659ca9bf423e656", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626390, "uuid": "5d41ce01-1432-456e-a40f-cb277c4e92c2", "comment": "Malware payload", "value": "82c5ac3a0e59121cd87f12fa4d46209632d1e8988ede602d38402c8d1b72eed024ab104766a91cb02e84c01d1b888440", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626390, "uuid": "b4d6024d-c9a6-4755-a94e-37d4f9aad07c", "value": "9C83122003768A4D74CE9D3C9CE31DCF3F76BAB4252E5DA2716905987226C821F3897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626390, "uuid": "fec25b9d-e40e-4eee-8a2e-a6ea2c25154a", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdXNp7Ctdn77/Iws:4DAysJADlV378P3RPVJLddp7mdnn/I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626390, "uuid": "a0aed590-deb8-4263-9579-a7f38af690a8", "value": 86110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626390, "uuid": "5b3cd53b-a590-4c4f-a739-9fc9492b879b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626390, "uuid": "ed96c5a1-e609-44bf-8aa2-0a3fd21d55f1", "value": "statistic-234906354.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc7bfb9-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620296, "uuid": "5a640ca6-ef2b-4415-a6d9-9f8b1b8ad46e", "comment": "Malware payload", "value": "5241d51ecbc142fad604aee124c83e51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620296, "uuid": "3846336b-5bae-47af-9a5d-69f9f3cf3b21", "comment": "Malware payload", "value": "1b7a4ac0c36a7724a0dc6de8f3b4e88ad3bf92c1e1ada98c911793c97abad1b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620296, "uuid": "9d01fe51-e6b1-41f6-b3d4-26ea0d4d7548", "comment": "Malware payload", "value": "2df97724633ca9935051f949d9b0e6bb62ef8eda", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620296, "uuid": "802eeaab-8ab3-480e-ad66-ceff6d3bcc52", "comment": "Malware payload", "value": "3b8307228a796bebf58c8882ebf8b894958cf252ceffaa24149023a2256bb5ebcfbc46e7c276b9a04661094c24664be6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620296, "uuid": "47a22174-234e-42bf-8fe3-4eecf762b601", "value": "FA83125053B94A5EB8CE8E296CE31E4F2B9AB8F4192B55D1794D04E1F2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620296, "uuid": "3b5a20f9-f64c-4e32-a08d-e1463906c072", "value": "1536:3DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdPIkGV8BAY0wCy:3DAysJADlV378P3RPVJLdi8BXUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620296, "uuid": "ffe03053-9990-45a7-b528-025500ad965b", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620296, "uuid": "c49638db-91a0-40ad-8724-2758196380ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620296, "uuid": "958a90c4-28de-4bb8-96e4-e7017d85f871", "value": "catalog-1905153639.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b664f6-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621322, "uuid": "212fdb02-7416-4fcb-901c-391267910b92", "comment": "Malware payload", "value": "015ffa9e1c4512a739297de04102f4dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621322, "uuid": "3fe81c5b-6d28-4fec-9ecf-75a2538eeb7f", "comment": "Malware payload", "value": "1b973512bc305e4a921373ca2b2a921c909334fcd71550a31ed15875e080e78b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621322, "uuid": "00aa3766-f379-4fab-b326-2143ae845242", "comment": "Malware payload", "value": "5d27d7f04c6135a5a8539488c3ffe7f37d2d27a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621322, "uuid": "4702bd59-22de-4aa7-ae96-3da6c3c8eadf", "comment": "Malware payload", "value": "50d03ff58dd9fb6c4ebc2311a1e568d105dd8ce3596d6f11db5462a1a52dc6682b4a150a1ceeb69bfabd07c308c9f8d8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621322, "uuid": "64ff5325-09d0-4617-8ee3-cb3a1f4f0eb7", "value": "4783123013B69F0870CD893E98E35ECF7B5AB8B42D2E99F1516E0456E123C561B2447E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621322, "uuid": "1355aa24-aa10-44d1-add2-027a44f2d18e", "value": "1536:mDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKk/:mDAysJADlV378P3RPVJLd+Z8Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621322, "uuid": "14e436d6-d3d2-4037-8760-a3e6b589a36c", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621322, "uuid": "7646b0de-f7b4-47ad-82ec-269c4600b7f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621322, "uuid": "a3f8afab-fa62-4417-b303-098fdfc067d4", "value": "catalog-564096457.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7a8706-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621201, "uuid": "9c108b75-336a-4978-9bd6-9cdf644a57bf", "comment": "Malware payload", "value": "54ddac33f8502fa405ea70620bad753c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621201, "uuid": "12742a8f-8ed0-4790-8e3f-8503f84cf78a", "comment": "Malware payload", "value": "1ba95a30024b2339874ed548aac096570e45d767f3a45bb2a4e9aec3d8fca9c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621201, "uuid": "2d712791-ce0a-45ce-8cdb-a4ea01a04ede", "comment": "Malware payload", "value": "c297ae45485b4b698e711eafaff9bb6c87be03d5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621201, "uuid": "cf92c966-d9d4-45c2-8c89-f18b4eefe7ee", "comment": "Malware payload", "value": "86434fb9748e96909621087a56657d73402804f161b271ba13fc0ee00765fafa46053b15a3c0f5f16b5608a6fa5136bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621201, "uuid": "776ef404-effd-4713-b76c-6d7342ef87e2", "value": "49830214237A064CB4CDDF2A5CB31DC76F56BCB82519A8F6905D04A4FA338526B2CA7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621201, "uuid": "184105c4-2ad4-4424-afcb-5acda976a736", "value": "1536:GDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdVR1EPCO0mQT:GDAysJADlV378P3RPVJLdFEP90mQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621201, "uuid": "c04df3ae-460e-4be9-abfc-1708531c66c5", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621201, "uuid": "0a945068-9992-4679-83c1-ba67b9ab9783", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621201, "uuid": "9430dcde-032c-455a-9c7b-40786dbbb23d", "value": "catalog-459432290.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d9b3e9-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620286, "uuid": "fbc757f1-5ae5-4da4-95b8-402fb1c365fc", "comment": "Malware payload", "value": "dcb34889af80862469f45fd4b712cde8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620286, "uuid": "fede4016-fec1-4656-8f42-1d0aae9ce9ff", "comment": "Malware payload", "value": "1bba52e29a541418112808be0102f3b0c8cc6252129254298cdc348c0605165e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620286, "uuid": "34a11376-5375-4141-b611-404dd715bd21", "comment": "Malware payload", "value": "aac6a6bd309254e17420fe4947a7657a4b8e1ab3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620286, "uuid": "89159e2a-39c6-44d1-8782-f4fb8bd98233", "comment": "Malware payload", "value": "37f59535df1ab0b12a7f46122b26bf2a2a11d0c5235d0a3add5d9bc1ed2ac2db8d82ddee652fb85b036495e6d3fa8347", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620286, "uuid": "0f1349c0-a1b8-4e1c-a818-1e5f0806a013", "value": "4A83025003AB8D4DB58E5E3888B31ECF3F95F9342905E8F1753E19B4E32E46A0A2497D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620286, "uuid": "37fa97bf-7bc3-4602-b1f0-95ab8862acec", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGneL4XqG2DbLX99:0DAysJADlV378P3RPVJLdg36GYp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620286, "uuid": "e250d8bd-19c1-448a-87f4-d8b3da161ba9", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620286, "uuid": "036569b4-b6b4-4146-b25f-477a1500df0c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620286, "uuid": "0a677fcf-524f-4da5-ad6c-1fa84869b5bb", "value": "catalog-1895264952.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65962d3-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623501, "uuid": "92de152a-4a5b-4205-ba33-94e01dff26d6", "comment": "Malware payload", "value": "31e63a151ec69e50e1bc274f05e441d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623501, "uuid": "d306c1b6-3833-42e0-8677-fd5e89bad411", "comment": "Malware payload", "value": "1bd6421f83eff42de8865773566047b813af259970d8e0803b84d0b24e4f9d4c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623501, "uuid": "2cca9f3e-4ab9-42a9-9499-1c816481ec2e", "comment": "Malware payload", "value": "0bd5f1a2126d362982b3a9ab75d15be8cdb1c48a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623501, "uuid": "08d05226-a3c7-4d5e-aa3e-79e81b386ce6", "comment": "Malware payload", "value": "076c28b5a19d1a32bc608bae43e624afae8039a7f8a23a494a5be9dc6283959b65486dba37c77c3e2a58e9621c2a9d3e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623501, "uuid": "71bb5c25-0642-4e52-9783-c3ec1d969c48", "value": "A783028C7538C1DF33BE6A08E2DC887BBD09D9B93504355EC089665FAD86FEB485B060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623501, "uuid": "2b2a2a1b-8662-4a6b-a17f-8d5a00c7a6ce", "value": "1536:HG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZds+RKYFxQ3d+pEa:HGEhrHJoEsBMG7qzkOQxOXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623501, "uuid": "cd5f80b0-ae19-4acd-a928-0d3399b8a044", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623501, "uuid": "3f4f6563-6cd4-40aa-97f0-752080afe2ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623501, "uuid": "ee3f5686-0d69-4f70-8bce-99aea449b79e", "value": "diagram-2140268579.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b92543-a861-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619642240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642240, "uuid": "5faf5e47-8fcd-4259-80b3-fd6c9a1ef57b", "comment": "Malware payload (Dridex)", "value": "6c89e79778977dd54e80bc4b857de08c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642240, "uuid": "5247ba24-5899-42e4-9b05-1deb09cb2a8a", "comment": "Malware payload (Dridex)", "value": "1bded86c83ac438bdda3a3cde8829a9e77fc18f0142c2ff6887b23ef3c51df6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642240, "uuid": "dc355c45-623a-4df9-a05e-e9715b62c1ee", "comment": "Malware payload (Dridex)", "value": "d915eb3b2fee7dd9883b7828b3338e626362e5eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642240, "uuid": "e20c4238-f75b-4256-92b7-80b41d485550", "comment": "Malware payload (Dridex)", "value": "2894a36d4c13433c30c8c1a9a88529427fa3ec453ee35fe6861d3787ad67c74e0e455fead783b373609ba3896307e884", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642240, "uuid": "b8085105-2044-476d-8e1d-3af90c58c747", "value": "CAF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642240, "uuid": "4a0a6853-e5d3-4641-b545-3c1705ee4d08", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642240, "uuid": "f7da796f-6f8f-4bb3-82ea-ad13d3d9e6e0", "value": "3072:mi8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY5Zwd:gnClX8WZ7/HrRCADTR0VlTZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619642240, "uuid": "2aa686c8-9267-4e02-b29d-1c3bc44e165a", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619642240, "uuid": "2481e7be-9c83-4ed7-ad35-710b0208e4a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642240, "uuid": "5b735d16-1c15-43fb-b3b9-11d2ca842381", "value": "6c89e797_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74484b2d-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626746, "uuid": "17a966d3-d829-4147-9d16-444d3591a2d9", "comment": "Malware payload", "value": "3bd9efe7c88d153c07e8dfeb3fb5c617", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626746, "uuid": "27b18d49-b118-494b-a0b8-73d608b4619a", "comment": "Malware payload", "value": "1bea43c302ed4756f2d6e1311e1594200b214d08c310bb9073c44599d7de7dc4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626746, "uuid": "4f27deea-0f0a-491e-8a9e-cb8156c8ff1e", "comment": "Malware payload", "value": "e06603bc262f6674c84560eec5ca8d6096381715", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626746, "uuid": "82039e47-0977-482d-8f9c-ad375607aeeb", "comment": "Malware payload", "value": "8e4ce7300ab1e1934a23cfc52b8d1507ce66fe05fcc979556bf2e120615ef829094c9664b3ec9826ba331dc3d2fd3db3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626746, "uuid": "7076faa7-3369-4db0-bd2b-359ed1640d34", "value": "CC8302A453BE4A5DB98D4E2DACA20D4F3F57B6743D0E68F1B92D0481E2318561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626746, "uuid": "df6ac497-3c3b-4639-84ab-b64d8a38dc70", "value": "1536:qDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTm4C:qDAysJADlV378P3RPVJLdBxpEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626746, "uuid": "4675ae52-2d5f-495f-be1b-ab4404543d8a", "value": 86110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626746, "uuid": "8982eaf6-afad-4f8e-9e6e-40f4a16815f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626746, "uuid": "5e446be6-4380-4c20-b94c-c716c64d29cb", "value": "statistic-47225549.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c84dbf2-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619297, "uuid": "57400004-da22-4b9f-ac93-3e4afefcfe87", "comment": "Malware payload", "value": "3c7eddd00661acbcf934ed6de8ec5523", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619297, "uuid": "bf930691-0446-4c78-b40a-080b7f05a5b7", "comment": "Malware payload", "value": "1bf0da0631a1e3bb6850d38c373e92c6715038e72db2e7de3d0f40bd284ac499", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619297, "uuid": "2e5aaae6-436f-49f7-a62a-9ba40f10a577", "comment": "Malware payload", "value": "39094c95df1bdd6cbcf2d0ebf04e6c344a7ceb25", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619297, "uuid": "3ef1bfd9-f5af-47a3-a0a7-16c00216aab0", "comment": "Malware payload", "value": "296af774f1ad913fe81ffa06ca37e1087fb9e46d4ba8aea0bf457c277058df9fe852c4fba4a172915fb8af0e006e5108", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619297, "uuid": "86d1d01b-e795-4218-959d-e9f346b76578", "value": "F383027103AE8B1D74CE5A3958D22E8F2F97E8B82D095993541904E4E327C669F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619297, "uuid": "c9a0a587-d6d3-4f8b-bc03-31df01cf2a2f", "value": "1536:jDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVR0:jDAysJADlV378P3RPVJLdtDsMU0dR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619297, "uuid": "84bbad78-9d5f-4515-9979-deec9df33410", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619297, "uuid": "df903334-28b7-4322-b054-0704b42c5b38", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619297, "uuid": "876a0168-8558-403e-9391-b3be4e39a7d3", "value": "catalog-1178566918.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eb5957-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640759, "uuid": "c91fc5dc-b912-4251-9bfb-330ca7308b04", "comment": "Malware payload (Quakbot)", "value": "d89c5148fda14eb15bfe134a635cda4a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640759, "uuid": "fedf6d9b-56c2-44a3-8181-a47efd966d0d", "comment": "Malware payload (Quakbot)", "value": "1bfe6e61f776052457e23584002c060380b5f7ded523f1b684a0d07c9b9230e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640759, "uuid": "eae012ef-305e-42d8-8e8f-9779c82f7e90", "comment": "Malware payload (Quakbot)", "value": "031196e78ea4dac083b697d0a3db232a8172f489", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640759, "uuid": "2a11f3fd-bd6d-4459-95f7-dc20894b351f", "comment": "Malware payload (Quakbot)", "value": "198226bde11b08ddc8b852e379dceb42ff40a7528180d4cda4c0a4c4b19788e0339d20bfc23e93c7f4c5c7526b52491e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640759, "uuid": "3509036e-cc89-4aba-b9ba-ae3564645911", "value": "87947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640759, "uuid": "b02cd80f-9e50-48dc-838a-2c173a826330", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640759, "uuid": "a14f689b-18ea-4dfc-9f93-bf002b9b4ef8", "value": "6144:9yPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm0:RTwr03pdf8vhhOKJET5By0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640759, "uuid": "973fc4a9-67ad-46d9-9c43-913f2f893f87", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640759, "uuid": "0fcede2a-9134-4c5c-b243-5c58ce345802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640759, "uuid": "721bb7e8-ee4a-4a60-8972-3c2facfcbde0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f6989b-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622425, "uuid": "20afe851-046b-4fad-960c-7dfb4a405052", "comment": "Malware payload", "value": "61295c5086fd664f84d711aa504e20a5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622425, "uuid": "c8b457ec-c9f0-4faf-a496-88bb6e0512f9", "comment": "Malware payload", "value": "1bff8c93b00cb8c119131490b6d8ba2595c9fa49cdae02694929b94390cb1ea6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622425, "uuid": "a03a3834-bf07-433c-9a82-d07613fd9f8a", "comment": "Malware payload", "value": "a8a65d6e378691a8fd1b58419acea098a634fbc5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622425, "uuid": "4ce51d46-c2ad-4103-9140-37d9d03b2909", "comment": "Malware payload", "value": "543ed2aa548c347a563503ddcf6bf1b1394e415bebf62486b4260fea97ea240f626d734981a59cb314f91096a8539429", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622425, "uuid": "d195d1bd-0df9-4a88-b50c-16cafa2744da", "value": "7383029D203DC5DF71AC6B0AB5AC893EBD4D6CB5210064AED4D8266EAC4DAFB9C53030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622425, "uuid": "597c556e-6cd8-421e-8a8d-a76c124aa72c", "value": "1536:hG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttkI5EzJKE9LfFSp7m8e:hGEhrHJoEsBMG7qzkWI5AB5gpS8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622425, "uuid": "68d44e03-616e-4730-b10c-5f508466e0b7", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622425, "uuid": "d001e8b9-3f25-488c-88c2-305d4e854bf7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622425, "uuid": "a4ec51c9-3c8a-475c-8f92-ccf4fab01f07", "value": "diagram-1374438961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f417cd45-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626101, "uuid": "1b53db32-2f99-471e-9b8a-7451edb31628", "comment": "Malware payload", "value": "478e97411d4a01b1ef57e9bd2a168d75", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626101, "uuid": "33d505f8-2643-418d-aa8a-f4e0e706b99b", "comment": "Malware payload", "value": "1c0e76df12ac72fe70579eec91997e5345fe7bf223087c5a60ecaa7c0ee72edd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626101, "uuid": "8e942deb-1026-4e4f-8a65-f662c7c4ab36", "comment": "Malware payload", "value": "51222968b53054689465bd4c5f67a320661d7995", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626101, "uuid": "9dc1af3c-0932-4228-a67b-2716eebaaef6", "comment": "Malware payload", "value": "e9745ea4c944c42fac35c70c844226aff51e753456dca49c40626abceba6a0a5942b177944a99eba0cd73be1a8c466c1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626101, "uuid": "a365e0ed-68db-44f3-bafe-04724bdfc47e", "value": "878302A453FE4A4DB98E4E29ACB20D4F3F66B6743D0E58F1B91D0485A231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626101, "uuid": "7edec531-3250-4deb-b232-ae8ef60c5464", "value": "1536:KDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd+hsMnSEwJPTmH:KDAysJADlV378P3RPVJLdQxpEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626101, "uuid": "0d3f4608-9548-4aed-947f-2072a09c1f55", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626101, "uuid": "f09aa6a0-4584-48f3-88bb-4806320f32e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626101, "uuid": "7b4e5f2b-482a-489a-8a1d-c4f7ee62da27", "value": "statistic-1956871357.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e7ed32-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626633, "uuid": "ee270bd0-3b67-4fc0-b2d5-c9e488c2a199", "comment": "Malware payload", "value": "426af750824ae81e4d50e363892177f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626633, "uuid": "e845920b-9774-487e-acde-b573b4999bce", "comment": "Malware payload", "value": "1c1cb4d5d1cd1ff23b67fbfdd170458bb8ace6d05587bb739bcdbf04ed5cef66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626633, "uuid": "c3cba8ce-fdfc-4ddf-bbdf-0b4d0283ce27", "comment": "Malware payload", "value": "4671b45403d7540798077293956d853a0ebcc33b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626633, "uuid": "ebb28be7-a8c2-48ec-94f5-f4c97ea0e9f7", "comment": "Malware payload", "value": "5fe58875709c5e4afd8316954ac0514d9655e2331645dcea6af11a6d0929a28edcf7653c7c00d188ecacaf3f86fde7fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626633, "uuid": "ac77a68b-33fd-4555-8e23-6aa5957df0b8", "value": "D583025013BB8EADB58DC93D48E20D8F2F56B6B02D5B5CF2B12D0494F1238961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626633, "uuid": "a80df2d0-dfd1-4c8b-a585-efcf6af06855", "value": "1536:ADXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7aY:ADAysJADlV378P3RPVJLdw7aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626633, "uuid": "df35a9d5-e0fd-4b4c-ae0d-5f6ebd9ccb4d", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626633, "uuid": "d4d83db8-5de3-41b0-954f-d141f26f9d0d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626633, "uuid": "034d9c09-309a-44d4-9217-b265ab789602", "value": "statistic-390979835.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f041a19-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624240, "uuid": "bc4a2593-e2d7-4f2d-bfa8-9ec152bfef2e", "comment": "Malware payload", "value": "f7d9247e1f3bfaf4ed2d82c218ce6b08", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624240, "uuid": "c6b1a355-9232-4d22-a78f-e223d80a91e7", "comment": "Malware payload", "value": "1c315f5b20d3428c45b738b17b11f3b2181af7283d6cd0941cd69ed7dc725c02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624240, "uuid": "24db13a2-3541-456c-ab32-631c95e34d9a", "comment": "Malware payload", "value": "623cf689d2f645851750a4179a8d3ab64051f548", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624240, "uuid": "dd4415ab-6206-4d0a-9dfd-d6dcedcb03b3", "comment": "Malware payload", "value": "13173017d9309b8ecfe8332571ebb21e4e3f00c07707908636925c1ca419288f714e905581309152b15eca513d1a09b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624240, "uuid": "29ad7392-cd94-46a1-ab6d-5c3321209545", "value": "BE8302D9203DC5DF71AC6A1AB5AC893EBD0D6CB5310064AED4D4266FAC4DAFB9C63030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624240, "uuid": "8164cbbf-5704-45a7-916f-1033ff892675", "value": "1536:kG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttTI5EzJKE9LfFSp7mJaL:kGEhrHJoEsBMG7qzkpI5AB5gpSJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624240, "uuid": "568eb2a0-f155-4029-8eee-8e3a01d8e58f", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624240, "uuid": "d2a11077-b0b5-437f-912e-30b5037bc622", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624240, "uuid": "ab8186e8-7743-4c6c-945e-fd4ed121608a", "value": "diagram-634108045.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16893c1b-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640762, "uuid": "368f8f8c-11f9-4b20-9f20-b00f04a4af83", "comment": "Malware payload", "value": "853c237f32f0fc38414db4a8be77e290", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640762, "uuid": "e8b6b7a8-066b-4ab6-a466-4e0377677fbd", "comment": "Malware payload", "value": "1c3493f9764823e85a00104843f9845734c2d82af92e8eb5bb1bd0c8f57a4bf7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640762, "uuid": "2769b3b2-d3e3-4421-80f1-778272037116", "comment": "Malware payload", "value": "1c624f107d9a089e78c770018910d9cc43d92c6d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640762, "uuid": "37b25aac-e5f1-4222-8c59-3372ccbe99c9", "comment": "Malware payload", "value": "45de1f5ce679a48e196f0922ef926c3deb8977e09a690b20a3b48de96028bc5853208f6917934a6ef0c35fc5f4a62350", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640762, "uuid": "d66a10e9-ee61-42b1-a099-34532ca2cea8", "value": "EA948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640762, "uuid": "ab6958a4-0ba8-4637-9710-1cb9eca93844", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640762, "uuid": "36cf113d-b821-49bb-b69f-ba9a6d935a37", "value": "6144:3VWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWradr:AFNmLKSVpJbPT+4xrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640762, "uuid": "036ffc5f-bb88-4e09-93b7-54cc66b794b0", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640762, "uuid": "5e53eedf-74cc-426c-a154-5ed0076243c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640762, "uuid": "fb57b93a-2432-4425-a2bd-d12ae0fe3a68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234c2ad6-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623603, "uuid": "0c531261-3ceb-4553-8851-8ee888575da1", "comment": "Malware payload", "value": "d75d3ddcfd811048bc98f3637eddcc57", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623603, "uuid": "a7366966-e1e8-4154-b46b-80bc8ea422d6", "comment": "Malware payload", "value": "1c36456ad1835a7f1f15aa2ba2d78041d6cd2eaf2e5ec6fd310febc6d517adcb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623603, "uuid": "72af24b9-c473-4990-8a66-e9da25615f71", "comment": "Malware payload", "value": "a31991792e0367309e0b0d5ea59749fac6a7ba81", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623603, "uuid": "bafce996-f18c-434f-a8d6-edaa6fa6431f", "comment": "Malware payload", "value": "7286cefefbc975d2bfd8524c50777cb19721922e51f602411dc29c10fc07f52281a59b29797c10613d28d7a1c074fa11", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623603, "uuid": "3b212add-8203-4a8e-aab7-8596a65e8e6d", "value": "3D83029C363AC6EF75786E0865AC8C3F690EED742044649DE8C06E67E84ABE70E57530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623603, "uuid": "6aa937b2-5902-4a2b-97f0-6a757ad05acd", "value": "1536:RG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttAsujryI8bFO:RGEhrHJoEsBMG7qzkjI8bFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623603, "uuid": "39808217-1e41-41ed-b283-45e59bb31fe5", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623603, "uuid": "5de838f5-d23a-416c-a69a-f4222a939ecb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623603, "uuid": "ed191e1b-2223-4805-93bf-5ab19c96ec9c", "value": "diagram-284791219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac16257e-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645308, "uuid": "0e02a3c4-5a26-413e-8ed4-8a5d2594b2da", "comment": "Malware payload (Dridex)", "value": "6e3db5457ef4472d3ba7e371a89ffe24", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645308, "uuid": "762f4ab9-505a-42da-ba81-0d253ae2cce8", "comment": "Malware payload (Dridex)", "value": "1c3760d2e582d7998b76d9a8479986bd5aaf92fbfef3e6759dd892a424f12779", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645308, "uuid": "0af419ad-4aeb-4635-b3a4-aa7926884ae2", "comment": "Malware payload (Dridex)", "value": "fa62bb5459cc0d6403e8a315d2ab9c54e5fb2fb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645308, "uuid": "8bf089c8-70a7-461b-904f-ea877d57009f", "comment": "Malware payload (Dridex)", "value": "ded013350c9548e148fb7b9c054373f5a9bd80a3a1e1e04578f05604a0b07f91426926814b5d1ea70fe3a7be3ab28b1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645308, "uuid": "57011693-7172-4c1c-a1af-7728e6b0cfa8", "value": "EBF3BFC6E7EFE0D6C02BB43385CDB036EF6069D88A3ACF35C104892E69D7D549A35469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645308, "uuid": "b2998b1b-6959-4ad8-a153-9d2a7002d2b8", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645308, "uuid": "cfcf5820-aafd-4f99-bb1b-281731be97eb", "value": "3072:l58CMtKJlXoDRl4epTGmoAc7iTRilfn6wlYYbZwd:8nClXSRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645308, "uuid": "1ea54539-a08b-432c-94b1-bbd7a2eb6fda", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645308, "uuid": "c3f26bd4-1383-4285-a3b8-bc65ae78eb1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645308, "uuid": "d0c59d68-0c4b-43ff-9ecf-1286f6d9eac9", "value": "6e3db545_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3686959-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624248, "uuid": "6d3ae650-406d-426c-81d3-bc0ec16e6396", "comment": "Malware payload", "value": "fc4a573324f34b94a4a1204988375137", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624248, "uuid": "8629c273-3857-41dd-8d97-1993e49d1d80", "comment": "Malware payload", "value": "1c4511c17efa89f6ea79679a80ff08520be790f16be0135b3b44fdff1d57535c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624248, "uuid": "70677657-fdda-4839-98ed-c19f72b13504", "comment": "Malware payload", "value": "17d74ee49e6bf6eeacff767cd7c8c1ecc8daf60b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624248, "uuid": "ec4de736-ae74-44f5-b763-8feed590cc81", "comment": "Malware payload", "value": "d5a4a6e3fa6bf76df4bb9eadf8de4da86511f2da35dc2ab2ae88ab22e58fca77f2b37f6c581bfe06f5439882683800c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624248, "uuid": "c7a26cf0-95d6-4bf0-b2ce-8fef77b2a3ac", "value": "4D83018C653DE2DF763D2D08A2D8887F780DECB4210430CEE4C91A6B5D8EEE758A7460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624248, "uuid": "4b479091-2977-4b2d-99f8-11315302b4b9", "value": "1536:gG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttKhWgYkCxGcf1aSB:gGEhrHJoEsBMG7qzkMh12xGwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624248, "uuid": "24c010bd-965d-484b-a495-61e26e5f45dc", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624248, "uuid": "5f174267-a0ca-4735-b72e-295b61400bcd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624248, "uuid": "0fb7a682-023f-42a3-a652-de6709c254b1", "value": "diagram-637990122.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916c780f-a808-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619604031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604031, "uuid": "dfc15178-f8fa-4743-9778-73f8e6ac7f0a", "comment": "Malware payload (Dridex)", "value": "e31f7f1a18c5b26f7cd9cc64c0419023", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604031, "uuid": "d0978e32-7312-400f-be65-34df54b745fe", "comment": "Malware payload (Dridex)", "value": "1c45b9ebfdb85349eeb846095c1a2d48520c972f5295a21824588e37957ad68e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604031, "uuid": "3ee5ae64-550e-4df2-99ef-b13b6b747ba1", "comment": "Malware payload (Dridex)", "value": "5cb1e82db98602d9aa7877ffa15fbb7bb6dc0c24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604031, "uuid": "5e8ca331-edbf-4f8d-be16-c30b7f72d818", "comment": "Malware payload (Dridex)", "value": "94b79238a5ce45633ef974850e969bee1217d1f2f5faea94ae58df54781b3cf92fdb25ceee09a1bf278c399773319db7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604031, "uuid": "71e0acaa-33a9-47d2-a6e5-3605958d9f5f", "value": "EBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604031, "uuid": "dbf3c3df-ac50-48e9-834a-180afd790b20", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604031, "uuid": "9f69a2bb-7b4c-4a04-9ac1-a63661eb5499", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619604031, "uuid": "95947e21-fdea-4a9c-9d17-5a3036f936d5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619604031, "uuid": "1fa793f5-a7ce-4387-a691-ecde62cbc2db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604031, "uuid": "a234096a-7c31-477b-b781-e0cd3e3b48d4", "value": "e31f7f1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d5feb5-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626621, "uuid": "15da71b1-5bcf-4052-ba5f-392510580e5b", "comment": "Malware payload", "value": "1b325045e1a2beba0e635fdf69f1820b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626621, "uuid": "697bd1f1-f30e-4a07-9cc4-9aee1b22725f", "comment": "Malware payload", "value": "1c503beff37d66d5fcfa56a2e6df71e17e55afd61bf1b483f0f07472a0e11bc4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626621, "uuid": "f009bc2b-9862-4fea-9a8c-9e0c2b567d72", "comment": "Malware payload", "value": "11883229f8c5add06aeb0566ba416db991ffbc56", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626621, "uuid": "5822c1fb-4441-4183-8a19-c023871d1e50", "comment": "Malware payload", "value": "d959d2c315af162e75b4882f6794dc7abb8333b7572da50590a23d62454b32cddf280ecee1ab615a6d88d6e774af78b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626621, "uuid": "d7044ba2-99f9-406c-aeb8-49ae9e369ef3", "value": "D983025013BB8EADB58DC93948D20E8F2F56B6702D5B5DF2B12D0494F1338961A3897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626621, "uuid": "aedf6847-0bbd-46cc-8733-4fdfa305334a", "value": "1536:jDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7em:jDAysJADlV378P3RPVJLd47em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626621, "uuid": "c1d25840-e766-4db9-8343-229064b958a3", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626621, "uuid": "12ef9cb6-ec12-4664-9f86-7fd4b4f2ab07", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626621, "uuid": "061453eb-9fe1-4c85-9d7d-525ee7ee1712", "value": "statistic-382106334.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ab4695-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622339, "uuid": "95608948-b86f-499e-8909-eb01aa4fa09f", "comment": "Malware payload", "value": "0a27d5c0781e02d75447c240458d230d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622339, "uuid": "24bbd6bc-a4c2-4849-855e-8120dc12359e", "comment": "Malware payload", "value": "1c52337dadffc6220736cb8863e2b159bdeb1877cdcc2184a1d42b8150b717c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622339, "uuid": "85819b84-ac02-4332-8380-3c3993533add", "comment": "Malware payload", "value": "7aafb80b0caf343753f74c4a3ceccdf00f8b8051", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622339, "uuid": "c0ff253a-9ba9-4e1d-9c9c-15de007a2b61", "comment": "Malware payload", "value": "a2b9b97a33136742da55b87003933361a2992394f9a83af62fee9ab51d6dbe741a8c998ef1698bef1f64988e6e5adb6e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622339, "uuid": "0f12d71a-a90f-4924-9277-f60d77f0a4b7", "value": "D58302D9203DC6DF71ACAE09B56C893EB90D6CB42104649ED8D4366EAD4DEFB9C93430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622339, "uuid": "06f2c44d-8ecd-47f8-a476-1e8c675350f9", "value": "1536:IG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttwI5EzJKE9LfFSp7mql:IGEhrHJoEsBMG7qzkCI5AB5gpSql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622339, "uuid": "77581868-907e-4a44-8ee7-5836f73261ed", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622339, "uuid": "469361d8-a0db-4754-b0fe-d36dfcef83aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622339, "uuid": "f47aa5a4-ba20-4895-b9c7-b3ce992b7a43", "value": "diagram-1310612721.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa78260b-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623105, "uuid": "ecf702a9-948a-473d-95bf-e10cebff8caf", "comment": "Malware payload", "value": "87f1ca5f8b71f4983b88e6806d40ce9d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623105, "uuid": "bac049e2-dbcc-4c24-96d5-4de683c4710c", "comment": "Malware payload", "value": "1c5e0a0a01f783f282e57de2f3fb9cd94c80667a6aa39652d93bf4d0ecf54380", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623105, "uuid": "07ece3fe-3132-4bfc-83e4-c3be5d8cff2a", "comment": "Malware payload", "value": "17265cb026bcd7f1aba9ad723f059c2a9c8efccb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623105, "uuid": "2c2d8209-bb3a-4b0b-a921-3eb73ab1515d", "comment": "Malware payload", "value": "3d8b09ec0b24a62ea2e18fee4edd8833e3d6f63a4065daa78bd7be2e56a3f87cfbf08a92446d5bec56390f8fd4dfe531", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623105, "uuid": "d1473f17-d1bd-44c5-a764-2e9838dda05c", "value": "7C8302CC353DC5DF3ABE2E4952DC887E740EE9B43144144ED8C8666B9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623105, "uuid": "d35885a1-dfbd-4e02-b6be-a6aa4ff3b7ed", "value": "1536:uG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt9KkApVr6wo+Rx+:uGEhrHJoEsBMG7qzkDxApxT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623105, "uuid": "3273886b-7709-4dde-85a3-f9d97c3fd4a6", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623105, "uuid": "42944872-ae31-4614-a2c1-786b7f2568fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623105, "uuid": "4679bbb4-edb2-4905-89f6-1c65ea2bee24", "value": "diagram-1863888215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79286b3-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620389, "uuid": "a01533ea-1974-4d96-abd6-240e692ba570", "comment": "Malware payload", "value": "da2117fc31e1db39bcc0c59af3800d90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620389, "uuid": "c8d0289e-4a8f-4491-b3da-5385e972d6b7", "comment": "Malware payload", "value": "1c679a421aa86d0b4b749913377d3447ae545f5cfecd1314ababfbb5ffa72254", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620389, "uuid": "b85f7d41-e061-4be0-a4f3-2c641bd4b6b9", "comment": "Malware payload", "value": "7c532cfce5aec3e0c8932a557214e016949e8ba7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620389, "uuid": "59a597a2-e3b2-4dee-bcc6-49d644db2ee4", "comment": "Malware payload", "value": "003728c38318dc19186196af642e55399e42ce0e2a4cea770756e1c5b94c3cded7ecb5c97f016be3351ef4c9d611dc7d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620389, "uuid": "78b3eaf3-6ab4-48b7-ba5c-d1123656ffb0", "value": "B8831290B3FE4E6DB4CD9E2855E20DCB2E5EF574290CACE275AE04A492358452F3493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620389, "uuid": "633f1902-b3ca-44b0-b69b-6e1484a6eebf", "value": "1536:3DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1HoK:3DAysJADlV378P3RPVJLdIeJLOnleJIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620389, "uuid": "4b2a15c3-eb53-4332-822a-3b9c18e3d6c5", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620389, "uuid": "0ae0b273-ceb4-4f7b-b83e-42ac2e521b6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620389, "uuid": "918e0164-5a8e-4abf-b50d-411e91dc651a", "value": "catalog-1977832067.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9707fc72-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624657, "uuid": "be73e248-1cc0-483f-9e34-3df7ccac35da", "comment": "Malware payload", "value": "8e4eb5fe3d06547f69fa83c5abb84363", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624657, "uuid": "3ad87fbf-cdd0-4455-96ee-f263a1be7aa7", "comment": "Malware payload", "value": "1c679e2197944dce81fa6042b7c3da820a9dea2afc997a90233edddcce94467f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624657, "uuid": "7a91d7df-4f6a-44c7-882c-837aab87a3ee", "comment": "Malware payload", "value": "cd7bba4e47c0056173d14a2f618a2bc64d3583ef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624657, "uuid": "5d066b96-c03a-438a-9e45-66df517ffb5d", "comment": "Malware payload", "value": "9aef523140f39a52c32d81ad1887ab3ecdf80068f6fb075b5e9e1f7bbf2a5f9ab01f4032c5771c458cc351939f663735", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624657, "uuid": "acfa4d16-c569-488f-a3a2-36ff56224f64", "value": "5E83128C653DC6EFB1AD2F09A3DEC47F761EFC623048248DC8C966A65D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624657, "uuid": "9654ae28-94f0-4a6c-a897-4aba2495bf78", "value": "1536:TG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttPe6n6475e0NEnP6H:TGEhrHJoEsBMG7qzk54q/NEns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624657, "uuid": "4c502ac8-c4da-48ae-a3fc-482e29deadde", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624657, "uuid": "843e3bfc-786d-44d8-854d-8c0af71933d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624657, "uuid": "fb95703b-5b9e-4ee4-b1ad-5ddba20d9ee6", "value": "diagram-914735594.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45117f0b-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623660, "uuid": "ea1643b3-11c7-4cac-8b8b-015e0ead3482", "comment": "Malware payload", "value": "7d21d693a490c75f8b7bf3512fc490b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623660, "uuid": "4caee30e-c21f-4211-8736-20ac9c00e239", "comment": "Malware payload", "value": "1c81ed3ef8766fee6397a432a49a1b7c7fc4bfd8774bedc842d6540dc68a9248", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623660, "uuid": "b8691701-7ebc-4dc7-8ef2-f0e121ce0e0a", "comment": "Malware payload", "value": "5559c7efb2110f3e17470cfc1736627987585467", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623660, "uuid": "755571ee-0460-44ce-b23f-8413458ec5fc", "comment": "Malware payload", "value": "b90185da160c5e337742602cffc53452ed2b0958d889385018b5c9f50498950cca04273c5d2fbd99eaa8d4eb1f313174", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623660, "uuid": "0b775688-1add-4ec8-a536-86adfce753c2", "value": "EF83025D613EC6DFB56D3F09A5AC897EB50EDCB4300018CC98C477679E49DAB4CAA4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623660, "uuid": "f387d72d-3f90-4865-8d92-19a96a3007b1", "value": "1536:0G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tteKKmo3zuUkbF:0GEhrHJoEsBMG7qzkK7KRbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623660, "uuid": "a45c266e-41c6-4d2b-8c0f-29d42e1665ea", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623660, "uuid": "fd6cfd8a-1e94-41eb-abbc-09bc155084e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623660, "uuid": "6c8cfdc7-c6e4-4fe9-a540-7c7a7ef72684", "value": "diagram-319240463.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0ade74-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621870, "uuid": "42031f5b-9e27-412f-8965-30c244c53736", "comment": "Malware payload", "value": "139ea66d2c544fbf090fdd5a29ec7476", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621870, "uuid": "029d2890-f849-4220-b411-1381532ddc86", "comment": "Malware payload", "value": "1c89727ca477ab0a8dc06136043468c7cd302fbf818e85b13c5d36ccc86822cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621870, "uuid": "0ba320ee-60fc-4ded-b3b4-4640c3c284c6", "comment": "Malware payload", "value": "b03f8b94a639a6d2bfb9a2964e80bf4d761b3337", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621870, "uuid": "954fa21a-888d-45ec-822e-a3b5c39c1ef9", "comment": "Malware payload", "value": "0fe2e8a873cffb9fe4a7c17d538539a56a21d238a82a08c21a1e1eaaef9b05abdfb842171f6ef7ecd608d676014906b3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621870, "uuid": "7a4dff7b-4ba0-4a47-89de-c557a88f2b2e", "value": "4E83023103AE8B5DB4CE4A3954E22ECF2F96E8B42D195892552904E4F32BC655F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621870, "uuid": "7a7316bf-ce50-4f1e-a041-efab7c06fc4b", "value": "1536:iDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdKDsMrbsTmHvVR/:iDAysJADlV378P3RPVJLdKDsMU0dR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621870, "uuid": "ada94898-da66-4430-93c2-afac6092558f", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621870, "uuid": "111911c7-8291-4196-bd39-4536854654ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621870, "uuid": "8b125773-65fa-4c5d-9f10-575f34b9aa8b", "value": "catalog-981557062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183b3204-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640765, "uuid": "b1123b62-c3f8-4ffa-9b91-fdd824c77971", "comment": "Malware payload", "value": "7822fa69f881e571f558a3f1a6db2b7b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640765, "uuid": "b77e52b8-6739-4fa1-bf8a-df5bb995a5c4", "comment": "Malware payload", "value": "1c89c7540e64bbc6a621652cccb4faf13fd8de852053a72af782b3f2d21064e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640765, "uuid": "217d8111-7b85-4ecd-8d4f-8a80a92f75f1", "comment": "Malware payload", "value": "fa2d1e4de23f98364652f58c13b50c78e6504315", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640765, "uuid": "3f5c0875-2165-44da-b255-a97a5c2428c8", "comment": "Malware payload", "value": "91aff0374f31e4cbaeea95ba570ad09ff671c2d9b8fa2b2727d40f3b038c0272028e17d6795c46695f79f72045b83648", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640765, "uuid": "ce2c4289-f468-419b-8082-85d0facf0129", "value": "D8948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640765, "uuid": "03aa9faf-9915-4af3-a9c6-0e7553b3f2ce", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640765, "uuid": "9ad8bf57-b894-47b9-ad7f-20d9e702498c", "value": "6144:DVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraD:cFNmLKSVpJbPT+4xri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640765, "uuid": "9af2a10a-fbd4-431d-bce8-31dfbb1fa933", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640765, "uuid": "d5182fe2-14c5-4037-9474-522abab856eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640765, "uuid": "ee974df8-3aab-4703-92b1-8495eace7bad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2f087d-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622840, "uuid": "fb52b91f-a3f4-4c16-a0f3-765787de68e4", "comment": "Malware payload", "value": "da59fecd3e361074e0b21378a31fc4f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622840, "uuid": "ee8b5c91-1598-4461-82a8-19c48fd9f70f", "comment": "Malware payload", "value": "1c970922f9eeea6d77203b235c97506dda3047fced3bd6486fa0ef1f99c0cb57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622840, "uuid": "c87023d4-d7fc-4c6a-abb1-298a65762489", "comment": "Malware payload", "value": "8e9ebd38d87a767de9aa2cfe7d02265232cca63a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622840, "uuid": "efa85441-723f-49d7-873b-6f6e1329ce86", "comment": "Malware payload", "value": "f2a2255193e51da0b476d25a724906e4ea626e3d2379c85351b41e5cc3d9723776d92287fec359b0f366d91a37b7d9f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622840, "uuid": "bcdc8afb-5e27-4d64-a39f-c9c90ab9966e", "value": "B88302CC6239C9DF727D3E5AA2D8C43A7D0E98BD3040289DE4C0669F5E899E75C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622840, "uuid": "5d1792f7-8eed-4099-9e58-27a8b2acf527", "value": "1536:tG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGrAb:tGEhrHJoEsBMG7qzkEEVerr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622840, "uuid": "49fcbda1-1b02-45a8-8da3-861a3b99169f", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622840, "uuid": "b5255431-52b5-43b7-b11c-f02b7eeb9a35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622840, "uuid": "7b1642fe-4bfb-4e30-993e-cbb0df1de5b5", "value": "diagram-1683208002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7388155d-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621161, "uuid": "838e2728-8b1f-4dbb-bc40-2f0ac5d704dd", "comment": "Malware payload", "value": "fdf0658e618981cbcfd281c641e0dd7e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621161, "uuid": "e0bb5e69-cae2-43d6-b41d-cf7994267317", "comment": "Malware payload", "value": "1c9a0dbd7b1092d51848b9fd41d37eaf8776436ee506829bad195e6eb25468ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621161, "uuid": "a9337ca8-8056-449a-9c60-2b417f1c96d3", "comment": "Malware payload", "value": "e333c3e35d17a5ca1ccb7cbce14ad22510091e22", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621161, "uuid": "0fe81071-ec40-452e-b5cd-05c97496fa90", "comment": "Malware payload", "value": "041c62e9b2b0ef251ac89c075a352b388c38533f689102135201ea7f1838db92cdc85b324a0fb86a00788054df6ee011", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621161, "uuid": "4535b8e1-ed3f-4468-82f0-3446abe59f4f", "value": "A583021513BF564CB88D8F3D9CA30ECB2F5BB9742519A8F2A55D00D8F6338425B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621161, "uuid": "da3be482-a4d5-41ad-aa16-5515c99212f3", "value": "1536:oDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsRP6sCO0PyS:oDAysJADlV378P3RPVJLdC6s90PyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621161, "uuid": "70c0ae70-97e2-43a4-9027-908207151018", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621161, "uuid": "11ca50d2-a82a-4ab0-ae82-140716bd6bba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621161, "uuid": "ad4a2b29-9d1a-4136-9091-e2d2a06243e2", "value": "catalog-438789632.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e70b49-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624405, "uuid": "928101f9-2502-49d3-8a9b-deb245ca2223", "comment": "Malware payload", "value": "ebe0fc4d37187dd45a9baeda6b195986", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624405, "uuid": "8ef817e2-2523-49f9-b019-3f8a1e563d10", "comment": "Malware payload", "value": "1cb44e4423d2ae0014b55d577e3f008f43bcb4e6b8ed6946820d4d5b30f9473b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624405, "uuid": "efe553f1-5896-4588-8853-865c3aa450d5", "comment": "Malware payload", "value": "47c51f0541e596bb2545b1428b0e9daa7ef2d10d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624405, "uuid": "df531bb5-afaf-4cd4-94ab-02b5128a8953", "comment": "Malware payload", "value": "fe71f0dfa51e839fd57d947489514d4de5e4c089f9c960869b68fa48a902e63b44bc63d5129a2d950007b60c4079aa33", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624405, "uuid": "a92c1f09-1f40-4d8c-aa46-de450edc36ac", "value": "2C8302CC653DE6DF763D6D08A2D8883E780DECB4614434CEE4C81A6B5D8EEE75897460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624405, "uuid": "13d231b0-5f2e-46c1-9b3f-4473c6d3b5d6", "value": "1536:/G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSQ:/GEhrHJoEsBMG7qzk6h12xGwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624405, "uuid": "af0bf7d4-ec34-42ae-b8f9-4e286c70604c", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624405, "uuid": "bcfa156b-c53b-4360-a539-a037cbc28d6b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624405, "uuid": "9d9021db-6224-4e77-88e9-986df907247a", "value": "diagram-752723518.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426e6cc1-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622797, "uuid": "483463ac-1560-4e0e-be26-2bc48d56abfc", "comment": "Malware payload", "value": "59c8c29f9612e691a079e89e918abd8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622797, "uuid": "2d4030bb-f13b-403f-9b14-ab690806847e", "comment": "Malware payload", "value": "1cbf20b0c3c068895fcb85247fe53831fba957c3a73d9379f5fd33400396b658", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622797, "uuid": "e3e20adb-72a3-4dd3-bac3-a4b7fcf5cd44", "comment": "Malware payload", "value": "39ccfeeec08b0767c9e9703ccb98ea87c6f4f327", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622797, "uuid": "afee10bd-0811-44c0-b4af-7ae0e8073679", "comment": "Malware payload", "value": "fb23a362114d48dc755f50afbaa42a360ad2698b698664638b160b97508536312fa9d85b42fabe9a3dfe5226a05c0bf0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622797, "uuid": "f6db0d5b-6a8d-4bbd-88f6-c517e3232f6b", "value": "B083028C3538C1DF37BE6A04A29C887BBD09D9B53504395EC489655FAD49EAA0C9F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622797, "uuid": "961d6c7e-c403-4658-a87c-db51d91d907b", "value": "1536:DG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+ph:DGEhrHJoEsBMG7qzkZQxOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622797, "uuid": "ec3f0b18-2cc3-4943-8a5b-026f63b74ecd", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622797, "uuid": "6fb140e8-9a91-4438-b7f4-83e15174c6e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622797, "uuid": "e08739a1-f9d8-4dd8-802a-3a70e3dffb4b", "value": "diagram-1656393462.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9006de97-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623786, "uuid": "5db2f7b9-2a51-43d0-8e0a-60424f35ec31", "comment": "Malware payload", "value": "9179ff0b88c427f649479ff241240d24", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623786, "uuid": "9ee5e9fa-67a0-4831-827d-04599c4a29da", "comment": "Malware payload", "value": "1cc291154f67e4d8cbf76a188a3e09044de30bd3cf085d015b45d33d653afd75", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623786, "uuid": "308dc96e-f717-438e-a790-90cb1ba81384", "comment": "Malware payload", "value": "e0c259756f050e7dd94997697a9e2988d16afddf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623786, "uuid": "d61fc9a5-4980-4721-a7e3-6c55a3396aba", "comment": "Malware payload", "value": "7aa1ab0a8a78515dcb3161386d5fc7e2ae95816951239dd40adf8c5c2a0b3b5e118aa5bf4d7740c5b5a1ffa2f26ad929", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623786, "uuid": "43b669d8-a6fa-43a0-91ee-d6fd0ad747b6", "value": "E883028C3538C1DF37BD6A08A39C887BBD09E5B93504385EC489655F9D86FEB485F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623786, "uuid": "2e1aa4ed-8eff-4d00-8a26-763c6608153c", "value": "1536:2G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOds+RKYFxQ3d+ptNN:2GEhrHJoEsBMG7qzkLQxOqNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623786, "uuid": "e8a7524b-3c0b-4d7f-9024-4fc42ede2006", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623786, "uuid": "86f427bf-2483-46c2-b31a-ba681496d0ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623786, "uuid": "ce425cff-c041-4374-90b8-64c6baebbc0e", "value": "diagram-408899976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92cd807-a869-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645813, "uuid": "c2a899e6-5c74-40b4-9e83-e09154941af7", "comment": "Malware payload (Dridex)", "value": "d764b85a627528d71bf0558d14d0cef0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645813, "uuid": "6c28d138-5b4e-466b-ac27-10b4bcd88a21", "comment": "Malware payload (Dridex)", "value": "1cc34895a213f4375fd6468ff5449dc992dd3f993468622ffe832ef83ef0b276", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645813, "uuid": "5a0d889e-9150-459f-b1ec-37540cc87cfd", "comment": "Malware payload (Dridex)", "value": "ab146a9762d552ddb3d52dcd5a749a183472799c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645813, "uuid": "382e483a-2e2c-4202-9267-a97947d88afa", "comment": "Malware payload (Dridex)", "value": "12461cfe675dd3f5ff88df1b0a5188f7ee1cf73f164b57e426c52d0b7d96d878afa725161d8e57c0fb1e651b4d224e1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645813, "uuid": "f92c9b5e-c065-4f78-9fdf-3bf596d1734c", "value": "F3F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645813, "uuid": "20e2d1d9-a03d-49cf-be93-adca826c00be", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645813, "uuid": "31b866a4-302a-459d-9e82-aff3e674da95", "value": "3072:L78CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYOZwd:snClX8WZ7/HrRCADTR0VlIZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645813, "uuid": "d8921aec-a85e-40d7-927e-b13c24be3534", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645813, "uuid": "bfc1c30a-a070-49be-8485-e1727cb4d900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645813, "uuid": "f6616155-dfd3-48c5-808a-960d07b2e1b2", "value": "d764b85a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19da3c8f-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640767, "uuid": "a255eb56-6a0f-476d-9fb9-7723282ebe1d", "comment": "Malware payload (Quakbot)", "value": "903b078de4256530447129c8e3d062bd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640767, "uuid": "bed80675-20f9-4b4e-b3e7-37ee97569141", "comment": "Malware payload (Quakbot)", "value": "1cc75bb64890a6a3d08ea2e5a9a6ff8eeb896e6574b04bde27959cc42b0251d9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640767, "uuid": "d3625c27-1c5d-403c-80da-7d91972bea3d", "comment": "Malware payload (Quakbot)", "value": "fc302c29c6d27d30b41fd8a5b2343345812036f7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640767, "uuid": "8a724508-24ff-49f0-a004-a583bf7b428f", "comment": "Malware payload (Quakbot)", "value": "d8c9fefbf670a372f200bab5de92649ccb214c4d230ea2836792d72aac02b926a2106d61244aa4351e37c54bb71ccd01", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640767, "uuid": "8a8c8f52-d032-4ce8-837f-1a05704fe6ec", "value": "9A947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640767, "uuid": "85cf92a4-14ed-429b-9286-f9ed3befec21", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640767, "uuid": "6135342b-e965-4ade-a2c6-7a6d84cac6c2", "value": "6144:1yPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm4:5Twr03pdf8vhhOKJET5By4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640767, "uuid": "dd3d7bb2-d5f9-4fa1-8b23-3a165942a5ad", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640767, "uuid": "fc0e74cf-ca20-4ea0-90f9-07687bc69ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640767, "uuid": "bd7789fb-d6ef-403f-ab04-8b06bd9da228", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5815ccd5-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619397, "uuid": "34da16b9-f0ef-4b7f-a8b9-e255d50b8e67", "comment": "Malware payload", "value": "6ba25238846fdd977c96c4cb13c85300", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619397, "uuid": "2d66e286-ae3e-48d1-a892-5f347bf46adc", "comment": "Malware payload", "value": "1cce0cd56f7b32e2fd1e733beb3d32f2f844e826e82e06c7b9fba0d11d0423c6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619397, "uuid": "9d66d6d6-5a15-4429-a683-10f16c4b6521", "comment": "Malware payload", "value": "0849694f79855fb74984f8f510978f0321d2b492", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619397, "uuid": "57d3fad3-e99a-4949-965b-005b0778a4ff", "comment": "Malware payload", "value": "15267683e93014942e75d61fb6dc6267b8ca649f0b405b7bece61fd4d0dbd2568bf76601ee451eee071050b3d2c5e74a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619397, "uuid": "6b3ddea8-c969-45a7-b3c6-03a554e63006", "value": "D683027103AE8B5DB4CE8A3954E21ECF2F46F8B82D195892541604E4E32BC665F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619397, "uuid": "c1d262eb-57bf-4ffd-ba2f-9bc7f9940dc7", "value": "1536:iDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd1DsMrbsTmHvVRS3:iDAysJADlV378P3RPVJLd1DsMU0dRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619397, "uuid": "4925cb60-9fc4-4647-b7c4-649599bddfb5", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619397, "uuid": "b6801e97-aa23-4006-ae1e-860e8f9e1bbc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619397, "uuid": "4d5bf14a-4abf-492f-bc2d-912e2ef38b0b", "value": "catalog-1240984769.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31796658-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626204, "uuid": "66e95caa-5322-4ef7-8798-a01d98aa6e47", "comment": "Malware payload", "value": "6e2c5d1134334c96c4f8fa0d3ee645d7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626204, "uuid": "5d9cb47f-c84a-4dcd-92b4-b4e99260593e", "comment": "Malware payload", "value": "1cd1c311dbd0b67db426b2e8e12cae7a2556768e62f556b4f22e6d6d102b4126", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626204, "uuid": "237ca698-148b-4ac2-9ca2-cfcc2600394b", "comment": "Malware payload", "value": "e5be4a6c90f2fd5b61e77bb09773e315fe6011e3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626204, "uuid": "9b1fccea-de37-4189-8ed0-90f3670bc994", "comment": "Malware payload", "value": "195c61c54e58a7eae3b011b51bbaecac778daee5ce66b7d37afc62339a144a510ea9cd2ecad2a89c16a3ed3feaf1ffbb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626204, "uuid": "b1508674-a54a-4ab6-a9fd-331697f0af2b", "value": "3B83026443BE4A5DB84D4E29ACB20D4F3FA7B6743D0E6CF1B92D0485A2318561B34A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626204, "uuid": "bffa7292-7f9c-4000-bb41-1af99cc79798", "value": "1536:7DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmGDV:7DAysJADlV378P3RPVJLdBxpENh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626204, "uuid": "f726bf4d-a3f8-46fb-a6ab-553f4dd17f2f", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626204, "uuid": "fab5cb61-4118-4c6b-8cb9-5e867f50ad1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626204, "uuid": "f8a70665-fbda-4562-8797-e71bcb6aa80b", "value": "statistic-2042714764.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9360d4-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640770, "uuid": "ce16759c-580a-47f6-991a-286abff9336c", "comment": "Malware payload (Quakbot)", "value": "bdb00cb0d4d9e17cee0237ef0e050621", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640770, "uuid": "86939282-f206-4534-a679-329fd663e760", "comment": "Malware payload (Quakbot)", "value": "1ce125ca470e70f68198d25ca3bec415de776b9f4b429722367b069f02ded018", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640770, "uuid": "02eb4f97-c157-4c12-97e2-6a2ba2736b19", "comment": "Malware payload (Quakbot)", "value": "aa0dc8b424e4496112539b65baf179579d253dcd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640770, "uuid": "19b3f645-e69b-443a-b0d2-a64860f299f4", "comment": "Malware payload (Quakbot)", "value": "f1ee4a1a0c953d6c74da2ec48a23ba09b3dc654f3234a290eb0f7c8907e7c796e15bb958e4495afe544810fe0106057b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640770, "uuid": "fc4451e4-1a44-43a4-94fa-99b71b906412", "value": "65949E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640770, "uuid": "eaf5c67d-b306-4952-9489-4e3a9cf972ec", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640770, "uuid": "392a4f4e-b862-4823-a6be-7d2a70fb6768", "value": "6144:6VWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWram:TFNmLKSVpJbPT+4xrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640770, "uuid": "64dfa288-bd7e-4b02-b4a5-df7b16a69097", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640770, "uuid": "03bcc986-f41c-4bbf-ab94-e827bf7bd882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640770, "uuid": "4d3921c2-d2b3-4628-94e6-facd6f2a6a67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c596887f-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623876, "uuid": "ce18abf7-fb9d-4873-a553-7e653bfa9379", "comment": "Malware payload", "value": "dde7726cd8a7726e5b19857352fb854a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623876, "uuid": "0c98db7e-c5b4-4eb0-b185-f15cbcfae409", "comment": "Malware payload", "value": "1ceb9f38e4c1ce05ce6f4301dd63d682882f70029c759a2f177136bc52e66abc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623876, "uuid": "5e881601-5c5b-431d-acc2-cdec4e367a3b", "comment": "Malware payload", "value": "5cec1c3966be47f2b5be1699e4f535eb6258bf62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623876, "uuid": "edb299f6-978a-497e-b325-4cfc96746a77", "comment": "Malware payload", "value": "74c956d0894bb1d6c7cb6d007097f7b3901a7ccbb7e1cd375df581b72fd03c2a24467b69d47163cd3d9a12977c32a069", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623876, "uuid": "bf065f72-da31-4123-b579-0527a3675710", "value": "2383028C753DC5DF7ABE2A0991DC887E740EE8B43108154ED8C86A6F9E4BFE71867460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623876, "uuid": "a5a77118-7147-4bcb-8e79-47f127ba7430", "value": "1536:ZG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt0KkApVr6wo+Rx9n:ZGEhrHJoEsBMG7qzkqxApxT9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623876, "uuid": "f663a35f-ec5d-41f4-b5cd-7bd2e1b97d9d", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623876, "uuid": "58cb8b49-16f7-479e-9236-e13538f74bce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623876, "uuid": "123471e5-c54b-492d-8648-1f6311e36523", "value": "diagram-473171915.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefd07ed-a81e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1619613530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613530, "uuid": "001fdf3d-cdcb-4dba-86ed-4fd639c38d24", "comment": "Malware payload (Matiex)", "value": "a93593f29a42b78d8463cb897e4502fc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613530, "uuid": "da81114d-7c11-4cd0-b402-bf488cb773ab", "comment": "Malware payload (Matiex)", "value": "1cf16af6389c86aad615052d3e888c7b67692eb1deae5eae18114502f56770bf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613530, "uuid": "eea6cb24-742a-4b94-99ad-f3400b84f080", "comment": "Malware payload (Matiex)", "value": "d253c8362ac8cb87230e9a51018e96ad10eb5ac2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619613530, "uuid": "72d84f22-a04a-4081-89ab-851738485d12", "comment": "Malware payload (Matiex)", "value": "6a985171d55f2512e7828bcd1d40dde2e4a9e88292701e9538e695e5ec1246cfef58220621bfc2ae94af5e9729a3c8fd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619613530, "uuid": "415421f7-77f7-41cb-9cc2-9951b8ae0392", "value": "F2712AA4A1743820EE2D5557DE37F85C06E27B4586CB44A8B2DDFD854B2E3315C07982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619613530, "uuid": "f9af2997-53db-40ce-801d-11f4745f91d5", "value": "96:IH0Q/2CErJDIcU7RzAwbST0H4uCsi1ZFRkWFB+f:IH0Q/GD7U7RzxE1ZFZ+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619613530, "uuid": "17b34f0a-dbf3-4f59-bca1-e101a3d193bb", "value": 3689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619613530, "uuid": "4102935f-995c-4abf-bc0c-24cdaa0a888c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619613530, "uuid": "5f05398a-616b-41a5-b643-12146fc136f2", "value": "GTRFQ-21-2332-1079-STRUCTURAL STEEL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2e0f57-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640773, "uuid": "febd5b1d-851e-4c86-86e3-e87f7b5ada44", "comment": "Malware payload", "value": "8450972cb4dda468f83724beaa042fbb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640773, "uuid": "1c943713-85c9-467a-85ab-7c1b231902f7", "comment": "Malware payload", "value": "1cf4c8e2393a29f8ff26d68fd6f96f06cccb8a242e04fde8b9fb8081d836490f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640773, "uuid": "4ccd0f3c-6293-4a93-8470-ecedbb2248de", "comment": "Malware payload", "value": "624ac4cc912e503863b05075d662504e9791c7e8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640773, "uuid": "49b125f9-d9a4-4398-bda4-04b445e72d5e", "comment": "Malware payload", "value": "3c4f32121912f04c14d638227e942c32c8837f488c8e564d3ad571f14d99442c45e51ef6fab46b2a2948ad29a3baab82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640773, "uuid": "b2865861-7875-400b-8cf3-8307ad36a05a", "value": "E0948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640773, "uuid": "1fe2286c-89b9-49f0-8db5-c019e6db653d", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640773, "uuid": "ac6b5346-2347-4b88-bebe-16f86ca83929", "value": "6144:FWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmF:FWrsTwr03pdf8vhhOKJETlByF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640773, "uuid": "12b260de-0040-4f08-a8ba-2cab8383c2a7", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640773, "uuid": "81c04c4b-3ad6-49a6-b655-72289b1b15af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640773, "uuid": "e0db42e0-3551-480e-9ec8-12343c2938dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee55a531-a85b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639835, "uuid": "8cfcbe1e-eaaa-42ac-a2af-09e28b420042", "comment": "Malware payload (Dridex)", "value": "82a36bae7e3ae88e2084f8342f22f109", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639835, "uuid": "3fd02c4b-f21c-4ace-a13d-628dda0a1a0f", "comment": "Malware payload (Dridex)", "value": "1cfca65f1873684b8e5978e9fec154ece1742c5b52b01356458a83c12d922b83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639835, "uuid": "7b48d075-b90b-4e4e-8bbb-5c99b995bc83", "comment": "Malware payload (Dridex)", "value": "0760dcc7bd9c3b6c91c334f3d2b913c131384a21", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639835, "uuid": "1278031c-97bc-4c87-aa06-480edfa6ad9a", "comment": "Malware payload (Dridex)", "value": "0656dba1fd08c5d77827ad6892650559387b0fa51d89d1e03001145907e60ac2b159f78170eb76539f77542244299a60", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639835, "uuid": "7f725cb6-8f5a-4b32-835e-cbc685954be7", "value": "AAF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639835, "uuid": "7debcb5f-1a1c-4d5f-8b41-481d7ba2f028", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639835, "uuid": "858871de-8418-40f6-b268-4ff1d8a4887f", "value": "3072:xxT2d85tleLD51fC5AHYEoefukoTFMpGmjn8D:yy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639835, "uuid": "4f05d06d-ef72-47f9-b6a9-3834e55cef95", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639835, "uuid": "c9f04bb9-264f-425a-a440-b0506c1a7e53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639835, "uuid": "e354d2d2-32b8-4dd5-8ab2-467330446712", "value": "82a36bae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9330a1ca-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624221, "uuid": "da131055-9788-4f2b-a7aa-2a4688d73191", "comment": "Malware payload", "value": "cd49f847a29ff122acd938d0cd2b74d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624221, "uuid": "6e4fc654-417d-4834-92aa-34467423734c", "comment": "Malware payload", "value": "1d1c6b07acd18b3f679ae22f7eff05562629f2be941005f43c3c9d4f2a1f9323", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624221, "uuid": "2bf1d359-6618-4b41-ac6a-cbe7b6e7bbf2", "comment": "Malware payload", "value": "7e241d576330a75ddf5e5e801ded6d9dd1609455", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624221, "uuid": "9f20d2c0-ef9b-4a0a-b213-0bf4fe5a5f25", "comment": "Malware payload", "value": "6d3724374f6ded506a1044525c75a692c2abd8716d43b986f5aaaae8e5f28efbfc449c7d34b10c52db3cf120db21df62", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624221, "uuid": "5b58cf09-a109-40b9-85af-88b2147b94ab", "value": "7183028C3538C1DF36BD6A08A3DC887BB909E5B93504385EC489655FAD86FEB485F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624221, "uuid": "99492b0f-a752-4302-b9a2-33aa32542579", "value": "1536:9G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttOds+RKYFxQ3d+pJN6:9GEhrHJoEsBMG7qzkLQxOaN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624221, "uuid": "e6530053-b608-4767-b885-bb94bdfb23b7", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624221, "uuid": "2962716c-8d17-43ec-8838-b67023723b12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624221, "uuid": "0843aef8-a94e-488b-9172-d4ada33160f5", "value": "diagram-621713402.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0ee1a3-a843-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619629446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619629446, "uuid": "5c730ba3-e8ca-41ae-88ee-18d7f704c9b3", "comment": "Malware payload", "value": "4b85eaf6b3c63094626cef64968a50a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619629446, "uuid": "b0503c7c-d1bd-4e87-8a67-9b82091dacbd", "comment": "Malware payload", "value": "1d1f3d96aa9d697e11bceac99712701bc807afcf068f579c24dcf456e3cd0e21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619629446, "uuid": "e33bf7e4-f0b6-4a38-8783-b18226d3305d", "comment": "Malware payload", "value": "076c735bc030a48154e36a99b41bdf807f2aa856", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619629446, "uuid": "7eda9b0c-d6a0-4687-b5de-ba75a541786d", "comment": "Malware payload", "value": "273c4bebd29836cc1b8d20d7fd1fd60ee21c35aac6e78e5259ae706917f09ed4ecc17cd8072ccd4ecb9be07901e5835e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619629446, "uuid": "77c763b6-fce8-4ac9-9712-bdfd7915e256", "value": "9112AF5994035EAC3916A3338C7357D8FD196D73CA12AE5BAC87215A0903FC1B58092F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619629446, "uuid": "e8d998a0-430f-43ab-905f-c59517cc425b", "value": "192:0aq7dF/MDMo8mMv6UV+yYrSAFSP3wDNMEuACE1LCsc24Cvqe8iZjQluUd:0aqxF/mLm+nmAF1NMEurmL3BZjQl7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619629446, "uuid": "68cf393c-f8cf-4bab-9ef8-0c5175198474", "value": 9064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619629446, "uuid": "3f29e9b1-e62e-4762-9416-bb436be3d006", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619629446, "uuid": "4739eb61-a17c-45fc-9bac-d104c3399f3a", "value": "4b85eaf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3834c905-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626645, "uuid": "e663a842-e9e3-4b29-b38b-c7b0db53b46a", "comment": "Malware payload", "value": "222b8e8583da8ae4a1a5c327bdc78cf4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626645, "uuid": "ee61556d-6279-4c7b-bcb1-fb89cba64b6b", "comment": "Malware payload", "value": "1d25257dedffc601ff9460f570f7a1c50b8c9ab5f9cd714f96e3afd147b84fdd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626645, "uuid": "b5a75a41-2413-40d2-af91-e49247cba149", "comment": "Malware payload", "value": "04722a0e344755a98f83523d530456251f925997", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626645, "uuid": "23af3ce3-6032-404a-bdf3-2c12a193dd22", "comment": "Malware payload", "value": "97025ef24eb54ab13478847fd02ceb503a67645d966178d1f99fb24e6bd1b7cc0216abcee2215b7b31271f65e031c682", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626645, "uuid": "2afb1286-9258-44f1-ab87-d691f8d4900f", "value": "0E8302A453BE4A5DB98D4E2CACA20D4F3F67B6743D0E58F1B92D0481A2318561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626645, "uuid": "69f1d8a5-bcd8-4acb-84f1-8a09d9cac178", "value": "1536:eDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmrI:eDAysJADlV378P3RPVJLdBxpEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626645, "uuid": "fabd40f6-73cf-46f5-b52b-b9449429ce06", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626645, "uuid": "3db1be73-e77b-4774-8205-e89b88530d88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626645, "uuid": "b6224ca5-1d64-468c-9033-bd62a5160e09", "value": "statistic-400514943.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8a0cd7-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646303, "uuid": "228f2e2a-0f2e-4a71-a23b-3dfdbaa0bf69", "comment": "Malware payload (Dridex)", "value": "8bf2e32aa8105cf72cde0ee04691ea05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646303, "uuid": "4bc5acb5-bf6f-4a85-b423-9c9ebe383f4a", "comment": "Malware payload (Dridex)", "value": "1d2f0abc70be9cb7ede8d041dcabaa8fc95879c150589f5a9b69e1454c154e4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646303, "uuid": "bd1de7c1-32d6-4717-87da-9038b76abb2f", "comment": "Malware payload (Dridex)", "value": "c76373fa6f30944b672894a96a65e5dadb4f349e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646303, "uuid": "b30480a7-2b20-4ca0-b4a0-d6edae1574eb", "comment": "Malware payload (Dridex)", "value": "282072c12a69791c561e6b204d03365bd362ba8ad1ae0b3bd7732a609a3b9a6c3cdb8e2ebfdde95defa488bf8a1baf51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646303, "uuid": "904524d5-0d27-4b73-995d-c4f79c789c6a", "value": "DDF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646303, "uuid": "c39fa5bd-19d3-478e-83fb-40dc2b899f55", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646303, "uuid": "85329eff-6b13-43fd-950c-855865c723c4", "value": "3072:rnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:Wy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646303, "uuid": "f9d57708-2adc-4ec4-a8e3-e9246618b859", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646303, "uuid": "1cccafe7-20ce-46e7-a291-09c757dc6605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646303, "uuid": "9bc79171-4673-4d8b-ac6c-07208062e103", "value": "8bf2e32a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ba95be-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619532, "uuid": "0a93c9e5-ea0a-4661-9ce4-cbcbbdbce287", "comment": "Malware payload", "value": "57e7bbd5a6fcd13dfee72aea9edf4fed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619532, "uuid": "a1290007-bc66-49b9-ab1b-e1387431c4b6", "comment": "Malware payload", "value": "1d38e7fd1b1be969c8356b0b901d9669922523a9728d1d6fb3cb91e227d67f0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619532, "uuid": "3cf4e9dc-7066-4b53-bde1-33e5c6da7e3c", "comment": "Malware payload", "value": "09ce0eef3db23c49be4a9a8703047111bd7abfe9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619532, "uuid": "9c5adba5-47d5-483e-b5b6-8d7194c9b3e7", "comment": "Malware payload", "value": "1c1830a66033080829157ced3243e4607b03ea29fe99ca2d4db1ad32c8095aa8de912c73e10e727b2fe1ada636bae7a2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619532, "uuid": "4b6b0ed5-0a78-4a17-8cf9-196e3cea77cd", "value": "E683129063FE8B6DB4CD8E2855F20DCB1E6AF574290C6DE166AE04A4D2364412F38D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619532, "uuid": "7f54dc4d-3b3f-4749-bdef-d3be16f6eaf8", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd0eJx9awOnleWI1Hl:zDAysJADlV378P3RPVJLd0eJLOnleJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619532, "uuid": "23ebc337-c984-4f3c-8ec9-7a6117de23d8", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619532, "uuid": "99eb9246-c16c-471b-8591-d739d64c44a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619532, "uuid": "8acceb75-6735-4345-9079-38464cbecaeb", "value": "catalog-1330376067.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f045dac-a828-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619617744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617744, "uuid": "5cd4ac17-6a18-4785-b67b-04213f2d6e7c", "comment": "Malware payload (AgentTesla)", "value": "b8b2d764c7cb5cd8d53cfe8adf5cd21d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617744, "uuid": "f4aefbc4-c359-4a26-9f85-0f51855a9fe5", "comment": "Malware payload (AgentTesla)", "value": "1d4b81ebf8bf53797d2a87ed7571f787263079e797885e7dc905fa5b3e50079f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617744, "uuid": "890d2140-8777-4e35-8096-9a03bec58d63", "comment": "Malware payload (AgentTesla)", "value": "f9ea371d2d164cf51a5771cc9d53f74960f5de7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619617744, "uuid": "941158a5-8d41-4029-989c-a9f1cedd0f15", "comment": "Malware payload (AgentTesla)", "value": "e1715244b7f9f881d1dd6059503f81b4d4bf9ab574a5a1b2c16692f42329dadb86830b30168dee799d0e10fd7cf71f74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619617744, "uuid": "46ef9615-0005-4132-b6ba-bd4225e2c184", "value": "DCD4CF20E294DEA5E42F13B9D976A0F02773BD4AD526CA0F399A3D1D797334180E2B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619617744, "uuid": "f9f8318e-ea06-4f5a-9434-a672c604cd1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619617744, "uuid": "3afb1d8a-7082-4edf-90cc-d7ee7e258fb5", "value": "12288:0Zb5Vz4OHNHnTVaI4IUd9jOvNUOJXMMj3mgNdYeVb8m:sbTM0hnsRld9jOXj9dT8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619617744, "uuid": "7a46a8f1-d122-4e30-b787-a342c69d0e17", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619617744, "uuid": "f8872c46-f489-49a0-9538-8089505d0e63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619617744, "uuid": "ee83ae9f-958d-4d5c-a221-8b03eea24c2b", "value": "swift_copy00988w4638589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc82f980-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625203, "uuid": "d1ce2edd-d744-4527-9155-be1b84ab70e4", "comment": "Malware payload", "value": "b557d83e2a892cc0d75704fa7a78929a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625203, "uuid": "b4de663b-fff8-4d5e-865d-cd5abda08572", "comment": "Malware payload", "value": "1d528fd0920b363aa55dd4830e6dc94c2c5067d210682eb444649874be359341", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625203, "uuid": "4e0e9abe-b8f8-49dd-a70d-fc1df243c14b", "comment": "Malware payload", "value": "0c08fe0f38d42b6c918f0e13faf6bc6c592d466c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625203, "uuid": "2013eccf-f885-48ef-ad31-6ce7ee5bc34d", "comment": "Malware payload", "value": "abe2359435ca388ec7d80d5fc82fd65cba3018e37f3008a29124ecd6825c6e17686221b6284725926f73bc864b08fd99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625203, "uuid": "810c3801-49e4-4b6c-9880-15ead26543dd", "value": "138302A453BE4A4DB98D4E29ACB20D4F3F66B6743D0E58F1B92D0485A331C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625203, "uuid": "49b8cfac-8ff6-4df6-b419-7ddf36c2216d", "value": "1536:iDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd+hsMnSEwJPTmD:iDAysJADlV378P3RPVJLdQxpEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625203, "uuid": "376343e8-3a9e-45d1-8807-e6bf7d9870c9", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625203, "uuid": "69077f58-1c30-4515-a62d-15eaefc0afb6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625203, "uuid": "ee21c186-eaa3-4ee2-b805-627e570fe008", "value": "statistic-130287871.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9463540-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647048, "uuid": "51e8c74e-9178-493b-8812-e661cd99591e", "comment": "Malware payload (Dridex)", "value": "326a1bc7ff9c34839dc2abd4849c70e6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647048, "uuid": "5fe6cbda-d31b-4730-b084-8a8a5ac481a2", "comment": "Malware payload (Dridex)", "value": "1d60d8064bebb92ec8d1e308eb8f2e5198c226b8d36fd9583dfd35174d5d8d27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647048, "uuid": "df7d5651-7a6f-4ccf-bf52-edae1935c565", "comment": "Malware payload (Dridex)", "value": "f7822306fa19637d581287b8d898c6428935adef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647048, "uuid": "bcddb6f6-438b-4440-a3fa-b75f27161b40", "comment": "Malware payload (Dridex)", "value": "f05e51988e98c5dd27573aaf9fd7efb6ad540c715dc2c6849a744e3d4ba21f8f1327fd145cac7eb3e5f5a3bc84544eaf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647048, "uuid": "ddfc553f-e00e-4591-b80b-0557cbcbe7d7", "value": "49F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647048, "uuid": "0dd02453-c865-4ec6-99ad-8fc4ddfd55ce", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647048, "uuid": "3ccede97-de18-4a91-9e6f-bd5de2aa0cd3", "value": "3072:8HT2d85tleLD51fC5AHYEoefukoTFMpGmj68D:Xy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647048, "uuid": "57118322-9845-4001-8d6d-a172be1662f0", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647048, "uuid": "50a3b301-f2e5-4694-b2a1-3b383042454c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647048, "uuid": "ca557c71-aa61-498a-ae63-0acc95f01d23", "value": "326a1bc7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d438e5-a7d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619582463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619582463, "uuid": "e177117c-7cd8-4704-9dc8-dbba3ca2ad25", "comment": "Malware payload (Dridex)", "value": "7e907ac6188c425d25224de967293441", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619582463, "uuid": "4a348663-eea6-4b8f-a450-10585aa6188d", "comment": "Malware payload (Dridex)", "value": "1d67a62765e34916a9c06f207d2d3183b1f916ba627af1c83ebb2d33cb9ffe8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619582463, "uuid": "ff776a16-f03d-4f9e-a716-0330949a08cc", "comment": "Malware payload (Dridex)", "value": "b8b080a580e4df5a426d57ff78ce1f59b4804390", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619582463, "uuid": "8da21495-78b7-457c-98b9-6367e0f8cdfb", "comment": "Malware payload (Dridex)", "value": "1ee62e752fca9385203d997b727881a37d5a93bdc805455cf3726aae9cb2bae1ddfbccec19b23e6982d77f5bceb3e4b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619582463, "uuid": "3f79c741-c0f8-4fe9-be8c-036ac63f82f4", "value": "BFF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619582463, "uuid": "d4d13b9c-191a-4730-9241-2fc066016610", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619582463, "uuid": "236ea128-2b54-4e83-9b64-49af4830bd77", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619582463, "uuid": "3363f506-69e7-4d7b-957b-2c43b1ddbabb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619582463, "uuid": "30163ff0-3145-48a9-bd7b-cb4abb6ac447", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619582463, "uuid": "955dabc3-5321-42b4-930f-499636696564", "value": "7e907ac6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5aa5d7-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625904, "uuid": "de9793b7-9b9d-437d-b188-cd3f808f4609", "comment": "Malware payload", "value": "cbf23894b2476ef1d6189f297bfac027", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625904, "uuid": "6493e25a-46e3-4b47-acd9-84a3a8a00879", "comment": "Malware payload", "value": "1d7101eabf7689ed32f9d29e0069f9928fc5ccdd2edaff2b976dd10a7b834b02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625904, "uuid": "f64df7ee-1fd1-49f3-a043-9c2b28e7c587", "comment": "Malware payload", "value": "26c3c65b4e9342f0056c471eba157cd994bee370", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625904, "uuid": "ff5e50f7-5e97-4799-ae33-00ff5533b108", "comment": "Malware payload", "value": "0072cd9d75df3cc498934019e3f6255540f6789dd77a9ebbe4d0a74af2dfb6ad9e1561b3de00e31278c463679d27fb49", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625904, "uuid": "a77a57d9-baf1-493c-b93b-e2733870f5fd", "value": "9783026563BA8599F4CE9E1D5CA20D8F3F56B5742C1EE8B1353E0186E226C530F3453E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625904, "uuid": "1597a88c-26f2-4668-8a9b-14513cd1a50a", "value": "1536:sDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdChET/WkOsB19M2ME:sDAysJADlV378P3RPVJLd0ELb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625904, "uuid": "2b6a00bc-80d6-4c80-a566-285e1006f069", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625904, "uuid": "b3cc685a-d491-4001-aeba-b8e38c29428c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625904, "uuid": "3fd56923-ea9c-4fd6-8c83-a970dadc3532", "value": "statistic-1840434081.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0b2cc8-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624905, "uuid": "969ebe19-fa36-4f7e-bb2c-22d0031fd187", "comment": "Malware payload", "value": "787ea3928dec4e1f6315d546a6e4a9e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624905, "uuid": "30d620c1-d4b3-432b-b93f-f22c81369471", "comment": "Malware payload", "value": "1d7a3fa7fb4dd4ad469bc7770e7c8ef25a4ce877e7af0e4ca5fbb497c7c6ecc4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624905, "uuid": "9b297913-509d-4b8e-84ff-b525973cd431", "comment": "Malware payload", "value": "1e4c4629865bc1dc565d1a6d527185f21a51ce75", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624905, "uuid": "b47a4061-c736-45d1-899d-a6a35cf264f8", "comment": "Malware payload", "value": "1fbb8ef58685df8fa97a6f2419951f2e7e9806f3e48a60b5595f497af97ee5f5d452be99a651b7a06a7c120e57d75d39", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624905, "uuid": "2dd13799-b7ea-40f6-aaf6-03627992fada", "value": "B683021403FA8959F48E9E3DACE20DCB3F9AFAB43D1A58E1962E046563298510B3453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624905, "uuid": "43ce5a6e-4be8-4386-8849-71bab8b8ea05", "value": "1536:3DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdAgKXsth8wBUs3:3DAysJADlV378P3RPVJLd+eh8wBV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624905, "uuid": "c7b116e0-b0ee-44df-9036-50072a39ea42", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624905, "uuid": "278a7e3b-274f-4658-8ac0-b83c10597809", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624905, "uuid": "cbfcba70-d6ac-47d2-9df8-dc681fed27b8", "value": "statistic-1086457833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702c6df6-a861-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619642201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642201, "uuid": "d0326ad8-5cd8-4476-8aef-88c3f90990d7", "comment": "Malware payload (Dridex)", "value": "d305a4e963e48b905eba31ae24a5a890", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642201, "uuid": "87861cfd-58f2-4945-99ed-eacab2242f13", "comment": "Malware payload (Dridex)", "value": "1d7b8709307bf6b22d0944022b4c69b383e961a92d20cf56c7ba95ef9c6acae0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642201, "uuid": "04350b37-d14d-4e2e-aa8f-9930c65faa02", "comment": "Malware payload (Dridex)", "value": "b9120616d543c64efb67750c3c4a8a2ef3bf5023", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619642201, "uuid": "91621f39-6aca-4a1b-8175-4e4a783010f6", "comment": "Malware payload (Dridex)", "value": "b5bc606e6ca3976b135e433d5b4dbc16610575d143eff634e25893ffc6c1cadde527e8b75f898d8a6080caf5b60bcb24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642201, "uuid": "46ef04a2-f9c0-462f-aeb0-f91b6bffe5cc", "value": "E8F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642201, "uuid": "11bbffe4-569d-41b2-ada3-cb9ac854b53f", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642201, "uuid": "6e9543ab-a72f-4450-a4f5-06aaf623d162", "value": "3072:t38CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYVZwd:6nClX8WZ7/HrRCADTR0VlvZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619642201, "uuid": "9bbc419e-ff65-42e2-b08d-7623992f1918", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619642201, "uuid": "a086a7a3-66b0-4af2-8391-2672cb20d794", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619642201, "uuid": "66d504d5-cf53-4c45-9231-34c122d8c768", "value": "d305a4e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1c69c7-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621283, "uuid": "c5810eaf-33f7-4f64-a9b3-98e9a7ab2cc5", "comment": "Malware payload", "value": "634210162fd9b328dac42dc17aca28ac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621283, "uuid": "3d9d34e1-baea-4349-a30a-ccc716e35826", "comment": "Malware payload", "value": "1d7f6e396878a368e82a25d6a9397ebe2d147f2920cb7eda9637466062898657", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621283, "uuid": "f8f0992e-c9b0-430a-9811-607c3cc86c6a", "comment": "Malware payload", "value": "bb2e03fcd757d79e1237826a558f94e44e9651c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621283, "uuid": "118e52d1-d585-477f-8593-a5830ef523f2", "comment": "Malware payload", "value": "ea43a9035f2aeecea14543cc71802ebab5a551124e7afc6771902846bedb1ae269c81b7e848bd8e5eb500a926cca7ecb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621283, "uuid": "905acd70-8bdb-41bf-bc2e-5c79436b7f64", "value": "4C83025443B94B5EB4CE8A2C6CD31E8F3B9BE5781A1F69E1381D04A1B1278650B28D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621283, "uuid": "e9fafcb6-ecba-4d37-b5f4-585b06b313a1", "value": "1536:oDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdoN4WV8BAY6Hv7Re:oDAysJADlV378P3RPVJLdK8BXsjRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621283, "uuid": "ab24b96a-054e-4277-bb83-242f4a76b962", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621283, "uuid": "7ff7ae55-28e5-452f-9dbd-71e606814669", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621283, "uuid": "787c23ca-6dc0-4bcc-83ae-027d85452305", "value": "catalog-528359306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8587c37-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645409, "uuid": "5c0e7d53-41e3-4ec1-9a9b-0ca5ae0dda45", "comment": "Malware payload (Dridex)", "value": "137ebbfa5ab81262849817353387ee1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645409, "uuid": "87d76d35-384f-47af-994e-7135b53ea4ea", "comment": "Malware payload (Dridex)", "value": "1d90c3b901a70f5f703602d7354df875f70980e88568244e416946a1c8481e6a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645409, "uuid": "92f5a5fc-db2c-4524-88f3-dfdf381e5eb2", "comment": "Malware payload (Dridex)", "value": "b3237d7327e553fc1018b0e3c8eba6643e67739b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645409, "uuid": "4f5ce306-d235-4def-91b1-c824ae261153", "comment": "Malware payload (Dridex)", "value": "02ebda4a1bb2568cb6e1b6e54253347b6b0acb33970cec8cffc77ecd9840498a4ae872b1f91b7b2d4f327d833b3405c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645409, "uuid": "589a4042-b3f3-44dc-8d23-e289fd144e0a", "value": "02F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645409, "uuid": "8463ee5b-08d7-47c9-97f5-be1a3ea53b1b", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645409, "uuid": "459ca76a-cc15-4054-8c83-ea3500fc9320", "value": "3072:C58CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYbZwd:nnClX8WZ7/HrRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645409, "uuid": "960de5ef-6df5-4b96-b690-2cd9997325de", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645409, "uuid": "8223265f-d055-42f1-a834-fb2f62c3ced3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645409, "uuid": "ff6287ab-ddee-44c3-96a5-1a11632d614e", "value": "137ebbfa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee7653e-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640776, "uuid": "d8327d9f-f251-4861-a1ef-96209d588dc1", "comment": "Malware payload", "value": "fd20ec7c5643ccb9d17a8fb62601cfa6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640776, "uuid": "312f6a46-1168-4f48-a12f-2a7bcc8d16f2", "comment": "Malware payload", "value": "1da20fc8fb18e13218f32278bc11e5e891d44b6e67be2d6b8e36b55dd7e31d31", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640776, "uuid": "e526a3b9-3146-4821-8ca9-5155c57be9b9", "comment": "Malware payload", "value": "c03d477c2c12815ff3b7f49be8c3c12552ab243a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640776, "uuid": "c8dccb39-98d1-4932-81a9-39b65102f63a", "comment": "Malware payload", "value": "915dba040b736b2186d654d9d1944e7b2566777539a3c69da91dca2b4e708c4d2233a984db744561fc615d844e5b4d7e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640776, "uuid": "073de97e-7328-4e5a-88a5-c274561901c0", "value": "7E947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640776, "uuid": "97b2b5cf-7aad-46c6-950f-651993cef7cd", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640776, "uuid": "27c60c55-b90e-4659-a288-6f69324c8e10", "value": "6144:PyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAm8:PTwr03pdf8vhhOKJET5By8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640776, "uuid": "d6f80840-a84f-416a-a1e6-f7a64b6a8eef", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640776, "uuid": "f612dab4-97f6-4cfc-bd79-3b624b9de55e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640776, "uuid": "7382ffc7-24af-4325-a424-ded818e1ae19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209e2380-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640779, "uuid": "a2a1bfe3-7cef-4db9-8113-7582d86b8446", "comment": "Malware payload (Quakbot)", "value": "eb9044b6d14323f5783a72284e2119a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640779, "uuid": "4d592652-7e00-4e50-adfa-9495ee30c20e", "comment": "Malware payload (Quakbot)", "value": "1dab028184e341be343979f9d83f91415049f9404ba6e4cbe7277720ba72b98e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640779, "uuid": "9620fb7b-7fcb-44c3-8fce-e0b9188b5f2d", "comment": "Malware payload (Quakbot)", "value": "fff8f7de32d9d0a8f3f30764be0a5701a5c76d13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640779, "uuid": "6055b04c-83cc-4425-b231-9ce251cc113b", "comment": "Malware payload (Quakbot)", "value": "16739e3dc0e950c39c3337f52a7918ad6f45d6176d0b73015014cc5882a320f4dd1e009994f771c76d493de0bcdcdf37", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640779, "uuid": "01515050-15cd-46e5-bc09-762ade45b377", "value": "D9947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640779, "uuid": "0f1557ed-876b-4cdf-8664-ffe122994ae4", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640779, "uuid": "8208cc1c-ef56-489c-bab6-b1a3c0f537af", "value": "6144:6yPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmP:+Twr03pdf8vhhOKJET5ByP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640779, "uuid": "98be79ba-b955-4d40-9cde-e0771a82e4ed", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640779, "uuid": "9155db51-7f65-4869-8f22-10a74e1d9674", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640779, "uuid": "bf0916f0-b53e-4cfe-9ec6-4e1ebf089643", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830be60c-a7ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1619593270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593270, "uuid": "3d392267-aa83-42f6-ac0b-fc0b172fa041", "comment": "Malware payload (NetWire)", "value": "6c9e4dd7daab40a2b40db3d13279ee2e", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593270, "uuid": "76407854-8222-40d2-bb3b-2bb9c07494e9", "comment": "Malware payload (NetWire)", "value": "1dcddce0408092a22c015e183e463020a7231e1f5ca47e71acad4ddcfb0f2385", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593270, "uuid": "0eb55d69-9ec5-4844-9d0b-2d34a1ee3b4b", "comment": "Malware payload (NetWire)", "value": "879eaa020afb3906709ffd8efe9dfcdd23399227", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593270, "uuid": "e90da20d-1025-4ea9-8261-a006eb9532f7", "comment": "Malware payload (NetWire)", "value": "1209e00139a17af2fe238146f1f7b6a78c03853c21dea2e92aef349256b1aceebb4610580bfa8ee526032c10c7003a32", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593270, "uuid": "e5090890-2dc2-496e-9b9b-0ac68c9c3803", "value": "1A95AE12FA46D1F6CB6E0539068DB27F4565BD294B21A9F3A7C83B4FA5311C02DBC18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593270, "uuid": "d6b13ca6-bdd7-4396-8398-af6ac2db0735", "value": "0b6ce52b13559fc7fd638da8d5c538c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593270, "uuid": "72c7ef40-576d-4ce4-acdc-8fb4291d0ffc", "value": "49152:nhtORUwc166NlRq7vLSUtwFODMQSOXzZ2WFeZkP9aiK+d/:nhtORUB166NHq7vLZ0mQoNzFeZkP9aiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619593270, "uuid": "e6d88b7f-3c61-4439-93e3-c4d18f9ae77a", "value": 2019840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619593270, "uuid": "e7007b9d-973c-4e9b-ac42-be327d506126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593270, "uuid": "2d2d8973-2aff-46ea-b2de-6143cff8b6f8", "value": "6c9e4dd7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2232aa00-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619640781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640781, "uuid": "baeb6f21-0a6b-4697-af92-871af0375c2b", "comment": "Malware payload (Quakbot)", "value": "b0813ebd96b1024463c8cc508ef9ce83", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640781, "uuid": "30708eae-4bd6-4f0a-87c6-6549ee35a318", "comment": "Malware payload (Quakbot)", "value": "1dd94ada0e05a01a8b20db32924c6a5d2a3891b7ebf33f2ffbbed0b1a044734b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640781, "uuid": "bf198586-e690-4e8d-a264-acd6b02cb850", "comment": "Malware payload (Quakbot)", "value": "a78702f9ed4f4e4c516fc6c836e6274fa668278b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640781, "uuid": "420b8535-138d-4003-bd88-e032f19ca0c1", "comment": "Malware payload (Quakbot)", "value": "85226580d5248b698242d191bc5debe90a640a82e5b8ca68fc6a203da76906c71f33a47697aa6c151f46d09717ce509e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640781, "uuid": "15ce1332-95e5-42b8-908d-09adf40b0286", "value": "7B948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640781, "uuid": "fb7848a3-5959-4a5b-80d5-d9b03a60bf49", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640781, "uuid": "17192864-56bd-4c20-b963-7a2ad313f6c3", "value": "6144:8WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmw:8WrsTwr03pdf8vhhOKJETlByw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640781, "uuid": "f2bef121-8a22-41e0-ac46-c5ada776a118", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640781, "uuid": "8749d1e2-7765-4ee4-8899-af4b7e4976bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640781, "uuid": "f60b5653-e327-4d40-93d6-8515cff37074", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cebe3a-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640784, "uuid": "d48a6bb2-7b41-403c-b261-4a9f0cf1a8b6", "comment": "Malware payload", "value": "91c271e29d1cf52632731b8a949a12d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640784, "uuid": "0231a1c9-0ea5-4281-be96-dd17ab544822", "comment": "Malware payload", "value": "1df11091a86de70d5295cccea5b630a804d92d40237d941916a71e2fb7e5ce26", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640784, "uuid": "d0cdc4fe-c6b8-48d5-9613-a2002f9da974", "comment": "Malware payload", "value": "6a1352959f96145ca0ea2bc1115693bf9b9963d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640784, "uuid": "38078c3e-15d4-4d1f-89c9-438a508b01a2", "comment": "Malware payload", "value": "f78420e7cf1e71b3dcbeac9b6d4bce08d3e7066fc225a0fbdddf576a948d79b7efb55e9b5438ba2595cfb9014ae88090", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640784, "uuid": "3eec0158-c2dd-49fe-a30b-eb8254b84158", "value": "E0948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640784, "uuid": "f039c5f6-6527-4942-a516-dabbce590c87", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640784, "uuid": "6cbe21c1-11ad-45f3-8524-a3cc2e7e0805", "value": "6144:oWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmL:oWrsTwr03pdf8vhhOKJETlByL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640784, "uuid": "f58cefec-0577-44e4-8797-9ff56d7e525a", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640784, "uuid": "750e1a2d-cca0-468f-9498-a0fc9a675666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640784, "uuid": "be586129-6d65-4469-94dc-4ffb0c240040", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fff170-a876-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619651436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651436, "uuid": "08a86b97-3a1a-4b13-a69b-85f27be843e1", "comment": "Malware payload", "value": "b1a6fc744dc340e216c16811524cd510", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651436, "uuid": "12e6a060-f37b-45c8-bb2e-fb9feda5141a", "comment": "Malware payload", "value": "1df627dab5349caa21b7796747299cc00d5def8f1f9af2bfd93d61a74455151e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651436, "uuid": "76d15920-0041-4bb5-954c-61bf6cbe7ebc", "comment": "Malware payload", "value": "b83e88d7db1e0e45db7de52c1331e6a58fd15a92", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651436, "uuid": "f53126e1-a980-46f4-874d-7a9897a68f6d", "comment": "Malware payload", "value": "b3f7a80ad49f99a03ac3493c82dbc629958a8490c6d8dc9f647ef0e217f340750fabfadbc0f857d24ae94d2a2c9250c7", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651436, "uuid": "a7dcb961-6e97-4028-924e-fcf2ee74934c", "value": "3E147C007194C075D67F027904789B52553EBD358BB59ECBB7E84DAE1EB82C2AB30B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651436, "uuid": "f7f574ec-9a90-4d80-aff7-aac84773791e", "value": "4dbccdd7e362a7dcc3e5aa6643f7bf66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651436, "uuid": "bdfa7090-7fbc-4ce1-aa6a-28923c49791e", "value": "3072:bO9QjXZ0xuXCwmzTzqzxkcZbUszz+6rL64fXBUEbo:a9XuEUxkGzzm4feOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619651436, "uuid": "4efecbfb-4a85-4042-b5a5-8920f9ef44e2", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619651436, "uuid": "0dcf06d5-a1cd-4a3b-883e-c168c2aec75f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651436, "uuid": "d132a211-76bd-4861-841c-86256be50d1d", "value": "1df627dab5349caa21b7796747299cc00d5def8f1f9af2bfd93d61a74455151e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2b54be-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623945, "uuid": "0cb51640-ed99-4b73-96fd-755ba66580be", "comment": "Malware payload", "value": "d8e648aabd3a69416a299fd9ae21c207", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623945, "uuid": "7be2f04d-7f8a-479b-9db0-9ab796d4cbca", "comment": "Malware payload", "value": "1e000edd7f29e33c557dd12b18a6252def9cccaa8cbf26b741e9b1e5a2471828", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623945, "uuid": "97ba8539-8aa2-46bf-a257-11e98c5f0587", "comment": "Malware payload", "value": "5494abb1f83d48d452defa546ade246de57a0efb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623945, "uuid": "17c2a83a-5ffb-40a1-954f-6c53f5c05816", "comment": "Malware payload", "value": "72cf946c5fe134d33b8af8032781faddb67a5e0b7571299ae07bafcbf8426cb8ee527e5ea23f4b3c38c48de2eee40bf9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623945, "uuid": "a5fee712-3c0f-4828-b368-59e33b66e84b", "value": "8A8302D9203DC6DF716CAA09B56C893EBD4D6CB52004689ED4D4366EAC4DEFB9C93430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623945, "uuid": "0ce60162-6dc0-4d19-b1a4-1c5e9076c3db", "value": "1536:TG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttwI5EzJKE9LfFSp7mcE:TGEhrHJoEsBMG7qzkCI5AB5gpScE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623945, "uuid": "3622639f-cb5b-4216-a469-966c13a0c15c", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623945, "uuid": "e1f3c18e-5cfb-4d4b-a246-ea730380ee5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623945, "uuid": "116cdf63-dccb-4803-9a5f-577ce457c997", "value": "diagram-519710390.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcf69b5-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619648, "uuid": "1aba00ce-3519-4a44-bc7d-392fa74e607f", "comment": "Malware payload", "value": "d84b27588a3e303816be05737f603904", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619648, "uuid": "2090d45b-11da-46b3-bf17-42b573cc30cd", "comment": "Malware payload", "value": "1e1672a5eb83a7e560fe8db4273a17c3c46c0c6c5dafa2f197ef842db2a054c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619648, "uuid": "ec136b4b-690c-4fe6-a5a4-66d063aa7a8c", "comment": "Malware payload", "value": "3853a96d64cbdd7a8d478e8c89114edacfc017f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619648, "uuid": "913798ad-514a-49ce-9073-f68bc2e34534", "comment": "Malware payload", "value": "7a0d768df589ef4c0b84c8cac55f79bb845b55c20cd31e72acfcb4d8e8c5c57128b24dffd824bcc7648c299434463370", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619648, "uuid": "d475f877-bae1-4254-b4d9-4219e156a20f", "value": "D683021013B54A4CB9CE9F295CE31ACF2FA7F9B8160D68F575280894E722C474B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619648, "uuid": "00ff47a3-5161-4520-9a7c-008d8e351ac1", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpZP9+jAJjn:zDAysJADlV378P3RPVJLdlDpH+jAJjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619648, "uuid": "ba63dc73-5042-4c5e-ad7c-5af0119a35ca", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619648, "uuid": "9899be83-4e9e-4677-8c68-0d1ac3d35866", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619648, "uuid": "4c47e0d1-cc2d-4ec6-b0ac-1f88f66d3dd7", "value": "catalog-1405389906.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c55e072-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625498, "uuid": "c1f4466f-b6b0-4da1-bc3f-e23a6676b68b", "comment": "Malware payload", "value": "44325d9def20fb9b7b966619ec533d5e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625498, "uuid": "2f0a4193-78f3-4fa7-b22e-658f38b88303", "comment": "Malware payload", "value": "1e1ee3bca50169eb70bbc3c14d74797d98c2705a465dc8dd29a07838b65d03b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625498, "uuid": "d0045c67-1961-481e-927f-4c882ae1838a", "comment": "Malware payload", "value": "c699076979e7f70d7651e587ba9da0f3b0b348e3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625498, "uuid": "6de9cb9e-b2d6-4e65-94c3-caae59ca27a7", "comment": "Malware payload", "value": "f347cfa169ea32f6a7414a00ba2e2473378ece59b368260a630b5906098c9bbebb21af5b4a51c3890924a1626bb3ea25", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625498, "uuid": "725df7db-6009-4139-a50c-9e0285f41cee", "value": "5883021563B9C998F58D9E2D4CE30D8F3F43A9782C1ED5F26229019AE227C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625498, "uuid": "e64cd3e7-c894-4e9a-8344-cd90dd117d64", "value": "1536:cDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdpPqXT/WkO0B19M2f:cDAysJADlV378P3RPVJLdVqXjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625498, "uuid": "a3ed36df-b339-41dd-8820-25c69060c2cc", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625498, "uuid": "67feef15-bff3-4759-9670-17c59bc64944", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625498, "uuid": "93e615d8-5b5f-4d3b-a161-0437d3d49bfc", "value": "statistic-1544173426.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25757d44-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640787, "uuid": "0cbe8b50-6452-439f-9e06-fb2a1a750455", "comment": "Malware payload", "value": "0d0854442649d7cd704e557db9a643cb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640787, "uuid": "e017b454-a547-44a5-8d7f-96154bd3f373", "comment": "Malware payload", "value": "1e27597cee15003ebd7f4dbe4e7d151665351d53db872dc3c28073c6ec6f52c5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640787, "uuid": "dbaed01f-1db6-4d13-975c-dcc3c40e2b8f", "comment": "Malware payload", "value": "e49bca1799d04a009bd2a3edf4e86a084919b0b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640787, "uuid": "03dcccd8-3ac0-4c8e-b1bb-ccbee9aff095", "comment": "Malware payload", "value": "7aa65cbeff2af224f05dd9cfd19e6b9b882fbd0a2a945350b36a957e08ea11fb6478559d32073ef4aa6d15815a9dd816", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640787, "uuid": "877fb5bd-3574-4675-bfbf-8c1af25c62ba", "value": "1C948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640787, "uuid": "7f5018e5-c386-4569-978a-a79b9c40e6a6", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640787, "uuid": "8fa03a35-12a8-4984-bef9-813318d047aa", "value": "6144:CWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmb:CWrsTwr03pdf8vhhOKJETlByb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640787, "uuid": "5354877f-a009-41e9-b37e-a034075fa23d", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640787, "uuid": "333815d3-026e-4fb1-9e5c-01b04b0b5315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640787, "uuid": "9ca3c834-0f9a-41ef-81af-4285646ea335", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698e8c3d-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621144, "uuid": "974baef1-1dda-444e-adab-f622ae6e96cd", "comment": "Malware payload", "value": "fc426f2f48c82f3b49528d226cf59c7d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621144, "uuid": "b6b6a6fb-72d8-4b84-a764-93ecce1d1643", "comment": "Malware payload", "value": "1e30c091d57e9711897bb1c48087b00df846f0e30a5cc48ce3554c315fa0657d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621144, "uuid": "78eb52cf-772e-4e5d-a33a-0c26ea50f551", "comment": "Malware payload", "value": "368252638958ba6695c517a034b2d4ec9d12e103", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621144, "uuid": "6e2ec5b6-b064-41b7-b28b-e2ee8762894f", "comment": "Malware payload", "value": "83c63b7cb42ca4c9ffd4d627fc51f32e3a16878ecae2590e9f9a96f4507f71391b14e292f5337c40cc3dd14666f78088", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621144, "uuid": "43165622-fd3c-49f8-8238-afa4707b209a", "value": "E883025443B94B5EB4CE892C6CD31E8F3B9BE5781A2F69E1381D00A1B1278650B28D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621144, "uuid": "652680e2-09e6-4924-b728-f4e0521e9faf", "value": "1536:hDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdoN4WV8BAY6Hv7RO:hDAysJADlV378P3RPVJLdK8BXsjRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621144, "uuid": "313ff48c-26f7-49b1-8565-355bd5aecf7f", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621144, "uuid": "7ee56d9b-0968-492c-9e04-af1d175eabf8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621144, "uuid": "a4163666-c136-4eab-925b-ab08227d3d80", "value": "catalog-432379611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6710a7b2-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625865, "uuid": "6f8afc14-94d6-4fd6-b2ca-7b138b2e779c", "comment": "Malware payload", "value": "c5a96136c101716ec5cedd3dca3f5172", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625865, "uuid": "325292ab-a72e-41a4-95fe-22eeaf91aa06", "comment": "Malware payload", "value": "1e3d58e70da1293de6bda85620ed9d4ff000b503bc1965be7d13de7f6458e3df", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625865, "uuid": "d27c8b77-311c-409c-8d8a-3a5f4f8ea150", "comment": "Malware payload", "value": "431b333368de6ece243178f3c04c4924f43369fa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625865, "uuid": "3f4d5de0-173b-4d6d-a8f2-46652e3bc8b2", "comment": "Malware payload", "value": "3386a685b71c814496bb4b2b062bba8032da70bfcfff65ec501c7b7fc53aba0cf27c96e7096f50184997632e65113ba9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625865, "uuid": "d6ed406a-2cc1-4081-89b5-f009347bca1d", "value": "B683025013BB8EADB58DC93948E20DCF2F56B6B02D5B5DF2B13D0494F1238961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625865, "uuid": "cd12ef7f-60ed-4ad2-9d91-06e87565d6d5", "value": "1536:LDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdkZn7a6:LDAysJADlV378P3RPVJLdw7a6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625865, "uuid": "55f1b3a1-fd65-4299-b6d0-757b5881ae29", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625865, "uuid": "8d2efa51-fc9d-43dc-baef-71916d2d37cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625865, "uuid": "e0d8ced4-924e-4a90-b2bf-120c839b5a2e", "value": "statistic-1811965569.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976b5bd7-a808-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619604041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604041, "uuid": "e2304726-1541-434c-9444-e6165d834afa", "comment": "Malware payload (Dridex)", "value": "3cce870459d24abc611769c195c3f744", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604041, "uuid": "9ee275d4-4a7d-46c4-80d0-1d027ff8717e", "comment": "Malware payload (Dridex)", "value": "1e4a15507c40163dffe7b30c7780cf125e70781992e48f4ab063fa0fa78642c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604041, "uuid": "eafc18a5-e7db-44ff-992b-f99b3da298e2", "comment": "Malware payload (Dridex)", "value": "2b5e78788b4d27ac9796604d3b51bb228841f325", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619604041, "uuid": "93058d6e-84b8-4f87-8625-b6bb96c6f8f9", "comment": "Malware payload (Dridex)", "value": "072e98749cd9ce2431d088ef451f70c0bc32ae20982b4baf705710aa262513825d26db715ccb8e40c797705787b44cec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604041, "uuid": "13b89acf-88ec-4352-a649-4b78d7228fa4", "value": "59F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604041, "uuid": "dbc38b07-9681-4904-b181-0e58239df713", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604041, "uuid": "e435d2e0-1860-45cc-94ee-0243e857a44c", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619604041, "uuid": "02ac6815-ffb4-4e36-b09e-f10eef6c1c1f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619604041, "uuid": "e3bc3a19-857e-4c62-986e-36db7e97c0e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619604041, "uuid": "9f4d7162-88ab-4aff-b88c-1ec3f34dc4b4", "value": "3cce8704_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300fe030-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626202, "uuid": "35686dc4-500e-4c68-901c-84c15ad7046d", "comment": "Malware payload", "value": "a2b96c26b74547ba1b46f2be88c436a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626202, "uuid": "b2f09ef3-d002-4651-bb4b-7f2c37feb4fc", "comment": "Malware payload", "value": "1e5cf6aae40b98f9eab1e8d01ecdb1aec43706774f702ba3c0a9141c4c956851", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626202, "uuid": "5c094abe-af69-4b49-aa72-9e1565746bc9", "comment": "Malware payload", "value": "c9e7edf1494e74b19f6bd04bb0a5cbb2440a60be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626202, "uuid": "a119d604-fbd7-44cf-be72-fc4f4daa6c2c", "comment": "Malware payload", "value": "da9d0bc193c45f648863ea4758d0e9a7658e3284de8336a2fe7fa04b3b299df6d389570a8feefccbf03fd6219a3ed19a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626202, "uuid": "54407a73-eb48-46d3-b2f8-082108319f8c", "value": "8A83026563BA8558F4CEAA1C48A30D8F3F52A5782C1DE9B5762A01D6E226C534F3093F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626202, "uuid": "8858d470-f257-4f4b-96a6-c63413f1f7a4", "value": "1536:uDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdihET/WkOsB19M2b:uDAysJADlV378P3RPVJLdUELD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626202, "uuid": "4cefd5c3-ef5c-4d15-92a7-390f2d617382", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626202, "uuid": "685f30e2-e06a-404f-bb26-51165e8bde9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626202, "uuid": "3746780c-388f-4e38-b0e1-603a458250db", "value": "statistic-2037866722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a1d818-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620306, "uuid": "7fb74d82-72aa-4b57-99ac-b32b603f5d7c", "comment": "Malware payload", "value": "c900c015db3b4ed128687e14b9d888c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620306, "uuid": "c8efabac-2e69-4346-b852-d66c1876894a", "comment": "Malware payload", "value": "1e86ff751e319500641c527220bc8330717a4094037fe1039329143a9496a554", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620306, "uuid": "006aae31-e67f-4e01-aaa2-6b90d2703c85", "comment": "Malware payload", "value": "9227c6b60ec559c4d0c62b1c14583da21ceca5c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620306, "uuid": "68b811ea-4158-437a-9927-49820090d209", "comment": "Malware payload", "value": "164441fd8043a149a77b31818f6e6227c31edb7605a5320da807fd21f4d731d236bb94e7fc44e863089ad8153d81bdf2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620306, "uuid": "4eac2d20-4ddc-4d0a-a043-49b2aa193199", "value": "3E83027103AE8B1D74CE5A3958D22ECF2F97E8B82D195992541504E4E32BC629B2887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620306, "uuid": "0a775bb4-2c79-40d9-8cc5-3d2eb0af24c7", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVRD:zDAysJADlV378P3RPVJLdtDsMU0dRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620306, "uuid": "91044bdc-132e-4bcc-9cd4-404a769b2aaf", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620306, "uuid": "8cc4f74f-4272-49ff-88ce-61f19305d8f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620306, "uuid": "8a53425e-9df2-4331-b43f-96a1b131aaac", "value": "catalog-1908027258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd290a95-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647081, "uuid": "2986ca11-f837-4e6d-aead-b0366e155b4e", "comment": "Malware payload (Dridex)", "value": "e5ac54de83c29ba1e4eb88008494b99c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647081, "uuid": "557fb354-cf59-4a6c-8614-279d2656235a", "comment": "Malware payload (Dridex)", "value": "1e92fa1b8333b807a909f91d9570e2cef8eccdcb7866eafebcc6db1b45922ed7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647081, "uuid": "50df1f17-bba1-40d3-81fd-dfd4f174f6d0", "comment": "Malware payload (Dridex)", "value": "d34527762c6b940828350c9dddb0b1195151f23b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647081, "uuid": "5c75ff47-2329-41f0-800b-c289838fd9c5", "comment": "Malware payload (Dridex)", "value": "93cf30c493ebe2904a5e48950036acbefab59065462a79f8eadd714226f661170c42411bbb80910d86a3ae3dd5c88549", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647081, "uuid": "8fa8b34b-c25c-419e-9dad-6e57118b2686", "value": "CDF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647081, "uuid": "524227e2-2dfd-43a3-90de-7c685ef71b4e", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647081, "uuid": "bbbf80ec-f9d3-4c0f-b7be-5777ec6500a4", "value": "3072:OHT2d85tleLD51fC5AHYEoefukoTFMpGmj68D:1y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647081, "uuid": "6230bd26-7aa1-458b-9dff-25246f23153f", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647081, "uuid": "ed6bff78-9193-4815-8ec3-7247888c1302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647081, "uuid": "fd2c8201-9836-42b8-a4b7-74fe4eb9a09e", "value": "e5ac54de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391f8f1b-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622352, "uuid": "29c09fab-5efa-49a2-97a9-d65c929631d0", "comment": "Malware payload", "value": "d5f9ec6bba49e2d6aac8fdc9ea108642", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622352, "uuid": "e2193b1a-ccb5-4bc9-927c-098644b7be07", "comment": "Malware payload", "value": "1eba2dcf03d3914617231e461754206baec3c088475504759e4b97889ae1d0d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622352, "uuid": "a1444b71-3051-4f8e-9291-fa48fb1692f0", "comment": "Malware payload", "value": "212abc8f8f9108ec5aeca3ced87961a416b6ccde", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622352, "uuid": "fe93dffd-f976-4015-b191-a4eace317cc8", "comment": "Malware payload", "value": "f3e2d22e031f566303fc84dfe45482943c20f54f0ff8e4f4da5a28cf65b440e0c5a0f493c10297af70afb02eac9ed75d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622352, "uuid": "ff2be4d9-82ae-4496-a4a6-b29ec1db92a6", "value": "8183028DA53DCAEFB1AD2F09A3CDC53FB61EEC613004248DD8C466A65D49AD30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622352, "uuid": "d584bbb6-7c83-47d3-a140-cd49105b538b", "value": "1536:CG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5de6n6475e0NEnP6N:CGEhrHJoEsBMG7qzkZ4q/NEns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622352, "uuid": "d5b0c67e-23a2-458a-b9ec-b32c23f17e19", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622352, "uuid": "d4984397-68d7-41d7-9170-58800d05b2d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622352, "uuid": "d5b09612-96e1-4164-9ad1-9a8874274611", "value": "diagram-1319479792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7ab634-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622597, "uuid": "172168a9-2451-4f63-89ec-309b28f7f0a9", "comment": "Malware payload", "value": "b0030d1c469bc3e5108e0654c2a3ddce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622597, "uuid": "4d05a86a-2961-48b1-927f-8665a4ea3f95", "comment": "Malware payload", "value": "1eccc75fb581ec04cc90b6bd318f1d506196b5c30602c686e80553e005831185", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622597, "uuid": "d53903c0-06c0-42da-b124-7f4d5a56a410", "comment": "Malware payload", "value": "e123b5759241d7ce9eb413718a23c0efc9af249b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622597, "uuid": "39ca90df-a9d4-4895-a9ed-6c5fa21c279a", "comment": "Malware payload", "value": "47b50f2dd0bef104a74e623ed5a06eb52c665e7d7a09c3e3ab105f4b952018662e6942b9277044c3076a70459837016a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622597, "uuid": "514c63d6-0cf0-4816-a7ca-cfff48c7be71", "value": "2683028D653DCAEFB1AD2F09A3CDC53FB61EED613048248DD8C466A65D49AD30CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622597, "uuid": "32cbf62a-4e28-4f83-b36e-470a96e6dca7", "value": "1536:CsG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttje6n6475e0NEnP6b/:/GEhrHJoEsBMG7qzk94q/NEns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622597, "uuid": "8cecbcda-9748-4703-abed-5029b0b6de76", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622597, "uuid": "6e0158d3-6c1f-4fea-a6a4-e33b49da6a74", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622597, "uuid": "9530b6a1-ff34-43d3-9b7a-2c6b73645be6", "value": "diagram-149259532.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc332f0-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621339, "uuid": "b414ff2c-8766-418c-8fa0-0081a0d9be0b", "comment": "Malware payload", "value": "b5a51ec4f5683e2b26ece8ff69cfa8fe", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621339, "uuid": "c6714d3a-9644-461c-abb5-2ec12d7e123a", "comment": "Malware payload", "value": "1edc0ad554da014c6b2977490e61d10a7da65bba91e1e47c52265c1866bfd521", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621339, "uuid": "e7fcdc7f-b025-417f-aba3-f02d8cc729c1", "comment": "Malware payload", "value": "0b75132f0e2e5d940a9141b83003eb7f5f36c520", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621339, "uuid": "ad1d8d43-8f9c-4f9b-8ef3-a442e0074217", "comment": "Malware payload", "value": "c803975a056fc85c4e760a23a5b921fe52010478e1301859d2456f7d108944e9ff073f63d0c0b9ad142703363804f7c4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621339, "uuid": "5036520b-af45-4bb7-bbe9-e0456b137580", "value": "0783125453B94A4EB8CE8E196CE31E8F379AB8F41A2B55D1795D00E1B2334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621339, "uuid": "5fa90024-a0b5-436a-bd30-7beadc49f5d9", "value": "1536:LDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdeIkGV8BAY0w21:LDAysJADlV378P3RPVJLdz8BXg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621339, "uuid": "3ad40a14-4841-4118-887b-28c32dc6e68a", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621339, "uuid": "73f5630c-d7ae-4c53-ba15-bffe62c7693e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621339, "uuid": "494ac762-38a8-42f5-b336-cfbd4d085f76", "value": "catalog-581431574.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ef0681-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625356, "uuid": "31288cd8-99f8-4c0a-a4f0-233f7be1e550", "comment": "Malware payload", "value": "46cd1cf888c634f414fd63ce50ca810d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625356, "uuid": "c648782b-e55c-4491-ae97-e70085326369", "comment": "Malware payload", "value": "1eed9532bd89e2c667e0e4e87259fd381c5dcb5664d38ef4b376ea3bd44e662a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625356, "uuid": "8665ac68-5175-456f-b3a1-44f787fdd3d2", "comment": "Malware payload", "value": "dd74662dcdd7c195c6e17ac2ec6778fd42846b2d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625356, "uuid": "6333762a-3512-4dfd-bb12-686f905ef2a5", "comment": "Malware payload", "value": "d7340074bd9d8bf7af63b1dd02726ffda10cb4910d3db96a7b4b112f76e3e31b6960c8737a5aab02a0dd3a3877426c31", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625356, "uuid": "f43cfd95-49b4-4950-a518-bb5104ffdb00", "value": "4B83021403FB8519F48E9D3DACE20D8B3F9AF6F43D0A58E1966E0455B72ACA11B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625356, "uuid": "5ad3e57d-deaa-4a69-b5ce-97147b110733", "value": "1536:QDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdTgKXsth8wBMtKs:QDAysJADlV378P3RPVJLddeh8wBMss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625356, "uuid": "d70be28c-3f13-48ed-8793-6ef075f9aacc", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625356, "uuid": "ce24acbf-531a-4cc7-be24-4823c8939e81", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625356, "uuid": "860edf33-52c3-4d42-a9c9-0b8af0b26c95", "value": "statistic-1434234475.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27143b89-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640790, "uuid": "18f1a018-b206-4988-b94c-7b2fdc9e155e", "comment": "Malware payload", "value": "7b167b91a2c2e506289204ca896caade", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640790, "uuid": "cc3f2e50-a7a8-4d59-9382-a6d4945e792a", "comment": "Malware payload", "value": "1f054f936ff55d63b397e0c65c483545ff25fb4525f7ca9789fa2b78a5cc49c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640790, "uuid": "9864ed36-8cb3-4e89-83cd-e048f67feb96", "comment": "Malware payload", "value": "4da0f6e91ad6d1537a2dc6a275784b840df7fc4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640790, "uuid": "cd956bd5-822e-4669-b7f9-cf336347ab57", "comment": "Malware payload", "value": "3bbedf42b73c4aa806cb54f26a427c5f924f2d9647846a803a83f5b58ad018c2b1e411a96788b54b7e904b3447e43941", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640790, "uuid": "2bf8804e-47e9-4225-80f0-e34d55a865b3", "value": "94948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640790, "uuid": "7232cc0c-6863-40c0-ab7c-132087c0524e", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640790, "uuid": "9faac3ed-18d8-4fc7-b15a-78aa00948a94", "value": "6144:zWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmw:zWrsTwr03pdf8vhhOKJETlByw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640790, "uuid": "63fdfc1c-734f-4d5f-86d9-742bd24e6963", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640790, "uuid": "33c06fa7-04ee-4b73-aea5-3028d600fb1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640790, "uuid": "b7c6c99c-85f1-4374-8732-facaf932edd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f492e393-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620089, "uuid": "e786460f-57fb-4435-b600-b37563d20f8c", "comment": "Malware payload", "value": "76c7ddfb3f1991f8ed2b2a4ad2409380", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620089, "uuid": "50d7195c-afb8-4726-9ae8-da81dd4ddced", "comment": "Malware payload", "value": "1f0dd21fff1735752041ce8a25079f98d4a13c8685bf0449397d8c85da2c0b80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620089, "uuid": "065e30d0-2b64-4d42-875f-e79afad2bb3c", "comment": "Malware payload", "value": "4f0037cbf7582f842d74d0d583210989e23d49ea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620089, "uuid": "cd4be230-ea10-4aec-a8bf-3784a4fc2571", "comment": "Malware payload", "value": "04720c2fcd1a4e0b96c3586bedef27843803d089cc500ab65eeff9d3fca852fa7c54796db54be7da3f61420eeb9c0b88", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620089, "uuid": "8df8e2f5-c121-45e4-b958-0b5d94a5548f", "value": "CA83027103AE8B5DB4CE5A3954E21E8F2F46F8B839095892541A04E4F32BC569F38D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620089, "uuid": "8ac112ca-1803-4f12-83b8-841af7c8a689", "value": "1536:yQDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd1DsMrbsTmHvVRco:BDAysJADlV378P3RPVJLd1DsMU0dRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620089, "uuid": "2dc786f3-705a-495c-a28a-4f09b3ef8dc2", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620089, "uuid": "2c32340c-32e9-44d1-b2c6-1434a3780c50", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620089, "uuid": "fbfa4f26-46a7-4331-ad17-a0426a083737", "value": "catalog-1755807126.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffbcd46-a86a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619645905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645905, "uuid": "8c7847b2-9aec-4973-bcc6-46e06015c054", "comment": "Malware payload", "value": "87d28990225d4297535c211d28a34690", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645905, "uuid": "59597b2c-0b3a-4bc8-b572-5b796772b11b", "comment": "Malware payload", "value": "1f108a10b866def65686fcb0e0c10612152288ea1f7a6158e5ada37f26d03265", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645905, "uuid": "0be2f8f8-cddd-4091-b8c4-088ae206da43", "comment": "Malware payload", "value": "3efc3021f506f72e06386d7374cb317a06fc3cee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645905, "uuid": "ad2ed647-fd32-4804-9f09-a042048f440f", "comment": "Malware payload", "value": "6f313b62dde141a37f2bb1b18e0876cb9127684037f5b277eed8be2478214ba133bbc5c5d8e5af0827a5e3f8fc8ad392", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645905, "uuid": "ca2cd186-cd62-414a-b9cd-74706284f092", "value": "760382E6B281DC16DA4907360DE7D6E72776BC615F57838B3289F31E1EB1AC08A02617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645905, "uuid": "17cb2fb4-83c2-4a75-bcf6-f9d3334e960f", "value": "768:yck3hOdsylKlgryzc4bNhZFGzE+cL2knAJ0OiCgpYOz7yi08DXn:Rk3hOdsylKlgryzc4bNhZFGzE+cL2knd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645905, "uuid": "111b0a49-5cef-4b39-a999-58d434ab51f4", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645905, "uuid": "2c218171-93f7-418c-a844-b03d0612adad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645905, "uuid": "91f2bd86-3b1b-426d-8fdd-536b28643f6f", "value": "87d28990_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e105bfc8-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619627, "uuid": "a7c9a884-91e3-406d-9932-43c403b49a3e", "comment": "Malware payload", "value": "2ef5a1b4db76bc33b98440eeaf17385a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619627, "uuid": "3b225b1b-66e3-4ac1-8219-dac3022d5d25", "comment": "Malware payload", "value": "1f152316cfcffd13597412b43d05e3706726d7533c589572dca78b56e2905bad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619627, "uuid": "fd41fa32-2b2b-4d57-bc1b-fd727af89891", "comment": "Malware payload", "value": "009318b5729978e7a2a5b4dadab879b236609029", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619627, "uuid": "3bd1ca02-3e24-4363-9958-d39b9213ced4", "comment": "Malware payload", "value": "b886c289fd195f8e2c8cef140f423f69a8e70a983ca56ab541fd02b52ce9a4ba65116fc7a24eff0aa3e6b5499ca1405b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619627, "uuid": "7cfc734a-eb8b-4ec2-bf4d-27f369451df7", "value": "AB83121023F68B4CB4CE5F2DACD21ECF3F97F8B8251D65B5612804A5E6268560B2057F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619627, "uuid": "d192bff6-284b-49b3-a960-a06c629392d5", "value": "1536:dDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdlDpEDP9+jAJutK:dDAysJADlV378P3RPVJLdlDps+jAJMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619627, "uuid": "16eb7a7f-55b2-4499-977d-8afb67daecdf", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619627, "uuid": "a2d9f356-8c07-4666-b63d-aa05e22ed458", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619627, "uuid": "7353d042-1117-4eea-9b06-c2b062a7221f", "value": "catalog-1389552151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6bb50d-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624347, "uuid": "511efda5-7cb8-40f1-aaa3-e8417ea48c88", "comment": "Malware payload", "value": "28829a34a5420bf52b5138cbed37a4b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624347, "uuid": "195b1fc8-52c1-4421-a2fd-af53554eeb92", "comment": "Malware payload", "value": "1f1693d61f7b7d8ecbd54a4c1c7c4238c1a87bce6abbd6104fe49ff266a5ddfc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624347, "uuid": "2b25900c-42c3-413c-be78-da8acb8212b3", "comment": "Malware payload", "value": "f1e597d3d3b4c6efaaef251bc25776f3831a1ebe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624347, "uuid": "ff6b9ca0-821c-4ddd-9002-d9ab2f6cf77a", "comment": "Malware payload", "value": "404fb3dfbf91601cec1628a603c77d2d2a3c7d24c68a0b22a556c99039cf37b32206d2200ff82c864d4a2e6fd585e8df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624347, "uuid": "490811b2-9bb6-4737-9245-50e29f983512", "value": "D683028C613DCAEFB1AD6F09A2DDC57FB51EFC623044248DC8C866A65D49AA70C67470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624347, "uuid": "4b72db3d-da96-442e-9aac-000747c89caa", "value": "1536:OsG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttle6n6475e0NEnP6Ji:bGEhrHJoEsBMG7qzkj4q/NEnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624347, "uuid": "13042898-9154-4662-93f0-9a1adaaad3e3", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624347, "uuid": "d199542a-91e3-473f-bfa8-f146694884d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624347, "uuid": "c1710e5c-f59c-4eff-9a36-0cff0b23a4f3", "value": "diagram-7113770.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b8eeb9-a7b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619568061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568061, "uuid": "25912784-a983-413f-8add-3c9010c8f138", "comment": "Malware payload (Dridex)", "value": "cdde72ea918432853aefb17a10ad0c05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568061, "uuid": "bfa2c06d-f84f-41c9-b68e-9bd302c3437b", "comment": "Malware payload (Dridex)", "value": "1f342afdb9839fce3082d4241f0d352ace54db814692566009d5d0baaeda8ec5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568061, "uuid": "8258fc26-db4b-4eff-94d8-d613f47edf4d", "comment": "Malware payload (Dridex)", "value": "64f4215033b651f61062353cf99f4503c8e131d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619568061, "uuid": "1803a064-66d5-4a88-b64c-deba7742f798", "comment": "Malware payload (Dridex)", "value": "b8d374f1c907d1983b831cf3fc215d40008e133d20513ba8e7b488e402ca24056b522d6c0f29ec4f5a024d2eec04b8c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568061, "uuid": "6ec85504-6805-4389-a33f-bfaf610a949e", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568061, "uuid": "a56ad708-b6a1-42b2-8354-e1983e0cb94a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568061, "uuid": "25b77e50-0fce-4e38-b102-5d3a71f34d2e", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619568061, "uuid": "c7fdba1f-e462-430d-93ca-a57a1ea0a5af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619568061, "uuid": "0f0c2d55-3b45-4c83-81e7-3880e323b5d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619568061, "uuid": "612a8310-80cc-44db-9b53-97f1fdb1db80", "value": "cdde72ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8199be0e-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619896, "uuid": "1b0d36de-ec71-4f7a-b7bf-85c8e0c7c9e3", "comment": "Malware payload", "value": "4b56af68ae089256384acb5b64df6492", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619896, "uuid": "770cc18f-cfd9-4598-9832-0fa095063fd7", "comment": "Malware payload", "value": "1f396930e26e271d00c21fd4a7248693839ab55f436fa7539740d503f51676ac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619896, "uuid": "669eac84-f295-4e8e-b571-45551da4219e", "comment": "Malware payload", "value": "9d1254e612c009057a811695032963add2f373bd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619896, "uuid": "e78fea05-de8b-4340-ab47-736606af7703", "comment": "Malware payload", "value": "6c2f407af52c5f6106bec8ccdfebe53d81d075d27066d4fd1d255cf929c3f8df3b08c0a48ac751549bfffcbec5c57bb2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619896, "uuid": "27d026c0-537a-4fa3-8532-dd59b528194d", "value": "A483125453B90A4E78CE8E196CE31E8F279AB8F41A2B55D1795D00E1B2338660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619896, "uuid": "10134e40-9f26-4b67-9993-909e07281a3a", "value": "1536:2DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdfIkGV8BAY0wy:2DAysJADlV378P3RPVJLdS8BX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619896, "uuid": "e5901780-7e04-4883-9c54-3104a047bc49", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619896, "uuid": "d882129d-7723-40df-9ecf-3664904d55a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619896, "uuid": "f9c1209a-4777-4191-a448-68945a6cb622", "value": "catalog-160878354.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1498f1-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626948, "uuid": "669c565a-5c1e-487a-b5c4-b6cc0045ac9b", "comment": "Malware payload", "value": "4edf3395d937f95bdcfbfb0a70ab8f98", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626948, "uuid": "b3c6d41c-d513-4f6c-aac3-b8135d915680", "comment": "Malware payload", "value": "1f3e7f73da67e65205fa9a1dc88a1c1a9f8ab594af048d0ac95e2ea2e2c90d0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626948, "uuid": "027caf4f-33b5-449c-94d2-2b15d1e61178", "comment": "Malware payload", "value": "a65260d4cc46ecebe0a668421617168c9fb9e372", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626948, "uuid": "2722da1b-b09b-42e6-ab76-5f0d3c084ccd", "comment": "Malware payload", "value": "b54acd3050a1514a320a351a66c8e736cb4697149c1860be065f9a97598029a52220761feb74da2def724fcff3dc6e1e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626948, "uuid": "63d7bdc7-8f9b-41e8-a926-b0890ef392f6", "value": "0B830220137A8A0975CF9D3C9CE31E8F3F66BAB4352E5DA3615905987636C420F3897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626948, "uuid": "405d5c89-9b3c-4846-bb75-0cf7b24014d0", "value": "1536:uDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd0Np7Ctdn77/Z:uDAysJADlV378P3RPVJLdep7mdnn/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626948, "uuid": "5c8356b5-8ad2-4dc1-a664-22d56e64e6f9", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626948, "uuid": "19abfc8c-c175-497a-ba68-833ffbd50e4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626948, "uuid": "85cca0a0-9489-490f-b996-5acba7ecee24", "value": "statistic-618667568.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d226e87-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624184, "uuid": "09775616-6193-4172-981e-26bd3b341406", "comment": "Malware payload", "value": "52a2d1d0276f6fd1ac287ef95ee95355", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624184, "uuid": "fa9d6386-9601-4971-a3fe-9c30c6e2297b", "comment": "Malware payload", "value": "1f67aee42f926563b1e36993b812932a3877c3505e4e5b2d0f9fb44ca2561f0c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624184, "uuid": "61a9d53c-b1b2-4555-9b17-513ba399e5cd", "comment": "Malware payload", "value": "df6639ca399c1ae8fa5bd6b65d03b62542ccf348", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624184, "uuid": "d15ba926-4cad-4ec6-819a-f5f6e3fc62eb", "comment": "Malware payload", "value": "25bed19d89702053dcddb226f9e83b3861c017428fb1215d9687b54c2ed82c57ccdc946378c2a954cacd353a4ed69173", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624184, "uuid": "153b5ec0-331f-45df-bf2c-4353dd8bd1bb", "value": "418302CC6238C9DF717D3E4AA6D8C43A790E98BD3040389DE5C066AF5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624184, "uuid": "7213776c-12af-4c63-9343-af2146a0bbb7", "value": "1536:fG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGr4:fGEhrHJoEsBMG7qzkEEVerr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624184, "uuid": "97381cf8-7bd4-455f-9f59-fadced77c217", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624184, "uuid": "ee57fc9d-6b4c-48b2-86df-6a701d336ea6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624184, "uuid": "dfc6e9f8-3af5-4027-beda-9a08b82e0658", "value": "diagram-589304755.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255d8cae-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621889, "uuid": "69b2824d-8e8c-4e2c-9279-39eedacd7b90", "comment": "Malware payload", "value": "560723d75f74242ba1482c6dfbc7a4ae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621889, "uuid": "08d927f2-d2e5-45f1-a811-42cffd1396af", "comment": "Malware payload", "value": "1f71e57ed75ca0e5f50e3a599375ed4af827e066725517ae4fa7d11316bec420", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621889, "uuid": "c180b26a-f935-4527-b7ea-b2febee8db28", "comment": "Malware payload", "value": "acd485d016c8ed6f5ebe41196f7fbcc94bee5eb6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621889, "uuid": "d847f828-af26-401c-844e-10e2957106e0", "comment": "Malware payload", "value": "ad5fcf15ad8ead846d6565410a1de34a6ff923b994a1087b36cbf66cec21b4743a6dd9924e005c48f4b3144221af279b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621889, "uuid": "e9e5e45e-c5ce-48f4-a1d7-40b968c035dc", "value": "A483027103AE8B1D74CE5A3958D22ECF2F87E8B42D195993551604E4E32BC629F3887E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621889, "uuid": "8a63f0cf-6ed4-4c60-8cb9-d36f154156c7", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVRB:4DAysJADlV378P3RPVJLdtDsMU0dRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621889, "uuid": "100c31cb-310e-46cc-8205-fbb2e48f7e74", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621889, "uuid": "efa07422-1b3b-43d7-be1b-395d897da887", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621889, "uuid": "d269084d-6abd-4b4a-a895-d421b671de8e", "value": "catalog-995092474.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546a0d0f-a868-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645161, "uuid": "a39e70fc-4693-4ad1-8409-fc86fd9c627e", "comment": "Malware payload (Dridex)", "value": "f350cc31e8067582a91bbf9390a8fa31", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645161, "uuid": "e2f0910d-96af-491d-ab0b-30b1a9547753", "comment": "Malware payload (Dridex)", "value": "1f73546508246f1af42e066db9d38680b96f9600be249ded35fcb8eac0209e56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645161, "uuid": "f0ffde30-423b-4338-8d26-a517d24d4d01", "comment": "Malware payload (Dridex)", "value": "5701ad5663be73d40f0d699c1a15661562ccd5ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645161, "uuid": "ac6e4822-7a60-4d87-8e3b-fd52af06e046", "comment": "Malware payload (Dridex)", "value": "646e97776db423e5af581657e68312b9b86fe363b06bc40170e9f0f688cea6f33cd3809f3d6fe4aef630975614c84556", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645161, "uuid": "95e2a406-d924-4ec1-b631-fa67e9b4d7ce", "value": "C3F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645161, "uuid": "0149ef1e-0dd6-4ef0-8159-1df8cd8d25e5", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645161, "uuid": "678d3bc8-94b0-4d92-aa19-d1a98c877626", "value": "3072:X78CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYOZwd:AnClX8WZ7/HrRCADTR0VlIZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645161, "uuid": "a1fc2821-9a79-4e66-9c6c-2210ea1d678a", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645161, "uuid": "120700da-91f6-4c0f-8c02-5c5b8b43fda4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645161, "uuid": "5d3bf8ba-5919-4aa0-a161-91363383b93d", "value": "f350cc31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11de152-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619949, "uuid": "28f41080-23e0-472f-b79d-20f1eed29f9e", "comment": "Malware payload", "value": "01ce5b8b2b11ca41b650b2525cf942f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619949, "uuid": "e1fb4b52-72d8-47c6-a139-d5242871b423", "comment": "Malware payload", "value": "1f7978931a2ed09b859fa978664da43da475c7837e417591f068cdbe629806f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619949, "uuid": "279b5402-d740-4e5a-97dd-72af6832bf57", "comment": "Malware payload", "value": "dc52548c6d31f87f6af133a5e441f90f3e0d1422", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619949, "uuid": "0854ecc0-6aac-4a81-b52d-0fe1edc7f112", "comment": "Malware payload", "value": "9e817f16d76fdbd3ee32ae1955afd709b28dd314351bd79ca7452c87674350483cf43ab7c2a0d2111827b26450c09950", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619949, "uuid": "25c8042f-bade-46af-aca9-959816c20239", "value": "3C83122013B75F4870CD8A3A98F21ECF7B6AF5B42D1E98F1516E0466E123C961F2047E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619949, "uuid": "1dff356f-085c-409a-b0c5-f3aff4c49606", "value": "1536:XDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9cZ8VzpIsOKzQ:XDAysJADlV378P3RPVJLdGZ8VzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619949, "uuid": "8953b120-1e45-421f-862e-239273ae52d7", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619949, "uuid": "affd30dc-eb7f-401e-a818-abb3fee2ee33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619949, "uuid": "4db5c76a-94c1-49d4-82a5-b6634fb42fc0", "value": "catalog-163927197.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a08b686-a7bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619571672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571672, "uuid": "eb362664-170b-412c-b105-644bd334114c", "comment": "Malware payload (Dridex)", "value": "8e5cfcc9c9e0c696c03650ce34ad2871", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571672, "uuid": "00066e6d-a28e-4e2d-820f-241002f117dc", "comment": "Malware payload (Dridex)", "value": "1f7f765f61a371e61ed684f7da52ad7dfe778e413eaa908071314926b61877ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571672, "uuid": "bd1bc68e-6b71-48f9-a041-536bcdc78d18", "comment": "Malware payload (Dridex)", "value": "9fb7f0958d6295d738314090ebe00a5449208f90", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571672, "uuid": "49cae7ba-fb27-49b2-bb59-0f5d996fc8cd", "comment": "Malware payload (Dridex)", "value": "470a14358cb96f155254b043ef550f4d4880ef80d1ebb4592a1eaab5e35d5c5e9e41d8bc0a019a52a9f4b21230260c9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571672, "uuid": "63a8139b-7a73-4556-8a14-3def2ed29d2b", "value": "CBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571672, "uuid": "baf8337e-aeb2-41f6-b4d4-c7ccc62b485e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571672, "uuid": "50056809-f0bc-4604-ac18-93b17350f83f", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619571672, "uuid": "560b3405-4e09-49be-8fb2-7303c4b75589", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619571672, "uuid": "3593eb58-5456-4e27-abe4-3fa29b83bad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571672, "uuid": "d9a1ee9b-0531-486d-a23a-959787ecdd89", "value": "8e5cfcc9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865de650-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627206, "uuid": "6f188506-6294-4997-aa8e-4da8341abe36", "comment": "Malware payload", "value": "e074d78305df9480909d0e5bcc8de350", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627206, "uuid": "36314f35-30f5-4616-a3f1-4ec8a705a682", "comment": "Malware payload", "value": "1f8f6c8bb3d5abff119fa540991eacd8da3edc4670793d6c0b27acaf03193389", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627206, "uuid": "1beeec75-bfbc-4a8e-ae63-de3aebad8cd4", "comment": "Malware payload", "value": "f4a08b3eb897f6fe32fcc4135584d7dc90f6b0a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627206, "uuid": "3e1282d0-6429-4028-928b-55ffb8c2cd19", "comment": "Malware payload", "value": "97844ab0d911b6dfb7c03cf1fd0b6a2b8515267decd6a2a51b0a6df21f48bae17f0b18f90830fdb8c82ce76d04117e46", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627206, "uuid": "7375e340-fcfa-4754-96ab-efff1043ebd1", "value": "F88302A453BE4A5DB94D4E2CACA20D4F3F57B6743D0E68F1B92D0485A2318561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627206, "uuid": "07e29260-8e07-4d4e-97bb-ff60e14a3252", "value": "1536:VDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmTN:VDAysJADlV378P3RPVJLdBxpEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627206, "uuid": "77425929-e581-4b04-9fac-dc31ef5a2022", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627206, "uuid": "b940dc21-f35e-430f-ba19-1a5074d22f0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627206, "uuid": "7149fa9b-0832-4e90-aa00-3ab52818fa18", "value": "statistic-771926641.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1f31f7-a869-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619645494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645494, "uuid": "dc8b4550-99cc-4a93-be8f-266bb72cef35", "comment": "Malware payload (Dridex)", "value": "8b5c6c199d62bca0833e8c6f91daa416", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645494, "uuid": "2d7482b4-cc5f-4eb8-b322-c12655588752", "comment": "Malware payload (Dridex)", "value": "1f9cf018029f5ac596c6b2cc18211b360ebc3ab28a2dc05a1f76c181e98cf8ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645494, "uuid": "1c12c16e-9b29-4a01-bc92-73f83dc42a21", "comment": "Malware payload (Dridex)", "value": "11cf35692c4a19772e13420434d1c05cad7a2586", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619645494, "uuid": "bee2a818-f2f0-4951-8a52-d051be35d298", "comment": "Malware payload (Dridex)", "value": "3079ed6ebad4dfd05241eab47ec200c5653393bd41e1d55b1a56d066d89e39c15995cb324c0529a088b81573c3d3f5e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645494, "uuid": "6b3d6fa1-71f1-4d63-b0ed-3720fbc5af3a", "value": "8EF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645494, "uuid": "1f316281-b447-4e58-9b2a-97c7c4935719", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645494, "uuid": "fb374dc3-4f8a-41c7-9e86-f764d4d89443", "value": "3072:hWSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2NGkFY:AnS62Fl+pkeJl3CvRStrFl+EYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619645494, "uuid": "1bbe3473-cecf-4e1d-805e-37d2dcfad552", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619645494, "uuid": "4a85031c-991e-4ee8-b36f-7992b820cb69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619645494, "uuid": "d4df9819-ab05-4ca1-8a36-2187a92fcaf8", "value": "8b5c6c19_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d998e7-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626024, "uuid": "e06ddfbb-69f2-4401-a75e-05d845c2604e", "comment": "Malware payload", "value": "276f9ddf6b39564c07aacc19eabe22b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626024, "uuid": "2fca1633-4b71-472a-a9f0-1b2021acc8d2", "comment": "Malware payload", "value": "1fae01c4aedabe1c63084b334a299b1ef2fa00d14a8fbfd584481dea1a763eb9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626024, "uuid": "29e00b03-f665-43b2-98d6-99ee4e75ae71", "comment": "Malware payload", "value": "1d19fe0da5486fbe7ba4ee736ad72797f5043268", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626024, "uuid": "802e84fb-9e20-45ef-8d59-bf8fe71ce1ef", "comment": "Malware payload", "value": "e6b05f5bf926a3de334127123657dec0e03d594fd37f310a15e4a94a0ea0b18daa2f8679716d353a48494b1c6d467917", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626024, "uuid": "3d879474-82ad-4976-b053-642931093aaa", "value": "58830220437ACB1DB58E9F2D9CE31D8F3E5AF6B02A1D9CE1B53D0495F16A8110A2467E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626024, "uuid": "81a0311e-62e8-454c-b532-4084ce94846a", "value": "1536:vDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdn8rZctFOLVVrCvI72G:vDAysJADlV378P3RPVJLdn8rZc2xCvmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626024, "uuid": "eb8474f6-276b-4372-880a-da1d170efc30", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626024, "uuid": "a87c1734-bbb6-459a-b339-bdf6b263890c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626024, "uuid": "f684017d-79ef-47e0-adea-3083193e1034", "value": "statistic-1909696911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ab3499-a85e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619640792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640792, "uuid": "52e3e534-8a90-4f0c-851a-f94a17be69aa", "comment": "Malware payload", "value": "b7fa29cf6171e75f3211ca630daa635d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640792, "uuid": "4bdefc5d-af93-4417-b3d2-9f15dd0c6916", "comment": "Malware payload", "value": "1fc6868d13e70667a29b9a762173c51edceab477096b042db36e40d09345c895", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640792, "uuid": "93d338d5-7348-4de4-b63c-145a4c03a91d", "comment": "Malware payload", "value": "d03b014325197a10e167d765b8fcfd18cdcaa675", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619640792, "uuid": "68da41d5-a29f-4b07-aae3-a449cb4fb775", "comment": "Malware payload", "value": "1aa1147e6ee117b96aba1b72c68fd5bcd5ec3e253e83b4727e2f2694b0fb4e46468b809c8739f2d5da1bc6b1dcf01df3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640792, "uuid": "9101444b-9ac7-4315-8dea-97ad0301c1de", "value": "7D948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640792, "uuid": "c9aa576b-69b7-4638-9d48-7fdd3913e46f", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640792, "uuid": "dcd9905d-f1cd-4b76-8278-ec6ebf402040", "value": "6144:7WrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmR:7WrsTwr03pdf8vhhOKJETlByR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619640792, "uuid": "94d4298f-1627-4266-b917-88d4b8fab217", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619640792, "uuid": "26763c85-7597-4940-a549-4b2644b551a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619640792, "uuid": "8ba43874-1da2-4ac0-b5a0-17aa769ba321", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0c7353-a86d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647353, "uuid": "32156d3b-d0b8-43ee-aee6-aec966b75c88", "comment": "Malware payload (Dridex)", "value": "fa43b656d7eee11efc8cab9696d72d72", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647353, "uuid": "88040bce-7c1f-4f69-a430-13fe01419e04", "comment": "Malware payload (Dridex)", "value": "1fc74906600a362f798174c6257f9b19ae4634564a851f23babc9bc3e1a24323", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647353, "uuid": "238e8980-b639-4be5-9e83-5d841993cd5b", "comment": "Malware payload (Dridex)", "value": "2083231299b3d8c8e9c96ca3c127d401096dc8e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647353, "uuid": "fbfa3796-6305-43e4-86ad-80fc1fe9ff01", "comment": "Malware payload (Dridex)", "value": "4bdfd78d8ba8a76798aadf7507afd0a5d83b7e2b5184f17bfc16198295b3f2a5a1856fc3e63369611c8210447f7f3518", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647353, "uuid": "3b5eb2d9-bd22-47a4-a350-d890458635f8", "value": "9EF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647353, "uuid": "eda908cb-9e68-4462-906c-04b1537ec779", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647353, "uuid": "4afe88ec-ed26-4e53-9ced-c3bb440fcfc8", "value": "3072:MUT2d85tleLD51fC5AHYEoefukoTFMpGmj48D:qy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647353, "uuid": "b6585db2-494c-4698-8c0c-89698e94974f", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647353, "uuid": "fdcd2544-c9e0-4f67-bdf3-f0ec7d3531e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647353, "uuid": "20c31013-e1c1-4d7d-85b4-cf47315b48bf", "value": "fa43b656_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afa4fa2-a83f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627482, "uuid": "17dc8aeb-a780-434c-bc08-f4010d0b9f82", "comment": "Malware payload", "value": "e4de9de59f2bad087ae44a2708bfaa10", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627482, "uuid": "6153caf2-5f11-4351-81b3-97549bce488a", "comment": "Malware payload", "value": "1fd89b0d33c2418cbd70faec73baa759edb44b0b6cd655fd8264158c3de1470b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627482, "uuid": "df0855f5-7279-4941-8758-38b40f42f244", "comment": "Malware payload", "value": "0b136b2d69db5e23ec7208023efa7e342423ea00", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627482, "uuid": "4411922c-cac3-4052-9f21-8fee81064ebc", "comment": "Malware payload", "value": "2b1a7d7fcc5b73f3ed0c43f4d0ea8267720460beff32c276d39d69006fd0e7e269e5530495aa88128001da961a19d289", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627482, "uuid": "2ec7520f-8b67-47a3-ba76-57e544fabbc6", "value": "6D83020813BA4909B5CECA2D8CC31FCE3F17F8B415094962A55D0199F627C6B9F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627482, "uuid": "7aa62ce0-6920-43d0-bc7b-eec83cf2ea51", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdM8ZTrIKrVAN3n11B:CDAysJADlV378P3RPVJLdkKuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627482, "uuid": "2d4f625d-67ac-4764-8620-5a45e3aec3aa", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627482, "uuid": "c4a57f14-49b1-4a58-98c1-83d0657e3fc6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627482, "uuid": "4772bbc1-0311-49b6-9d73-ece82d3ef03b", "value": "statistic-980347102.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1199906-a7e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619587790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587790, "uuid": "cef4bdf6-6e29-4226-827a-942a7353689f", "comment": "Malware payload (AgentTesla)", "value": "8103c13763cf6ade83af5f3de3dfe681", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587790, "uuid": "cb3712a4-ce64-40b6-b6dc-b7808be2dc58", "comment": "Malware payload (AgentTesla)", "value": "1fe457032d45f8a27c6aaf4470e9eeeff496faa45045600c2007b6e3197bf51c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587790, "uuid": "38a5dd5d-23c3-4875-ae51-d00233721523", "comment": "Malware payload (AgentTesla)", "value": "0f0897f2e61f3405df3d1f521b49b06cf541e6f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619587790, "uuid": "572717c2-1c52-497e-836e-34b91be38d5a", "comment": "Malware payload (AgentTesla)", "value": "c0e3d0c11c53be166012a67601954c39b5612a29dff4b1844f78c1e714a517c5198ab02150801445bbc3f52926f7358a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619587790, "uuid": "6c9d2992-940a-4c9f-89a3-41d36bbc145f", "value": "5CC423FD9B1B5AAC76B19607213AF576C798E84F33576DFACE0A360907D83B4017408A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619587790, "uuid": "1550be91-21ac-46ba-8ff5-6cce2fb748b5", "value": "12288:UG/Sr+6swVwcMexMWXDH5s5OorP6YoHUhj+JN5OCZWD9+r9UPmHU:cJswiPODH5s/rC/HQj+JjO2WDEHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619587790, "uuid": "10ed5cb5-b121-451e-9342-8274a257d511", "value": 582690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619587790, "uuid": "f77e6821-e3e8-455a-8f31-bd14259d1ed3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619587790, "uuid": "43395763-a6a4-48ed-9d23-d7b871627849", "value": "payment copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270cb13b-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622751, "uuid": "a240bd68-7af0-4a9b-b77d-ff3036464c4f", "comment": "Malware payload", "value": "e021defe3e5c574b301dd951bb5694c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622751, "uuid": "77a62a4f-ba0f-4a94-9a95-4ed4f152a69e", "comment": "Malware payload", "value": "1ff83a4feabbbe63166cd310636a6eb011ce281d1ae67bbb05dd576b65704b69", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622751, "uuid": "dcd2371d-1839-4aa3-8e55-66fd752551eb", "comment": "Malware payload", "value": "99f554da5430e75316d346f8a7139e868ba3f8bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622751, "uuid": "d02d0dd6-66ee-414b-b54f-7c15346a7e22", "comment": "Malware payload", "value": "8c6751f5559281b5b960029526e398a63407672721959a14187ed789ec41890f9c95612cd6f6265c36f6db60d01ad8f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622751, "uuid": "5161edf6-712d-4d17-bbce-e60a783d6107", "value": "BD83018C153EC1EFB6BD2B45B1EDC47FA50EECB47408248DD4C9266E9C89AE35C875A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622751, "uuid": "b157e4de-faae-4f11-9c5c-367cec4a1415", "value": "1536:7G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttB0ZKvCjFevNZIJldv8X:7GEhrHJoEsBMG7qzkf0ZUOTJvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622751, "uuid": "3f6754ae-546a-4c86-b0c0-f3bf68c7e5f2", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622751, "uuid": "2ab0a939-30f5-456e-bcb0-b7e4537d7c22", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622751, "uuid": "39a30224-97fd-45cd-a479-d6000011d2d0", "value": "diagram-162362084.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c861e4-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626399, "uuid": "fde8d06a-3809-4917-b659-3245edc47796", "comment": "Malware payload", "value": "f872a53121bb9c3876ce76aa5dd043b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626399, "uuid": "d86019dc-534c-4563-87f4-4ff0a2619115", "comment": "Malware payload", "value": "200271a01e57cc41caaf985f64d9aacbdb0b1cadce14491d1a625134a06b4cc0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626399, "uuid": "8461f5e9-7b2f-4794-b7f3-19d03fe7dc09", "comment": "Malware payload", "value": "9d8301b233bd6d2efde38b28ed1d7eade15dda8a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626399, "uuid": "70a8a1ec-7165-4a65-b942-52143d5132b9", "comment": "Malware payload", "value": "c2e05527e76b6a44400d87d168617971996990e1b2491ac18affb3e8556f1c3bf1ec3c05dffd6781072c59e155e43224", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626399, "uuid": "54e85e1a-6a31-43b7-a0dd-7e94dfa4b835", "value": "D183021523BAC998F5CD9E2D4CA30D8F3F42B9782C1ED5B5622D0199E327C964F2453B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626399, "uuid": "d8ee3689-2256-4dd5-9bf3-52c5ec0f21ee", "value": "1536:jDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdaPqXT/WkO0B19M2iu:jDAysJADlV378P3RPVJLdaqXj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626399, "uuid": "20b514b4-6180-4ab6-996b-4653864c7700", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626399, "uuid": "9b65efba-7c70-4d41-abf4-c16cb3f7fb81", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626399, "uuid": "606747e8-9dd5-44ec-9f24-da89a8e59255", "value": "statistic-236356631.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0376c60c-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626556, "uuid": "88e48e5c-b3dd-49c8-abc9-b608373d2705", "comment": "Malware payload", "value": "673901995ada2ba3e2bc57e7e227fb4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626556, "uuid": "6487895b-7a95-4866-818c-3c2316c56f69", "comment": "Malware payload", "value": "2006d905647055d02c5c73e251ad4afc4828c6a318568ef3a92e7a85abc4f1a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626556, "uuid": "4f7d04bb-99aa-4d73-b333-f880032c434a", "comment": "Malware payload", "value": "2bb1d08ee1af187975fa29e8991e655e571efb04", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626556, "uuid": "dcae2dee-ab7a-4f27-8d68-dbfb23273ee0", "comment": "Malware payload", "value": "8fd3cab18acac303efe67092ac70ec033fc3d5918fb8fdfd3c06bbcaabc91adfe8bf1ecffb55da18f80da86973224ee3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626556, "uuid": "eecc63ea-655b-421d-aeff-9a4965c048ed", "value": "0D83029413BB8E9DB58DC93A48D20D8F2F56B6702D1B5CF2B13D0494F1338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626556, "uuid": "ffdbf553-7afc-4ee6-84f7-4bcbd651adb5", "value": "1536:eDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn75M:eDAysJADlV378P3RPVJLd47y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626556, "uuid": "d8adc391-a262-49af-a4bc-7f6d7ee87df5", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626556, "uuid": "9d92f101-7372-4828-bf22-245072b9b926", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626556, "uuid": "4b06272e-fa94-4ac0-b906-4791d04bbdb3", "value": "statistic-355228909.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c60cad-a85a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619639021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639021, "uuid": "d2083710-37a4-4173-a5fd-7ff8d840a3c0", "comment": "Malware payload (Dridex)", "value": "e081264bf2a975ffc3a66fdbfe25ac6f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639021, "uuid": "ead805d2-cdf4-400a-ad3c-5ce672f41bfb", "comment": "Malware payload (Dridex)", "value": "200eee9d68e35795bd66d925c53daaec4c273f243d052de1caab63112d52c2f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639021, "uuid": "83e434f9-7764-46b2-bdb3-8bee51e11ead", "comment": "Malware payload (Dridex)", "value": "58d9ce700f1e220951d344649c44923ba30a050a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619639021, "uuid": "e05741ca-159f-471d-9175-1950a9490c31", "comment": "Malware payload (Dridex)", "value": "c1b46b477776e36a730666f9442b26872e7ba9d789d06f24ef339b86c5cc6f13b4c2a656b89147f48e46cdbeb66a80db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639021, "uuid": "55d6edb8-1178-4b47-abb2-b58f664545cd", "value": "55F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639021, "uuid": "f660eb6f-eb3c-4772-a19f-217677d310b2", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639021, "uuid": "5f02bcd1-ccff-4275-890d-83d76fd27170", "value": "3072:xoSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2aGkFY:inS62Fl+pkeJl3CvRStrFl+EYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619639021, "uuid": "34ffbcc6-7f75-49a3-8631-e9849c7d114a", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619639021, "uuid": "8e259494-d190-4218-8be2-49c5a48cd2b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619639021, "uuid": "d99542ab-3bf6-4fc7-be92-2251ebfd61b5", "value": "e081264b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc0b2b3-a82c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619271, "uuid": "e889605a-d237-413f-af5d-ae0d8b334046", "comment": "Malware payload", "value": "d6dd539a40a4e1d64eedb38b320eda9a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619271, "uuid": "6ea6f90e-877c-42dc-9bca-26d9c1130fee", "comment": "Malware payload", "value": "20202ca0f2cc4176455d0777400b8ad8bc5d25e31f112ae7840e3c2e7598ad40", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619271, "uuid": "bda3ca8e-5c45-451b-8fce-22fccf5b5367", "comment": "Malware payload", "value": "f875566924f1271126a26bd0de1151804cc877f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619271, "uuid": "094ed0d8-733c-4e14-a3f4-1d261f730dfa", "comment": "Malware payload", "value": "407524c63402bf83401accf9c63af5bca228a1a67aebac8c219b6a7f7c0e267b8555928ed6b84d755d5cf2560350d96b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619271, "uuid": "154e8738-cedd-4711-811c-fd51a09e1bc7", "value": "2783021013B54E4CB9CE9F295CE30ACF2FA7F9B4160969F571280894E721C174B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619271, "uuid": "d0a6d6b9-b6bc-429b-aca1-c011e7a8d1ee", "value": "1536:+DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJ0BD:+DAysJADlV378P3RPVJLdYDpH+jAJ0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619271, "uuid": "29c50be9-bb3c-45a3-9502-20aae18ac070", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619271, "uuid": "7dd8061a-0c09-4198-a2b6-2b8abffd3dee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619271, "uuid": "74610db3-73de-4cbe-a45a-b0b3b6256e68", "value": "catalog-1159677983.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1781c8-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622031, "uuid": "16ee0c22-e215-4720-a022-47dfda9b3092", "comment": "Malware payload", "value": "8cb104165f57b385f4cb0a94bea4555a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622031, "uuid": "76d4e805-b4b9-47f4-aac9-57b54fc6a9fa", "comment": "Malware payload", "value": "2030d3db54655aa0b1c747e03862f12798d31d31666a0fd6d54dee96633ff140", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622031, "uuid": "7f2dc356-4a6e-4984-89d8-257039caef86", "comment": "Malware payload", "value": "51da9c411ad0922e9a96a7c16d88e510a6a9b193", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622031, "uuid": "def3336c-1cec-42f6-8c7b-4af6ca606d96", "comment": "Malware payload", "value": "750d5378d2382535d6b8c804d41e029a6e81f2c2cbd9940198fe54964ed4ff7140d8e3cfa9e5fc0392edfcfa8f9b44f6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622031, "uuid": "d7675954-3cbd-4da2-8efd-78f69fd1d03b", "value": "238302CC253DC5DF7ABB2A0961DC887E780EE8B43144154ED8C86A6F9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622031, "uuid": "e6d2e677-e6a0-4147-aa59-297bafd28f5c", "value": "1536:HG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt9KkApVr6wo+RxHI:HGEhrHJoEsBMG7qzkDxApxTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622031, "uuid": "3f5bf1aa-285e-4b4e-bb9b-bfc75abbbd1a", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622031, "uuid": "baadfdf0-56dd-463b-9c32-4f74d14e08c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622031, "uuid": "ef641955-d14c-4ec9-8bfa-e3cc80bc3da9", "value": "diagram-1081302296.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9f33d3-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624371, "uuid": "8011fbf3-8686-4f09-89b0-1d16b9d27f6b", "comment": "Malware payload", "value": "7e9df6eb016ebc39128583b217ad4355", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624371, "uuid": "9702d32d-5ddd-4874-9d32-a523a5f5ec8d", "comment": "Malware payload", "value": "203eb95f26ae08219f2403e0864ee33ef5ba465a94c11191c9092a8389005beb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624371, "uuid": "9cc14172-0d31-462e-8649-ecfae3d34daa", "comment": "Malware payload", "value": "0d4a27fad11e81d3eb96594f24507a8634f90158", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624371, "uuid": "b85180bb-20bb-4f30-b3cf-07003dd2c7e8", "comment": "Malware payload", "value": "537c50f61ee333b72396760adc2c792b3c9f663ac61d417995293223774db2261a2f6566f73034db279ac811a76c0080", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624371, "uuid": "ffb8db76-7d2c-4e0b-991e-be4956f56ce9", "value": "2A8302CC6238C9DF717D3E5AA6D8C83A790E98B93044349DE4C066AF5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624371, "uuid": "fc718888-4289-4a6e-9d5f-034dbbce3291", "value": "1536:WG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGrT:WGEhrHJoEsBMG7qzkEEVerrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624371, "uuid": "1b4934d0-fada-4f44-b751-0621427eef59", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624371, "uuid": "5e30bb97-3547-4aa2-8a1b-2078b07e6b66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624371, "uuid": "86bb3d03-09cc-4fd1-874d-91e5cd8a2896", "value": "diagram-731056488.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68d5a71-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621327, "uuid": "78be3770-aa80-4a45-ae1f-ada8bf47ebfa", "comment": "Malware payload", "value": "0a0f742b006dd663727f224af0a5e33b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621327, "uuid": "8bb5c074-203a-499e-ac2b-eacac85ef4ae", "comment": "Malware payload", "value": "20444f452888434e2138f84ae2e9da5562e74fa5770a6add7c34335fda41fcd1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621327, "uuid": "69398f39-a143-4c61-ad4b-3eaaa7b9530a", "comment": "Malware payload", "value": "e8d79b699ea27b91ca5f28bd7b35359cb41565ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621327, "uuid": "f9a9e5a4-f864-4b04-bdb9-7a62f497b7b4", "comment": "Malware payload", "value": "97d010d53afbd2460ac58a6def1d8c68ef932f967b2fc0ad046fa45573db973524721bc718ba69a960bb73bab8b2d31b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621327, "uuid": "9036e44c-a23a-4074-9889-137863344af8", "value": "B083021013B58A4CB9CE9F2D5CE20ACF2FA7F9B4160D69F571290894E722C574B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621327, "uuid": "302e648c-7ef5-4e9c-86c0-f5007344c978", "value": "1536:kDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJVu:kDAysJADlV378P3RPVJLdYDpH+jAJVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621327, "uuid": "0aab29c6-f583-4777-994c-bbc067ee5ca9", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621327, "uuid": "9f2a44af-f86c-4b27-9ffb-368147370a69", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621327, "uuid": "01fc18c9-2746-4db7-9d9c-475c754916e9", "value": "catalog-568412289.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f1da2e-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622794, "uuid": "bc82ce0e-ae75-4be1-8a41-c0969ce8f2f3", "comment": "Malware payload", "value": "53b76512f1c167163a88fcc805c66336", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622794, "uuid": "b5ed7d9a-1de1-4ba3-ab5e-579467f10e38", "comment": "Malware payload", "value": "204f8f719eb4d0a1a81f4c7699956596054f7e824e7ca91fb76bae8a3ff59fff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622794, "uuid": "47181594-858d-4073-af60-1d908e4db5ad", "comment": "Malware payload", "value": "e2002075906eb88c6ae0aa9adeac6cb11a41d0cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622794, "uuid": "46cb5bbf-5372-4821-af8f-97aeba09de99", "comment": "Malware payload", "value": "6e212ba9e88a42a1f29a55a6df83a0a3f8a6dca8e9dc3065ce7ee9d046925a87aff6a202f73a47cde62c6992db1ec29e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622794, "uuid": "7c4d9e97-7b09-45a6-b198-238fe12700e7", "value": "DC8302CC6239C9DF727D3E5AA6D8843A790E98BD3040349DE4C066AF5E899E71C9B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622794, "uuid": "4ddb31c4-4c8b-4208-95e6-871a26a51c19", "value": "1536:GG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGr+r:GGEhrHJoEsBMG7qzkEEVerrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622794, "uuid": "85a2e3f3-bc89-402e-9205-bc257979c1e2", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622794, "uuid": "fa4b7417-4055-463d-b34f-128415cc84ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622794, "uuid": "f2e31e46-f4d8-404e-b486-08e9910742d6", "value": "diagram-165533978.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5c5344-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626815, "uuid": "234c4186-cee3-4dec-8901-210d545d68cd", "comment": "Malware payload", "value": "6b7ea9b58404c924780d92e3614c5a62", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626815, "uuid": "3a36b520-20ed-474c-8e43-7773d4241af1", "comment": "Malware payload", "value": "205c5a119bc7ac0f4c7f6befd03aaf07c8e8d3b68b5d5e63ea5d38a835cd7cdc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626815, "uuid": "3761e061-261c-4d9d-9438-9d6d314ace45", "comment": "Malware payload", "value": "7f107ce74af576d53b6f3fee119466e31cb50594", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626815, "uuid": "14114e77-0887-4b19-8845-eede34bdabca", "comment": "Malware payload", "value": "6ec6de2a4b026d94574c3bbee5954a489ae1bc0bf5372a8a2d7a1e10bc0a0a0b2f7dd8e683dfeecf45023491a5038409", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626815, "uuid": "c0869b10-df78-4b47-b62f-15eb3612eec0", "value": "3983020813BA490AB5CECA2D8DC31FCF7F57F8B415094962A55D00D9B627CAB5F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626815, "uuid": "6f9f7f44-c933-431e-bd1f-5be74416ada0", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n10e:DDAysJADlV378P3RPVJLdcKul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626815, "uuid": "4a87271f-3d1c-4da8-a5d2-53303bdec37d", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626815, "uuid": "37d5fb41-3b64-491e-832e-19a70e287341", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626815, "uuid": "a0265809-d7d7-4694-a34e-6e6dfb25acfc", "value": "statistic-528859161.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178b803b-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620148, "uuid": "07e2e7b6-cab6-4593-97a5-d87c50bf8c54", "comment": "Malware payload", "value": "96d2ff7c3f2d3c78a30bd4779d03664f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620148, "uuid": "96d67f1c-6ef5-41a3-8d3c-3e106b70ac09", "comment": "Malware payload", "value": "2069cb1a3a659e292052d4e7d4f74fe3ed433de415fc968f2e4944041c6fcc0d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620148, "uuid": "e835964f-a3e7-45d7-84b0-752176bc821c", "comment": "Malware payload", "value": "ace99aecde40c81a8d0fbaaf3c6da1f909dd4d92", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620148, "uuid": "1b4eef1b-d5e5-4a23-b51f-eaf7ecc8e752", "comment": "Malware payload", "value": "32dbbe6dc125b78ada75c56bcf0a645a0b97313cc32d0c2477183a420aa645ca6df3cd17166bbfc26eafb09511e7c44b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620148, "uuid": "6e045de5-c4a6-44a4-b790-7ab78957df83", "value": "E483025413B94A4EB8CE8E196CE31D4F2B9EB8F81A2B55D5795D00E1B2334660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620148, "uuid": "c3c067c4-8c1c-4cfb-bc6a-7d1be6b24a22", "value": "1536:JDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdnIkGV8BAY0woy:JDAysJADlV378P3RPVJLd68BXSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620148, "uuid": "5ceb8edf-9cb6-46ca-87ad-b5174ba6b669", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620148, "uuid": "61bd649e-ae5d-4380-ba74-29ed1e1520ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620148, "uuid": "53461f19-6a31-4f0a-b7dd-87a226439433", "value": "catalog-1802724051.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3196c4a-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626502, "uuid": "99d8360a-f196-4419-b0fd-4c98d83ddf26", "comment": "Malware payload", "value": "ad03c7b0ce750be8bc2592e0b3157110", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626502, "uuid": "a00a947b-b305-4bc2-8841-6b0d0f8fabe6", "comment": "Malware payload", "value": "206f73c156808b7122b94bcbf2225d6a211b0a69235d37ee61c57594282699d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626502, "uuid": "a86fc599-9308-48c8-bb4f-5e8bb8bd0282", "comment": "Malware payload", "value": "7f675f64952a4730f1addcf0c49a1ef351432e5c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626502, "uuid": "c56bce14-d8af-4740-96b3-0e85433cb33f", "comment": "Malware payload", "value": "14ab5542f5574dbe9a1f843fabfc8ef433751d3b426d1f86339c6655b00e5b07bc88bf7f84751fbab9ab1afe63be2f72", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626502, "uuid": "4e6ce5a5-90aa-4a8c-81e0-f3ad8271e4ca", "value": "A983020413FA8919F48F9E38ACD20D8F7F9AF6F42D0A58E1966E0455B33AC511B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626502, "uuid": "0c82aff5-acc6-4e9c-a418-308fc05e8292", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdhgKXsth8wBk:0DAysJADlV378P3RPVJLd/eh8wBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626502, "uuid": "a8d23ce4-80bc-4f18-9e04-944e703a3c0f", "value": 86113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626502, "uuid": "abaa8209-05a4-443d-aec1-a215252f0b93", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626502, "uuid": "fcf52402-80c9-4dc7-a7c3-78c6c1e71df0", "value": "statistic-317455151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a3688f-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626827, "uuid": "eb2d69c1-6a18-4906-b16f-a5f13a287ead", "comment": "Malware payload", "value": "2d2304207bf71436b38dae362384e6cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626827, "uuid": "f5ef4dcc-2955-4aa9-9506-e3dc00456bda", "comment": "Malware payload", "value": "2097141062c84a61e73dfd4a83c080e433c5a62ce76c758f558301236cbbeb04", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626827, "uuid": "9d75484f-14f1-4a36-b312-c8daf18a3d7b", "comment": "Malware payload", "value": "30a2da0dd7b3ecc72e3f9309f94e6f3be8d9fe9c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626827, "uuid": "a29e1f2c-2888-48fe-b559-671b8a3feb66", "comment": "Malware payload", "value": "677985cd44f2f849edcdcaec8042c1511d88053fe9cbca078cc9c6a2c590f2e6947be441a592b3c288db50dc2656be61", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626827, "uuid": "bf19f9c3-b058-4c54-ad16-4bbc03458d02", "value": "A3831220037A864D79CE9D3C9CA31D8F3F26BAB4352E5DE371690598B626C411F3897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626827, "uuid": "2c861c5b-b090-4303-98af-aa5c6377df94", "value": "1536:NDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdTNp7Ctdn77/SW:NDAysJADlV378P3RPVJLdZp7mdnn/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626827, "uuid": "35f24eef-8ed6-4d87-baed-69ba2e42e6ec", "value": 86110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626827, "uuid": "297f27b1-9bd9-417f-8cba-1cfdc96e135e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626827, "uuid": "2d54ff32-1e24-43af-a09d-9e6df2caeb23", "value": "statistic-532380526.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26e5b88-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625964, "uuid": "355cd759-94f6-4af3-8c0c-929f39e5a8cc", "comment": "Malware payload", "value": "1b980cddb105139a5a309357fa001ac5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625964, "uuid": "19952886-fd4c-4d36-8e3e-c7d3d6657807", "comment": "Malware payload", "value": "2099c6a52390ef1f133d2d669520c379e4cb87d217e2599d04217eefeaae4f63", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625964, "uuid": "c06953e4-2bf1-4853-9e39-631f05aac518", "comment": "Malware payload", "value": "2ebb52a25cd83719d5bc505f2bcffd9786bb7494", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625964, "uuid": "787b095e-dd86-4e34-a378-d3d98809522d", "comment": "Malware payload", "value": "7a238e24b32d8fb4a8292eccb1cad5f2b572ca0c953b527dc5a3ad217b0d0fb8384b37b98e87da26bc40cfa544e6d1e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625964, "uuid": "51cdf55c-ee96-4930-a134-a3a91d82f5b8", "value": "9F83020813BA4909B5CDCA2D8DC31FCF3F57F9B815094862A65D0199F627C675F3892E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625964, "uuid": "c4de650d-3408-4c87-a2e8-86fbc81c723c", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdM8ZTrIKrVAN3n1XJ:0DAysJADlV378P3RPVJLdkKuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625964, "uuid": "86a1f4f3-209c-4321-96d1-541ffe20d9ad", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625964, "uuid": "ad8c5cdd-c939-4144-93e3-f9310ff4fc1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625964, "uuid": "ea6e7f00-3e2b-4224-996c-a6e82c7138d2", "value": "statistic-1871675116.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a824d59-a82e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620153, "uuid": "6069ab0c-4b4f-4ce2-9fbd-3a77b827eb15", "comment": "Malware payload", "value": "945febebfcf20ae0ebe4715dbf85a590", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620153, "uuid": "84ca529d-45cd-403a-8190-9de2cd4b2792", "comment": "Malware payload", "value": "20a42c8dacfdc245873b6856f77900e884d98573710d3dc4b3f9e412d3d30958", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620153, "uuid": "34f84fc7-1191-490f-991e-30832506fe58", "comment": "Malware payload", "value": "fd66ca86a290279f68fc911157df5d40103ea0de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620153, "uuid": "0c601ee3-3358-4aa7-bacb-107e75aea01b", "comment": "Malware payload", "value": "7e59ca6b573fe10bd17c526093f0ad0ffe1943ee0760af677cc3e45d24fc959fba4a76f99b32d40b934d21e5d5b13898", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620153, "uuid": "8091d0a4-33f3-4301-948d-6e81835eba31", "value": "0783025413B94A5EB8CE8E296CE31D4F3B9AB8F41A2B55D1795D04E1B2334660F28C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620153, "uuid": "4c376124-e418-41ad-aef2-02f360ab0d06", "value": "1536:kDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIIkGV8BAY0wUB:kDAysJADlV378P3RPVJLd98BXqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620153, "uuid": "879b8e71-184d-4326-a550-26097375028d", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620153, "uuid": "524fcbac-29a9-4509-894d-6cd784988291", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620153, "uuid": "5a379177-7ca7-410f-90ad-2e4d99e65f15", "value": "catalog-1804041356.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6419d2a-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647043, "uuid": "e0ba0898-850c-4754-b112-b57aa3c2f2f8", "comment": "Malware payload (Dridex)", "value": "a2c2f9acf8451dc14dde72ad0762c00a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647043, "uuid": "0f672bd0-7202-454e-8123-d3d4034edd49", "comment": "Malware payload (Dridex)", "value": "20a972e5a781e06587131a51dc5999de8f101763dfadc3cc5bcc1969274523d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647043, "uuid": "6e771a35-63ca-490a-b81c-d0987a236688", "comment": "Malware payload (Dridex)", "value": "1b7c0221f2527cae812dfa7b618261f6653c0b31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647043, "uuid": "a45e111e-a557-4941-8542-31be21f6a207", "comment": "Malware payload (Dridex)", "value": "0597408674d2c621903780ebf61e97f39595b80da5b17a4a36542ee65dfff001a9a2219a232c6c971c95ec776a36b465", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647043, "uuid": "ff023e6b-1f33-4acc-b5e5-ec565184867b", "value": "3FF3CF41D5A6C458EBDB2870C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647043, "uuid": "addf1236-4122-4414-9aad-c0baf25cbd5f", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647043, "uuid": "6c8cf778-4ecb-416c-81c8-8ed49836fb46", "value": "3072:/ZT2d85tleLD51fC5AHYEoefukoTFMpGmjG8D:Uy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647043, "uuid": "76ed3fe1-bb90-47b7-8646-dd2ac156469a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647043, "uuid": "7076621d-a032-47e7-84e2-8649cc5f6e46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647043, "uuid": "458b48e5-f962-48a6-844f-1948aa92ec48", "value": "a2c2f9ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df029bba-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626925, "uuid": "d3189cfb-3c57-492a-a667-870c045d77d5", "comment": "Malware payload", "value": "7486d518339b49e0cee82894b2ae4ba6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626925, "uuid": "fbee793d-c1df-4364-bbfc-3cc2918c0c59", "comment": "Malware payload", "value": "20ba5c81bc5d77c79e1502cf1d048d5c12c12c3486e775cf3f7b43a0236ef20a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626925, "uuid": "1abb2476-139a-450d-92f7-f375d1e4ccd7", "comment": "Malware payload", "value": "80fcc98411bba0b94a39b4ee8e321304af8c24a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626925, "uuid": "93ea69f8-0917-4946-974d-260393a1fc82", "comment": "Malware payload", "value": "208165b93dec498760e16914fcbcc64a11d16ef94a6117ade74b2c3da2d24a9b07b7054e583e26800e06edd765695e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626925, "uuid": "12b4bad3-42cb-4d7d-bdac-6ed6dae84d92", "value": "5683026923FA499978CE9A2E8CE11D8F3F4BF9F42D1958E0527E0061E627C511F1893F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626925, "uuid": "02457162-1f4f-4a25-8ab3-d7675b2dc81d", "value": "1536:3DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdUb00T6B/tKr:3DAysJADlV378P3RPVJLdUIlB/sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626925, "uuid": "93a1e667-4ba9-4eca-a24e-3e61295986c1", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626925, "uuid": "0f92676c-2b97-425d-925b-2561cb3f7d0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626925, "uuid": "8a85810f-e16d-43f5-8000-4df9a540dc08", "value": "statistic-594085652.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf728d6-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626599, "uuid": "49b2feb9-5c4e-4937-943c-9cd006eed17a", "comment": "Malware payload", "value": "8fab4bb92d1a485ee5c6818238ed95a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626599, "uuid": "5f90969e-973a-4f3d-b81e-3cfe08808b77", "comment": "Malware payload", "value": "20c6a2c41f473f41a040994aeb18e5110635b2c06b291fdf15b7f8c6e798f328", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626599, "uuid": "444cdf3d-189a-4fbc-9d27-669ced52e512", "comment": "Malware payload", "value": "532066a60b1069cacb864a887297d705caa6836c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626599, "uuid": "b516a3b9-00f2-4718-8093-c4b07fcd5568", "comment": "Malware payload", "value": "d8e98f8592fb465f4363e0b257e66cd50433713d89eedb437f92bb44f406824ead788c57b1b0f82064ffe3f0bb847c6c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626599, "uuid": "8f598c83-abaa-413e-b7ef-14cd3f89cc6f", "value": "C18302A453BE4A5DB94D4E29BCA20D4F3BA6B6743D0E5CF1B92D0481E231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626599, "uuid": "98f0b9cf-807b-409b-a169-a7f84e604e47", "value": "1536:rDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdjhsMnSEwJPTmu:rDAysJADlV378P3RPVJLdtxpEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626599, "uuid": "56cb348c-607f-475e-bf64-779f61badc64", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626599, "uuid": "4b29b13a-214b-405d-862d-50e745fcfafb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626599, "uuid": "6ca47094-8357-4612-ab91-109bbacbef21", "value": "statistic-370923936.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe103cb-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625530, "uuid": "74d880d4-afcd-4040-8beb-049b221d315e", "comment": "Malware payload", "value": "8b71dae8127a346f2adef791e1da5254", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625530, "uuid": "c728db8c-3df4-43da-8979-8701f47d207f", "comment": "Malware payload", "value": "20c9dd1a05f098e3ee4e679acb8e5c77e4ed8c44e057aa83850cd7a9394e5517", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625530, "uuid": "8447ea25-fb1e-41fa-a3f5-09d7e2349a28", "comment": "Malware payload", "value": "18dd8b5c989dd4febf9d40d703a7824f24be0f64", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625530, "uuid": "e9911d62-70f4-4eb7-8f9d-716f4cd23688", "comment": "Malware payload", "value": "149af4e8797f15b36fa26b15632fc032b23101c02da14abfdd1779413ca3162980043cca8ee15f821d7bed2021237692", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625530, "uuid": "6aa9ea5e-f105-4a01-9602-2c0dd1d972df", "value": "4983021163B9C998F98D9E2D4CE30D8F3F43B9741D1ED5F66229019AA227C960F2493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625530, "uuid": "707bcf92-8ac8-4395-b30d-dac6ee4a8c9a", "value": "1536:dDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdpPqXT/WkO0B19M27i:dDAysJADlV378P3RPVJLdVqXjzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625530, "uuid": "1740480d-e1cb-4e05-bc69-63ed512605ff", "value": 86117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625530, "uuid": "91f39036-dfd6-422c-8a9d-91728e76124f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625530, "uuid": "de4525a3-94ee-45bc-930f-81704b7dc990", "value": "statistic-1568981811.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e0f693-a83f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627477, "uuid": "109e619a-c3aa-452d-8e41-0e75f9a3325d", "comment": "Malware payload", "value": "4f12a7b5e70b88369909b20e9228f472", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627477, "uuid": "72341520-6edd-4748-b784-38b4351d18f5", "comment": "Malware payload", "value": "20d960d573531e4c711a32b25f0d6b230189fd2504d56cc2b621e9072825f3bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627477, "uuid": "cb6aeed0-d621-441a-b4d9-8456c456c784", "comment": "Malware payload", "value": "28ef3037aabb6307025859cd06a452807dc360b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627477, "uuid": "7584b439-7103-4c18-8cb4-43cfc8c689b4", "comment": "Malware payload", "value": "1edb2311bc3e5e30e28b831b20efb09b02b91fee039baf262cc61dfc3e7f90e289eb5d5aaeed118cb691f609acd462e3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627477, "uuid": "28618069-2c6f-4a87-a77f-592b946b47b7", "value": "598302A453BE4A5DB94D4E29BCA20D4F3BA6B6743D0E5CF1B92D0481E231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627477, "uuid": "bf0ff488-9278-4723-9dee-6c732706dc76", "value": "1536:9sDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdjhsMnSEwJPTmOo:SDAysJADlV378P3RPVJLdtxpEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627477, "uuid": "971d8545-57ae-4f63-8436-57a3890037ed", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627477, "uuid": "a69ae755-6082-4736-8d78-bfc4918ebcc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627477, "uuid": "d4704e36-8d93-4e36-ad34-20562f15e525", "value": "statistic-968995436.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18e90e2-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621668, "uuid": "9bffbf2d-08e0-49a6-bce5-0dd2be86f308", "comment": "Malware payload", "value": "93b512b613fca9f480c1c7e52704af63", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621668, "uuid": "27c0e2dc-0d8a-49dc-937d-256dcfb97f29", "comment": "Malware payload", "value": "20e6731a18b3c733531866079836bc7acda59be3c64bccba8870be888426348c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621668, "uuid": "e4bce554-3621-4550-969b-5ecd60bf9d5c", "comment": "Malware payload", "value": "de1b2e00a655d374d57704f729b3eebad6a0b207", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621668, "uuid": "150d5b86-60fd-4a35-bf1b-db9953560c40", "comment": "Malware payload", "value": "311397ae5aa6ccd9a875bb8a14010d78fef18913e41b561d14bf369fa9d9dc011a6247b1be08a52d393f21934d3af3d5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621668, "uuid": "bcad8024-eaa2-4909-8387-fdbff5b22b02", "value": "DB83027103AE8B1D74CE5E3958D22E8F3F87E8B42D095992551504E4E32BC629F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621668, "uuid": "efe6b017-42f0-4e84-acfd-aae57319dc29", "value": "1536:FDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVRT:FDAysJADlV378P3RPVJLdtDsMU0dRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621668, "uuid": "46ad2a7e-486b-458f-bea4-c1cf7809b7a9", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621668, "uuid": "88933f11-be25-4db7-8364-4ad071357ff6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621668, "uuid": "faf84c58-d77d-4045-a208-b4b8f21a3850", "value": "catalog-834771650.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f39fc9-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621886, "uuid": "7f30193a-3f94-4f8a-b12b-ad5390879ce7", "comment": "Malware payload", "value": "d34891664c848720fe8d89d8a4fe5e1b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621886, "uuid": "50c9e25a-51ee-4866-be43-9b9df0b3c493", "comment": "Malware payload", "value": "20f37a0dcee7179545d8a5d5a395f0a20b880da7d83465fc593d833fa94c346c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621886, "uuid": "afc896b5-8d2b-4523-a2df-2367857a562f", "comment": "Malware payload", "value": "e3dbd2644881110fa57d5c2980493acddbc38bad", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621886, "uuid": "b7442530-2321-4c1e-8d2d-2b1d7f54758c", "comment": "Malware payload", "value": "2f52013b2b22478ae2203c86dc37337f70cb1df003da2dda2734878d64374d091bb81c7de2793c0efdb218caf1a4604f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621886, "uuid": "1e7f5c39-b6aa-4731-9e4b-fdb8063da44c", "value": "1A83025413B94A5EB8CE8E196CE31E4F3B9EB8F41A2B55E1795D00E1A1334660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621886, "uuid": "6b0e6500-a981-4987-8e03-952c30891904", "value": "1536:TDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdnIkGV8BAY0w4L1:TDAysJADlV378P3RPVJLd68BXiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621886, "uuid": "07c7080d-6d1f-48a8-b804-c4b2b59e718f", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621886, "uuid": "17edd074-dacf-463d-9bab-b21bd5195ae4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621886, "uuid": "6c517c53-0591-4221-a1ad-0689eab37716", "value": "catalog-99217581.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3430789-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623925, "uuid": "df29394d-2266-4201-8b8c-f386180432a7", "comment": "Malware payload", "value": "df4fe3beef20751a0d8030ebf00d48d0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623925, "uuid": "c4562026-16eb-42c8-abff-10a6342b72ab", "comment": "Malware payload", "value": "20f9ced1dbc66cf145d44063b49b608f9687d2cecefabcacae303368f6e55407", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623925, "uuid": "86f7c145-62fd-49ac-b5dc-df5b56b1d039", "comment": "Malware payload", "value": "ef30a72491e8b6a3b6eaf3b822e647a7c3a9e69d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623925, "uuid": "e904a0e6-94db-417a-bed4-02785b9f3f8c", "comment": "Malware payload", "value": "819d58bfc59d1e9f662fd255cbbb2c06632e37b6d870e7c0200f9865b8caab6a808fd5d13d98cda68f66b9ac60db49f2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623925, "uuid": "a79a3160-cf94-4c69-a73b-ba78ffec885f", "value": "C88302CC213DC5DF7ABE7B0951DC887E740EE8B03148254EE8C95A6B9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623925, "uuid": "6930c7ed-2536-440d-8ba8-4b0e8be1e596", "value": "1536:TG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZKkApVr6wo+RxG:TGEhrHJoEsBMG7qzk3xApxTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623925, "uuid": "03a7fb4d-97b5-4a5b-a6cd-cca8b14461e2", "value": 86098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623925, "uuid": "9d176c5b-a97e-4aae-a588-e718f67d80c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623925, "uuid": "8efa7812-5470-4cd5-817f-dd39f44c78a1", "value": "diagram-505594424.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c356e8a3-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622154, "uuid": "2be4264e-5d5d-4fc0-8d2f-363a98f0968d", "comment": "Malware payload", "value": "a6e207c569f53297c164202430ea385b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622154, "uuid": "1d966b63-7e30-4403-87c9-3834dbfe740d", "comment": "Malware payload", "value": "20fd1500a2bddb259c180133d8a81fdfd79776fb8349e25046e2c0c6ba17ba38", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622154, "uuid": "946cafe9-c91d-43d4-8f32-d225c9fa0eaf", "comment": "Malware payload", "value": "95dc327a59bf64acad08624156bccf68c02a086c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622154, "uuid": "534a4928-4569-4207-ad24-1f5ca4989432", "comment": "Malware payload", "value": "db109618303192c0d977b39ac555db96ce790a7c84964d3d5e553544e4b95b17dafe5de34dc29e3f1774b01486d0b05c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622154, "uuid": "398591a7-874c-46ce-ae52-ba67a2d8c186", "value": "838302CC663DC5CF797D6E09A7DC88BFB40ED9742144208EE4CD566B8E8BEE718524A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622154, "uuid": "aaf7d4b3-834a-4cb2-a906-8118e5a0bc0f", "value": "1536:hG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttohWapVr6wjOrp:hGEhrHJoEsBMG7qzkWh7px4rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622154, "uuid": "faa7dd76-f3b0-4c7e-9e6c-b27d62ec5a32", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622154, "uuid": "9c0b64b7-9be7-4672-bb9e-a7e407f6be1e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622154, "uuid": "0de28885-fd68-44f6-8be0-fee2510df711", "value": "diagram-1174117908.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228bbc1d-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621025, "uuid": "9c0a31ff-b1ae-4821-a74a-c685e669d02d", "comment": "Malware payload", "value": "433af738c96bfc9d6e1982b5f4747708", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621025, "uuid": "17c3f710-e6fe-48c4-9446-a8a62435d183", "comment": "Malware payload", "value": "21231bfd269c5f34b4d091915fb9b8a6775595d6335e6afddbaf8d7aaf87d7b5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621025, "uuid": "5bc7c999-8453-4b4c-86c3-c2b82de23338", "comment": "Malware payload", "value": "18dc48422c3512d6596ea96acf3c09f0db10fb44", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621025, "uuid": "fddd29a1-81b9-42f2-85bd-b73835c8d7d0", "comment": "Malware payload", "value": "d7722fdda175db7b10915518b0bd046304d792590628957fd23035ef4cea62d9599a1d3f9785269402be9cda03ce7eff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621025, "uuid": "e3e04b44-563c-4733-aced-1592115069a5", "value": "B683027103AE8B1D74CE5E3954D22E8F2F97F8B82D195892541904E4E32BC669F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621025, "uuid": "661340ff-89f6-49e5-8510-7260a654495a", "value": "1536:xDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVRK:xDAysJADlV378P3RPVJLdtDsMU0dRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621025, "uuid": "37023a69-e703-4df7-b9d5-2a369f7e43a6", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621025, "uuid": "0fa9e336-18f8-4464-a9c8-19c0f2d3065e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621025, "uuid": "69c5e78c-8cd7-4abe-9b08-00d1065c6b2e", "value": "catalog-349089151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd54777-a7ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619593258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593258, "uuid": "0d3a5cc6-16b8-49b3-9721-41ac5bf0d242", "comment": "Malware payload (Dridex)", "value": "a07002a0af8ea9cc240151c093dfd628", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593258, "uuid": "a552002d-b061-4af3-8e59-9229c0590460", "comment": "Malware payload (Dridex)", "value": "2142beaa9e5f9399ea149a029fb2722462bcf7f78e5b5e0b1142d4c575b9295c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593258, "uuid": "367958d5-6fa3-4ea7-944a-3cb1bb24a212", "comment": "Malware payload (Dridex)", "value": "0cca04efdc547a46346a6d23db2ad7680f0a56d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619593258, "uuid": "59644cab-bfb7-4743-884d-5c0b01e3d85a", "comment": "Malware payload (Dridex)", "value": "88d3425c31f8c38bea976b454ab0900e6c23b8f7f0e3361ce08411fff4463e0c41e21a8f8b9dbd15f2c134fbc0c8fa36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593258, "uuid": "1e753e72-3884-4ee1-9775-0968d734dd89", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593258, "uuid": "2e5a6482-3122-42fd-b923-cbba49ec9430", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593258, "uuid": "b8397c04-3aff-4aaf-bee3-7806897d3363", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619593258, "uuid": "65d4c50f-041f-4ad6-b194-5b351b120a2d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619593258, "uuid": "62187f7b-70f0-43f4-8ac1-b3a1a4583836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619593258, "uuid": "609c9492-7473-4b27-bfc7-9d6d04b57b46", "value": "a07002a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e497357d-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626934, "uuid": "ac3d372e-f575-49a5-a837-2d678add9ba2", "comment": "Malware payload", "value": "5c55424a2893cc55659d0ac2a562fd4d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626934, "uuid": "0ea7cc65-9c69-40f5-90e2-709262aa9ba7", "comment": "Malware payload", "value": "2158ac80da345ffbc4661213228da0fb5ca09d4f57bec6d42db8ff0bad97ec58", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626934, "uuid": "fd52a28e-84e5-4b12-b734-461fd0e262cc", "comment": "Malware payload", "value": "e726537f5def7064036ce10646990c603fe897ba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626934, "uuid": "1b7dba55-772d-4a36-b436-b335d1f8992f", "comment": "Malware payload", "value": "d2e718eeb570f503e74682674eda2c24678ce5b181684bf1459132f1a7342e21e3f526e7bc4a54c1608ec82d74dfba72", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626934, "uuid": "a2d2978c-be5f-49fd-a6b7-cfc3216ba1b5", "value": "9B83021523BAC998F4CD9E2D4CE30D8F3F42B978281ED5F56229019AE326C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626934, "uuid": "b07b06df-2128-4ed0-9076-202dc75cdefa", "value": "1536:KDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdaPqXT/WkO0B19M2V:KDAysJADlV378P3RPVJLdaqXj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626934, "uuid": "5806ca95-3e72-408a-a45d-9a9dc43d877c", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626934, "uuid": "c4c6c93c-b743-4539-8157-ab617af8a028", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626934, "uuid": "44684567-9013-444c-afb2-23526d039cd6", "value": "statistic-609895458.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7deb5f-a875-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619650840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650840, "uuid": "0e1b4430-b3f0-432a-9fc3-3cde37021a49", "comment": "Malware payload (Quakbot)", "value": "39bbdd8712dd4ce30786fda0ddb15e2e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650840, "uuid": "d1e9e808-9d6d-4ee4-86b1-acb5d7fc8e10", "comment": "Malware payload (Quakbot)", "value": "2165dfdf3df58650912acdbeb56c6d2cba0f9a02f27d69475b7f92dafc6c8b32", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650840, "uuid": "a26c1019-3316-4308-9e25-b7bd1c5ea9c8", "comment": "Malware payload (Quakbot)", "value": "37fb233bc23651040ef409a4be9b9fa675d17545", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650840, "uuid": "504ee417-c0d4-4865-a404-35be169beeca", "comment": "Malware payload (Quakbot)", "value": "ad2f229f8b8333430078d9eb1c6cf955714ded8a971d6250e36ff4bdd9e1a68e8d629e49cf1ccf1228efdec1fbb8b811", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650840, "uuid": "ce7b7c5b-06ba-441a-beb1-e0503a56c564", "value": "B8947D396A26D063D2BC27B143C3EF580E67EAD57234540622A2DF183EB6395BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650840, "uuid": "a4696e0a-3224-4d9f-b465-458160f7f9c0", "value": "300c10a50c3de5414c631eda8f77fc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650840, "uuid": "2573b3a8-5851-4c08-98d3-b283918f83f0", "value": "6144:IyPKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNT3wU7HuAmU:ATwr03pdf8vhhOKJET5ByU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619650840, "uuid": "971aa7af-c395-4124-bdec-4edc25592e5e", "value": 417760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619650840, "uuid": "fc7b14ef-20dc-4103-afdf-83bfc2987ac2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650840, "uuid": "99882cd7-a656-40ad-8d66-ce870c0bba6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc1dec6-a837-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624289, "uuid": "ce37e8a9-6d87-441b-91f4-333240172089", "comment": "Malware payload", "value": "22172d1dd17360666f6c65e9e078f000", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624289, "uuid": "7001a6d7-ffa9-4d0c-bd17-eb9de6414958", "comment": "Malware payload", "value": "217a99f2fb38b870c40d76508db96479be2ff409399be32a6abe5f94d8b6ab63", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624289, "uuid": "f7891b67-5bd0-4a1d-b9ac-263070ec491b", "comment": "Malware payload", "value": "a63a109313d7e2e571a8fdac8edf991416f38696", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624289, "uuid": "6d5b4e6c-401a-4dd9-bc34-5edb2406377a", "comment": "Malware payload", "value": "47fa4d6746f1f81c291d86517e682c1bf66c3f7722295b051192933df853f23c52bbdf13c8f746d4e0ef8977f22a626b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624289, "uuid": "7106d4a5-1765-437c-a6e1-21273706cd65", "value": "D183028C3138C5DF37BE6A04A2DC887BBD09D9B53504385EC489655FAD8AEAB0C9F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624289, "uuid": "89210d40-1d32-4be2-b89f-cf57a20b4e65", "value": "1536:MG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+p2:MGEhrHJoEsBMG7qzkZQxO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624289, "uuid": "f0123be9-2483-4677-8093-3dff05adbad0", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624289, "uuid": "6af73668-1b9b-4d5a-af3a-18a2a1daca1e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624289, "uuid": "122a8762-8c88-4280-bf75-aea1ff0a9b3d", "value": "diagram-662328021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a7bab3-a877-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619651704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651704, "uuid": "5a4bb72d-c568-4834-9d9b-19c2931185a7", "comment": "Malware payload", "value": "d672194165a7b978e19ecde87bb4b373", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651704, "uuid": "a9d54a78-854c-4c47-ac4a-5926d86b5d47", "comment": "Malware payload", "value": "2181fdf09d22e0b55db7e70914eec71ff98d55f0f4899a9f5ef9dba1f2ad9792", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651704, "uuid": "bb359f4c-b044-4608-bfab-bb6911ba50c8", "comment": "Malware payload", "value": "ed9411c50536e8ec1fe7242679ce3af72893fa2f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619651704, "uuid": "ad624ff5-71f1-46c0-9834-b114b8094e96", "comment": "Malware payload", "value": "a2f84a7a8549c4a8ef43747c64b00807547f8db243d33005495298f40b6a91e599f12fc0b471377bf662cb33580649ef", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Naikon", "colour": "#040C13", "exportable": true, "hide_tag": false }, { "name": "Nebulae", "colour": "#857B56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651704, "uuid": "c3522a24-9f2f-4fce-9b13-d0613cb44f2e", "value": "F2147D01B492C436D6BE05340476EBB65A7D7C314BB089EB77D44E7E8E302C29A31A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651704, "uuid": "f7180f47-f866-4896-8dcb-7a7d7d578999", "value": "b0687c79d79f20ad5f33a14f132f2674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651704, "uuid": "9dcf26a2-a204-49d4-b659-6c852d253766", "value": "6144:xqKIErL30UYcDd5OR2QCkoqursAO4AOJljg:RrL30UYcXORPursE1jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619651704, "uuid": "a6496b10-79e2-440c-b9a7-5784afefec71", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619651704, "uuid": "aa15f981-b3f9-4a3e-bf7e-975eaaaa1847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619651704, "uuid": "5a98d97a-4578-49bc-945f-df1561af2ef2", "value": "2181fdf09d22e0b55db7e70914eec71ff98d55f0f4899a9f5ef9dba1f2ad9792.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d246941-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620667, "uuid": "88419f88-f8b5-41e4-b64f-f7c052ffc4f9", "comment": "Malware payload", "value": "274a0e6d39eb25c5c4ccc30419cdaa35", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620667, "uuid": "f22d9153-5a0b-4a7a-ba24-7a84811eaa7b", "comment": "Malware payload", "value": "218dfc7a5c7442ef424e30fc47ab9ed7d7df0b121d4221b0ad5fd0358463a43f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620667, "uuid": "f057aa35-b2d3-4916-832f-fb0b41d171fa", "comment": "Malware payload", "value": "14d8de193c232ca92fdd44c9582a52a89c320415", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620667, "uuid": "4499a9ff-a67b-4439-9b1f-7b139b357bd3", "comment": "Malware payload", "value": "2af986f99f7ce79251cf355667a46175f31fa15c4b3b0513c6950b3c27bf444115107cd04b47827d8376aa94c89e8218", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620667, "uuid": "2d00d162-afee-4a22-bcb8-df07a9858b44", "value": "5483027103AE8B1D74CE5A3954D22ECF2F97F8B82D195992541904E4E32BC629F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620667, "uuid": "eb09529b-2779-44e4-801b-2cfb9d30ee99", "value": "1536:LDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd3DsMrbsTmHvVRd:LDAysJADlV378P3RPVJLd3DsMU0dRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620667, "uuid": "3ebe53ba-c670-480c-aefa-7c399a7680d3", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620667, "uuid": "6f632891-b939-468b-95bd-5d35814e77ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620667, "uuid": "b6d83bb4-41dc-4d62-b6bc-68aa803847c8", "value": "catalog-2060746789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56688f04-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646882, "uuid": "2a0efcb3-c150-4c45-9dba-9297056514c0", "comment": "Malware payload (Dridex)", "value": "7f365dd0e044942a616bd04e538301bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646882, "uuid": "c0bc8ade-b00d-4d85-82e2-ccf56631a939", "comment": "Malware payload (Dridex)", "value": "21a055401a7b18e77cdadc46c59650c0b28930e945863867128ba4286b6ab899", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646882, "uuid": "7fe5ef72-8e91-468d-834f-5c0b5852329d", "comment": "Malware payload (Dridex)", "value": "82f30ab4f7bbed9144c70241c3c4010011949818", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646882, "uuid": "25083dcf-36e8-4727-ba4e-6928d250db9a", "comment": "Malware payload (Dridex)", "value": "0d20ecc01be916f5bc00ab22b7b021b80084461862521a767a588733bc67a2654dad1d5da626ce3ad26f1027eb893f1c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646882, "uuid": "cd742396-5d8a-4a19-bfb1-d04c32fca66d", "value": "39F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646882, "uuid": "def94b95-276a-43f0-9ac0-f9f453485104", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646882, "uuid": "3e4d34cb-1916-4b07-bfcf-d9a25cc9e912", "value": "3072:ooSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2aGkFY:XnS62Fl+pkeJl3CvRStrFl+EYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646882, "uuid": "4f047beb-fa55-4457-b8aa-cb74a5976223", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646882, "uuid": "1d9372e1-725d-4d0d-839b-aff744834344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646882, "uuid": "af311c73-3627-439c-96cc-fad4b094e89e", "value": "7f365dd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8324b28f-a836-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623764, "uuid": "2f112901-7482-43ab-b1cb-ce7b1cda89ef", "comment": "Malware payload", "value": "de406ebadf63ccc10aa0acfff50e5879", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623764, "uuid": "1dec38b6-42c2-4ac6-8b10-98ee9667e639", "comment": "Malware payload", "value": "21b677998c494804f13b7f0a2a9cc2218b39f443f599886f16967aba2ea85b84", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623764, "uuid": "3c434467-7b60-4b8b-9c18-c01b6456b214", "comment": "Malware payload", "value": "c181d97d69f34956c801810e9a4c3203b9974044", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623764, "uuid": "5e477b71-20ac-4d78-b594-e99c9800ae7f", "comment": "Malware payload", "value": "3c3911d21f1484c960974326f78cc973186767a3a92d0e285e7eb686ec929f1ea3af3e697284f576a23cdcb68dfd6f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623764, "uuid": "123c293b-6570-4470-b85e-e431b19edc98", "value": "1E83028C3138C5DF37BE7A04A2DC887BBD09D9B53504385EC489655FAD8AEAB0C9F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623764, "uuid": "4dbfa55c-e538-4ad7-a3fe-6da391485032", "value": "1536:mG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+pc:mGEhrHJoEsBMG7qzkZQxO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623764, "uuid": "1372313d-59d2-45b1-8ef5-ed0d03ee7ca1", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623764, "uuid": "411e7216-bf67-421c-9ce0-81f688599a5e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623764, "uuid": "245d3d0f-566e-43fb-b20f-4cb036714d4b", "value": "diagram-400400841.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5d7f6b-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626675, "uuid": "ab657ca7-f2fd-49e0-854e-a3acf1cc73dd", "comment": "Malware payload", "value": "2a230d6c2247d4e66b4c589bfb0810b8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626675, "uuid": "f136f2b9-f36a-47ec-8094-75ab1c1e1a95", "comment": "Malware payload", "value": "21c0d046e44590ce828dfd3c8b86020696ee42f2c1b1b3bfeaa4476a8e92f290", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626675, "uuid": "67b0df05-9df4-4071-8fc8-e6d020a752c4", "comment": "Malware payload", "value": "948a4ae47f6ceff3572112308717d82e4c58d7f6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626675, "uuid": "93fc3c39-3440-4b46-9438-457ae39635a8", "comment": "Malware payload", "value": "af76f07e0ae8dce3b0fc8fb12aab0158e5ba4133654dcab9614b459bff974623b3743bf106a0b8ff0a9a04bfa0fb9f43", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626675, "uuid": "ced7856d-ede5-4d9e-8725-bd670ac76771", "value": "4A83026123B9C998F48DEE294CE30DCF3F46A5742C1ED9F16229019AE327C960F3453A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626675, "uuid": "e73f4083-5c97-468f-ad72-78bb763eecef", "value": "1536:1DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdqPqXT/WkO0B19M2QZ:1DAysJADlV378P3RPVJLdKqXjIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626675, "uuid": "5923d7d1-c7ee-4a22-a72e-aec6cc41bdce", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626675, "uuid": "46051137-5f2a-4300-b5c2-322562ec48c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626675, "uuid": "ed70a66d-f887-4ae6-8c5f-11f215f2535b", "value": "statistic-420840600.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8467e839-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625914, "uuid": "2f972c9d-ab5a-4140-8d15-f87fb021bd32", "comment": "Malware payload", "value": "c09310a012607da5b651d5bb410659a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625914, "uuid": "fd53a2b8-5a46-49cf-8e73-d18f7ee51921", "comment": "Malware payload", "value": "21c6e69638123e6527cdd4622bc40fa78a3824a1eb7a39388245ce93f62a9352", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625914, "uuid": "d4b7f329-05a7-4029-964f-873d08ea6b89", "comment": "Malware payload", "value": "18ce0b602d7c3768617b97e20b5d1b377e1e3fdc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625914, "uuid": "0d5ab285-44ec-4dbd-8a45-4b61d97ddc6e", "comment": "Malware payload", "value": "6805c9403b2addc40b6ae29a09a948e9b86873bf27464d01a34245e76436656d67f4e351340eba135c6d198d18354666", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625914, "uuid": "5896263d-acc3-421f-b1eb-72dad2ee59a3", "value": "E683022123B9C998F48DEE294CE30DCF7F42A5781C1ED9F56229019AD227C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625914, "uuid": "54ebe3e9-1e39-40b4-b2ab-4e0ea6840ada", "value": "1536:kDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdqPqXT/WkO0B19M2P:kDAysJADlV378P3RPVJLdKqXjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625914, "uuid": "43c9f37f-4b79-4f33-8d50-f8cbfaaaee53", "value": 86117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625914, "uuid": "4b46a0a9-9df4-43ce-8993-8df8fa0903cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625914, "uuid": "049f8fae-fcc8-40ed-8069-e22db194f330", "value": "statistic-1846784371.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31430d0-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624784, "uuid": "fd8f42c6-5702-47c1-a852-f65c5d47a449", "comment": "Malware payload", "value": "8dab6275c4dedbdc0b11ee2abae98d96", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624784, "uuid": "7b21f3b6-c4ca-4bf0-aded-502ed14e690d", "comment": "Malware payload", "value": "21f292c7e226a1befd96f59dc326c20f53da906f47a0aa2ffafacc1f601c985a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624784, "uuid": "49120979-ec8a-4fc4-85e8-588066993d35", "comment": "Malware payload", "value": "b902c7cdc4b6e65851d1b8e5ae972e458e2b8973", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624784, "uuid": "e101e9e5-9f25-4516-aff5-724b6e5ce011", "comment": "Malware payload", "value": "8705006e2d448e02220ec8131e2ef7b0e47f61ef4fe7a94a9334c38ded3ec1ce2c8c27f9a151640b18dc3bd72eecbef3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624784, "uuid": "aa9cc61e-badc-427b-890b-c20091897ca2", "value": "2683024003FA4B5EB98EDD7548E20D8F2F4675B4191B5CB1A16E05A0F2324951F28D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624784, "uuid": "98e6ecd5-38ec-4062-bea0-bbd7bf3cbae5", "value": "1536:2DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGSgxkDUoj:2DAysJADlV378P3RPVJLdeSUoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624784, "uuid": "fbc9e8cd-0a7f-4f67-b116-b0a922af7c6c", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624784, "uuid": "42047754-7fc1-4b93-8c54-ae21e1f80745", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624784, "uuid": "2dbb94f6-ad66-4168-9d91-741f356a4774", "value": "statistic-1005851960.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec206c03-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623511, "uuid": "f80fd755-4ab2-4b42-b0e3-83c87f857606", "comment": "Malware payload", "value": "30acb66d510a36b160e9fc267844b976", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623511, "uuid": "20019bba-3cab-47da-aae7-a7cb618b7d46", "comment": "Malware payload", "value": "21f38f9d369dedf7ddbc94d1bdc5455a25c51fdf98db05f55df9a920dcfc010f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623511, "uuid": "05974d21-932b-47ce-800f-e7d40a21ac4f", "comment": "Malware payload", "value": "97ee7a28e177b3e54e96a6eeb2a06087d8316fd3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623511, "uuid": "f0191a7c-3ac6-4329-b163-d48a3cc7cd99", "comment": "Malware payload", "value": "be533b726eabdef6bbb608f4b980fbbb29f9b2ec4d46abf2091c48f86a9c5289131287469b14534f086ff77715f8b0c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623511, "uuid": "c709b401-949f-41f2-9fbc-e7d4cc7fe8e2", "value": "49830199203DC5DF717C6B06B5AC893EBD4D6CB5210064AED4D8266FAC4DAFB9CA3030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623511, "uuid": "4fd124b2-32bf-470e-b3c0-b8d3ee19cd0e", "value": "1536:WG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttcI5EzJKE9LfFSp7m7w:WGEhrHJoEsBMG7qzkeI5AB5gpS7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623511, "uuid": "e2635897-5610-4018-8e5a-0b95f45e129b", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623511, "uuid": "78428178-85d2-4cdc-bd32-b84d1b4d1040", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623511, "uuid": "1a101488-ba91-418f-80df-38a846b27392", "value": "diagram-218915493.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5c8b4b-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626409, "uuid": "00e3d2cb-99aa-477a-ad3b-d1f9e4c4442b", "comment": "Malware payload", "value": "a67b17625a037d948d953ffeec67cc65", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626409, "uuid": "545baa5b-bf39-4823-8dbf-056c73de15e0", "comment": "Malware payload", "value": "21f46d2d9311e0aa349fade2f28e65dd2e5b784a1daf99e705c4d390c0521a55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626409, "uuid": "daff929b-5181-4aea-8df2-fd8b73a350e1", "comment": "Malware payload", "value": "32243d5a5a82d860e1c56c28f2118ca21ff4e127", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626409, "uuid": "bc67d4a6-53e1-4c40-b64f-684663a636fe", "comment": "Malware payload", "value": "c3cf89f1bc67917a54d06ed12d496f5aefda58b4c0042586b2b741b3486069d7586fcc79d4f89d202a91789c06b92db3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626409, "uuid": "3d1282b0-8bf9-4cac-b708-917e9f0f356a", "value": "C18302A453BE4A5CB84D4E29ACA20D4F3FA7B6743D0E58F1B92D0485A335C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626409, "uuid": "ebf79177-5331-4a73-83bf-e86c96ac8d9d", "value": "1536:2DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd9hsMnSEwJPTmNKY:2DAysJADlV378P3RPVJLdLxpEDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626409, "uuid": "22fbffac-89ab-4a5f-befa-69554c413255", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626409, "uuid": "e3ae87e8-7b18-4f41-b4d4-bcbf62dc9d36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626409, "uuid": "2a239af4-e271-4f98-85d5-d6807a6b2819", "value": "statistic-242450514.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b284ec-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621705, "uuid": "c358a66f-f2a2-49df-90ab-4c98237fb664", "comment": "Malware payload", "value": "e9d7d9ef92ddaececce505b205cced4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621705, "uuid": "322ef68e-46a2-4bfb-b1d0-7338f618957e", "comment": "Malware payload", "value": "2200cebc4945c430a85d7630560a001fc04e6128f96c00d1dc710bcdab541e17", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621705, "uuid": "7566be92-3ad1-4b2f-bc38-e067762b91ce", "comment": "Malware payload", "value": "0465090f21b9b3a2bdc01b025dbc501b1f06fe1e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621705, "uuid": "5afd65a1-317d-4ebb-88e6-716fe2413912", "comment": "Malware payload", "value": "ade5483f3fa00a3d817bf752fafdef9c9993a97aae04410dccb834e54673db3cbc4998f8fab9d97781906908bede2ef0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621705, "uuid": "f8c43b89-85dd-42e2-a747-6a50eed7bc2a", "value": "5C83027103AE8B1D74CE5E3954D22E8F2F97E8B82D195993541904E4E32BC629F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621705, "uuid": "38fb8378-8f92-46d4-aa9e-f6cb9322419a", "value": "1536:TDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdtDsMrbsTmHvVR7:TDAysJADlV378P3RPVJLdtDsMU0dR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621705, "uuid": "2338a586-d6d3-4c87-9fc0-b69dd3117735", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621705, "uuid": "fa0e3412-c6c0-4023-9a74-4e9d6aa9cd32", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621705, "uuid": "486de840-677e-44be-9a05-c9db335ccaac", "value": "catalog-869726415.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324ff6f5-a83a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625347, "uuid": "81c3596d-c2ff-48c8-9e5f-470ab7bd450a", "comment": "Malware payload", "value": "9bee9aced2760a01bdeaf156281c5292", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625347, "uuid": "d7d5848b-005a-488b-a139-035695c564b9", "comment": "Malware payload", "value": "22113c419afa6ab3567b4b3d50149ca351c494d928a50539e0a48832e7d370b2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625347, "uuid": "d577f3d2-580f-4310-bdd8-d23a8b2c936c", "comment": "Malware payload", "value": "f2355917cac3b9d867ee372e502b4515d9040fed", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625347, "uuid": "3f81eed3-e6c2-4b3c-ada3-d8f4dd80f6a5", "comment": "Malware payload", "value": "f8ceac6875ece32ee28c4481e3e78763aeb6c83c6a5bcd218462c65de38a4f2e37ff28bb3bf7dfd8fe44254584d0978b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625347, "uuid": "bd5ed9d1-c5c4-4203-a776-a623ecf4c0ff", "value": "C383020413BA4909B5CDCA2D8DC31FCF3F57F8B415098962A65D0199B627C6B9F38D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625347, "uuid": "544d4bed-0967-425a-ad0c-7b2e531d453e", "value": "1536:4DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd08ZTrIKrVAN3n1Kh:4DAysJADlV378P3RPVJLdcKuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625347, "uuid": "03bf354d-00da-4ae9-90fc-9cc390f1bc92", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625347, "uuid": "ec583fbb-69a9-4c0c-a195-3503b3f99161", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625347, "uuid": "cac7f340-9712-41a8-bf03-c3fb7b57c0b2", "value": "statistic-1424426219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1ece0f-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647103, "uuid": "e2d4d32c-8332-45db-9421-493abe3351c6", "comment": "Malware payload (Dridex)", "value": "bf329400fe4d6bfa2b35260ea53312c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647103, "uuid": "8388d5e7-09e7-4293-8412-7e96cb7e9f57", "comment": "Malware payload (Dridex)", "value": "2219c77b1a363dd2835ff5e9d9a0bcb00fb0927b5bd16c9d0ea9be99ecd99bf7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647103, "uuid": "1f84608a-2c19-4605-9db1-07eb3027090a", "comment": "Malware payload (Dridex)", "value": "37bcaffbccb93a33821a2240196c5e20d9589687", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647103, "uuid": "0ff4dd2e-f5f7-45df-b338-f07b30af0255", "comment": "Malware payload (Dridex)", "value": "27c41d199c2b5c24701476d990de100bc1bfeebc2872bdb402b2d7712bc54ede57d0f3308b91c2f3fcfc15c537014aba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647103, "uuid": "e4f67849-4fd0-4fa5-8f04-001d5236a882", "value": "9CF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647103, "uuid": "1922d121-8fe8-4e38-a299-7e27ddd02887", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647103, "uuid": "95307dc4-e409-4160-9c8b-3ab8e9749ea5", "value": "3072:0Z8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY3Zwd:9nClX8WZ7/HrRCADTR0VlZZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647103, "uuid": "c59d21b4-90ce-4faa-85af-9d053cfd96b7", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647103, "uuid": "0856cc34-5b6c-41e5-a972-af4564720ed8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647103, "uuid": "c5c743ac-aae0-4b40-b101-9bc6307e7a48", "value": "bf329400_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b90324-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619883, "uuid": "785d37f7-f987-4785-820f-a770cbcb8d84", "comment": "Malware payload", "value": "d175a2f6a41aadc19ea4005b780e52db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619883, "uuid": "645edb3e-c621-4e1b-ae65-3df936fb65a4", "comment": "Malware payload", "value": "221a27a87c3643a01f0b70186a0c92da4e284b9bc4bfcf0c4d90a5d51c9d1959", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619883, "uuid": "552da996-8ccc-440c-8077-3dc9a2125e3b", "comment": "Malware payload", "value": "814a39af43cc2354c5427e2451c09fa813767665", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619883, "uuid": "6372b890-f7dd-4051-9ea0-bf00e5ae326c", "comment": "Malware payload", "value": "7a15ab527491317bd5ea316547744046e253cb150d1e64aad82e26f773eba0712172ec838ff1530706c03e972a5f727b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619883, "uuid": "35dac05c-ee0f-4f0c-825f-b4e2d1849076", "value": "AF83129063EE8ABDF4CD9E2855F20DCB192EF574190CADE2A66E04A493314422F24D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619883, "uuid": "19c8eec0-cdc4-4387-ae12-01b03f33deec", "value": "1536:jDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLddeJx9awOnleWI1HD5:jDAysJADlV378P3RPVJLddeJLOnleJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619883, "uuid": "d14cbb02-f9e0-41a7-aeef-2f852fcf76c1", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619883, "uuid": "d703d17d-ab02-4e77-ad42-9901709a775e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619883, "uuid": "58e87fd2-4398-4904-a8f6-6d686f98c2ce", "value": "catalog-1600037195.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729f6635-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620730, "uuid": "28c8aeb9-28f8-42dd-aee5-0edb58651b42", "comment": "Malware payload", "value": "0c305d5469844ed7fc10223acded2e5b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620730, "uuid": "84ef4633-9e4c-480f-8260-ccf89bc00d19", "comment": "Malware payload", "value": "221b3a1de4520a8d085e34fe781b49a7e918d1a304f66c52a9d910a6d55f8522", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620730, "uuid": "7d2c3496-5add-413b-9b03-8155024b9c55", "comment": "Malware payload", "value": "d86d0e76c18906fcf6a29acf790511e235b5e0eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620730, "uuid": "6d6e9a2e-272b-4841-a8a5-07bc1f49a696", "comment": "Malware payload", "value": "75cf593cbacd12a7a0aabfdc57e5dad75adc7d13c43a8e9910205ce07a181eabf868ae93add6c405092a742b9d180b63", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620730, "uuid": "9424ba06-5341-41dc-b7bd-9cd6cada6e64", "value": "1A83129073FE8EADF4CD9E2855E20DCB1E5EF974290CACE165AE04A492354462F3493F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620730, "uuid": "18324828-153d-4515-9bd1-077e62761077", "value": "1536:rzDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1H4dVk:nDAysJADlV378P3RPVJLdIeJLOnleJYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620730, "uuid": "9e4f35e2-7c61-48f4-ba73-d86d6acf32f6", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620730, "uuid": "39c109a2-ea11-4b8e-b001-580543c98676", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620730, "uuid": "448995d1-94c5-4c17-a8eb-aed1f05bb5a0", "value": "catalog-2096848261.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9044e683-a875-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619650845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650845, "uuid": "b60a70d6-c921-45c6-927f-42f365c6bbe2", "comment": "Malware payload (Quakbot)", "value": "303c4a2b6de620fdc3981c8e89853edc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650845, "uuid": "ca10fba6-a770-4ed2-81c1-905b9e41e612", "comment": "Malware payload (Quakbot)", "value": "221baa781f0d180640445b04e3f70b4fa654c2d9ef75f0439c35b3b0f4c019d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650845, "uuid": "8a98e1ee-9d36-47fd-a005-a97d82f7640e", "comment": "Malware payload (Quakbot)", "value": "e101ea7697a77204e968cb0ed3381e767e9cbfc3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650845, "uuid": "c35ca96e-8306-4bc2-8729-4548fca3fdb9", "comment": "Malware payload (Quakbot)", "value": "0809a8ab0d30a4093c6e66f827508773a8508681a60abca9a95e56e37bd1037a06b6f1c7bde48069a7e829ce3dc656df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650845, "uuid": "2732b8b6-a352-4110-a6d6-dee8c11a548c", "value": "B3948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650845, "uuid": "b1798986-0240-4c87-a06e-b1951786dc9a", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650845, "uuid": "3d60595b-854b-49aa-9d38-1f17619e52e3", "value": "6144:OVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWrav:3FNmLKSVpJbPT+4xr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619650845, "uuid": "5a840ca2-948a-4813-ad7e-a0130a6c462d", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619650845, "uuid": "c826f9bc-17e2-4a94-93e5-62ad371bff87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650845, "uuid": "5c8bf7ec-6e4f-444f-8f51-eca9dd914580", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d468bba-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620694, "uuid": "c16f6f09-5226-44ca-9980-bb1ccb7ce7cb", "comment": "Malware payload", "value": "82ed7e97a8bf681ea31f6bcfc4c5038a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620694, "uuid": "92db7fdd-77fd-4674-861d-60ca1e7d77a3", "comment": "Malware payload", "value": "2241147c581579fa0befaaedf31bebae7a98c4c7dfe0aa1ff7e28839d935dba3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620694, "uuid": "fa0702be-f5ed-4154-9d78-e8958d55d3a8", "comment": "Malware payload", "value": "98663f3ba104bc509bb07833e1f170f2b2c326b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620694, "uuid": "725fcaa9-aedf-40b6-b2a2-3e4f64a86bef", "comment": "Malware payload", "value": "25a7e9e14798494f540bc0504ec574fdaa4edb0483b3af7d90d3c07fc0d47b536b8a7a9b6a6b4b8734d1af4d2650fcb0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620694, "uuid": "ab2b2828-2dc8-4d4c-835a-ab146156bef1", "value": "9E83023103AE8B1DB4CE5A3914D22ECF2F87A8B819595993551604E4E32BC629F38C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620694, "uuid": "0139196c-f500-459b-aa92-ece246c99d36", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRi:DDAysJADlV378P3RPVJLdcDsMU0dRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620694, "uuid": "4d64c8ff-862d-4d5b-b9d2-79755b8f95a2", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620694, "uuid": "2f6cc566-0558-4332-bec7-fb226c9788d6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620694, "uuid": "69a0a35f-db9c-4d0a-8d9c-611bfabf6175", "value": "catalog-2077275486.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8922e049-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627210, "uuid": "3deded7d-ad86-4975-9ea9-3170dd3af742", "comment": "Malware payload", "value": "3ee950b38af9201cf36a1383730a4db0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627210, "uuid": "f31f0714-0e6d-4b05-a543-e9b2751f6a20", "comment": "Malware payload", "value": "2245f1bae197e38a6e5b6605917aa8dfadd2cc0582aa746d483ae300b3fdf05c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627210, "uuid": "a8eca1ba-2505-47c4-82c0-c35f4fa952d6", "comment": "Malware payload", "value": "a1b82557e2357a40b239e5751eb072ccfa422ce5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627210, "uuid": "605bf815-4323-4ebb-a538-dc14684f114e", "comment": "Malware payload", "value": "593ba492af86fbecc6d32f3108633632b430765133278c6828be2986a51d4506fddd8fe6d74a59dde02b5e00c4bbd9dd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627210, "uuid": "40f363a6-f7d8-4e0d-977e-34fc5f1270a6", "value": "F283021403FA8919F48E9D3DACE20D8B3F9AF6F43D0A58E1966E0455B72AC611B2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627210, "uuid": "df9ece77-24c1-4ad1-93a4-f2305d62ae89", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdTgKXsth8wB8tKv:CDAysJADlV378P3RPVJLddeh8wB8sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627210, "uuid": "7f049a20-cadf-4424-822e-b8306c737367", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627210, "uuid": "37af62b9-0f88-4b00-86b2-169bea2ae6c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627210, "uuid": "220000b9-24e2-4590-9374-0a81b72f1fc5", "value": "statistic-77474555.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db02621-a86e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647673, "uuid": "d23a0157-efc3-424a-920a-4f8d7857206d", "comment": "Malware payload (Dridex)", "value": "ed36bc8c60dec9f7af1179d949441cf3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647673, "uuid": "89897ba2-c7af-4c73-86aa-a64132f6e667", "comment": "Malware payload (Dridex)", "value": "225f6a04e6e833761ff7ffbd0c388a4f1aee3555334519625106459daf8e4327", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647673, "uuid": "56a63fb4-ad63-44e5-a408-373375f281dd", "comment": "Malware payload (Dridex)", "value": "0b95c38277589f0a707b7fbca53759a62b4271fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647673, "uuid": "aa760974-2bbc-4b9b-9112-4d8a4e3fce2f", "comment": "Malware payload (Dridex)", "value": "461c3f2e9917aff16e5582199004a15d78bf0289794db59a4582b70528a9ec39b75aeca5c99319ad816903702af5e559", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647673, "uuid": "cc2762d2-5314-4da6-b7e1-3b011370faf8", "value": "3CF3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647673, "uuid": "caa2f55c-773e-4ab0-8232-751ab8f7c3f8", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647673, "uuid": "4e3c676b-7594-4bcb-a1eb-e7f5c3be46f1", "value": "3072:sIT2d85tleLD51fC5AHYEoefukoTFMpGmje8D:uy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647673, "uuid": "8728bfef-e7c1-4652-bc58-1cf7c6dc52be", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647673, "uuid": "37719a27-4ac5-4248-aa93-7b8cfb6a4447", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647673, "uuid": "995b0542-cd73-4df1-bb3a-00136663d2b7", "value": "ed36bc8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74b0095-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621302, "uuid": "36305d5f-5c7f-4f4e-9c5e-b6c5ece8cc53", "comment": "Malware payload", "value": "d3b93979988c48b73cfc4fdac01ce071", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621302, "uuid": "d6a75be8-a1ef-4e3f-b53b-41a38c9cb234", "comment": "Malware payload", "value": "226f2753b70806e3c16b1ac7cb9957de56f4254fdf6e8a4f4edcf5aafd3ddf50", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621302, "uuid": "9a6bfecc-92cc-4073-9d3b-412f9cf366c4", "comment": "Malware payload", "value": "f6b66a77ee9f2f5682dff7ca9d52e39c165c8f1f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621302, "uuid": "a7a6ba21-4a92-40c3-9854-376b358a5be7", "comment": "Malware payload", "value": "7841cf6b8f271677cc1aefe0b0fb0fc941efd493623784372143044a2bd76937be4f6f6891e789a1be0b753bcf1ad6c0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621302, "uuid": "043fd397-f23a-4642-aca8-78a6f40257b5", "value": "E483021513BF564CB88DCF2D9CA30ECB2F4BB974251968F2A55D00D8F6338425B18D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621302, "uuid": "613d1598-09b6-40f2-9123-3c2ccb1f678b", "value": "1536:CDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsRP6sCO0Py+:CDAysJADlV378P3RPVJLdC6s90Py+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621302, "uuid": "d656bfd5-aebf-4b6d-90a5-7f868daf2634", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621302, "uuid": "4f724cdd-e67f-4bf2-8790-c727eb4815f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621302, "uuid": "aea326b8-21b5-4a03-996f-ca0421f966ac", "value": "catalog-545550637.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a54b807-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623320, "uuid": "655643dd-a64b-4129-84ea-016362a287b3", "comment": "Malware payload", "value": "1c21b1a190d8f63fc2267fc8be2b3e98", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623320, "uuid": "33bae44a-b5ec-4727-b6d8-25c6c895e0f7", "comment": "Malware payload", "value": "22778fb84ba24c9a2be205ca29ad992cc0cd970313004520caed302e448e5fe0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623320, "uuid": "c07d8325-b4b0-4ef0-af01-cd09b2e7e189", "comment": "Malware payload", "value": "002f9360b9041d2df7fa5fdd7ad1aa699b87532b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623320, "uuid": "041c3dd2-a112-4552-8dbf-16266ae13bb8", "comment": "Malware payload", "value": "30e65c7cf3910755020872eda5c3ba7d9ad8c751f9dd1ed84002d42af75cd72f9f79df0d84aa2c1d74bfe969fc933a89", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623320, "uuid": "6c0efd1d-04d1-4149-8ed1-4259f5406324", "value": "AD83028C653DC5DF3ABE2E0991DC887E740ED8B43108154ED8C8666F9E8BFE75856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623320, "uuid": "6f7a8b1c-c8df-4b4e-8fc9-2bfa4f29deee", "value": "1536:JG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt9KkApVr6wo+RxT:JGEhrHJoEsBMG7qzkDxApxTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623320, "uuid": "48cb4645-2769-4152-ba7f-4cf1068df5f8", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623320, "uuid": "c8ffd1ba-fa0c-47da-bc09-3de5973758d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623320, "uuid": "9f98e79d-f379-48f6-817e-9dc1439b6c64", "value": "diagram-2008237067.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ce5e10-a82a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619618484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618484, "uuid": "c9a6d621-68cc-474b-a355-45f1962cced7", "comment": "Malware payload (Dridex)", "value": "4318699d7ba7ecbb75ca3d95abe93ec1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618484, "uuid": "77f01236-45cc-4aee-bcb1-2b4663365dc8", "comment": "Malware payload (Dridex)", "value": "22859a076d0dc39be36cc9b4aa2844723cf8da995cf9796c6badd53d4114ae13", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618484, "uuid": "5579dc1b-6436-4bf2-903d-236ddca227bb", "comment": "Malware payload (Dridex)", "value": "921ac5659d085a3550af09f6c1595cdeb4b3a062", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619618484, "uuid": "998d55a7-c09c-42d5-97a4-0b817917f313", "comment": "Malware payload (Dridex)", "value": "6f3b9018cf0dc989af425cbf8f0071e1cd35e8f05faf817e518515fcc4de75522cda626025f51cf1b63b100402f40ed7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618484, "uuid": "751b4d3c-b6c0-4996-8f7a-121f40f226f2", "value": "6DF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618484, "uuid": "b9364f14-03d6-492f-ad2e-6a3edea690cd", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618484, "uuid": "74fff560-eed9-4975-8cb1-9867e36b3004", "value": "3072:QA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619618484, "uuid": "0bcfcb40-b4d5-472f-95b3-677657598656", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619618484, "uuid": "2c5f11a5-b275-400f-b815-56b449c126da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619618484, "uuid": "b51f2c81-8d1d-4cf6-b7a9-cb747584d850", "value": "4318699d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd64d700-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622171, "uuid": "1486e43a-1eb5-4bdf-943a-a3c21b181ff8", "comment": "Malware payload", "value": "7e3f13a69ce8e19d6109299114078a46", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622171, "uuid": "e69f4382-6c7e-4911-b156-1b79ba4a1d7d", "comment": "Malware payload", "value": "22932a593a2a8e4b53af8401a48959c008a6d111f298d1ddf8485e3eeee5ca68", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622171, "uuid": "63092cd5-36ad-40f5-adb2-3baabedb568a", "comment": "Malware payload", "value": "21b284b2674be655b6d27e78be47b6d7aebf052b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622171, "uuid": "770808fa-bccc-4ca4-97be-c67a23f78847", "comment": "Malware payload", "value": "abcaf2b50b2e580a684aad840d4c3b9c7a56f2f8aac6627bc7d30a29d76f0328d07b984d38498e242117027ce1ff0b53", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622171, "uuid": "2c6f20dc-34af-4849-a515-5a7bb642b045", "value": "FA8302CC6238CADF727D3E4AA6D8C43A790E98BD3040349DE5C066AF5E899E71C97470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622171, "uuid": "5016d9e8-5811-463c-81b3-92090f4376e0", "value": "1536:YsG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttZgEVejoGrUm:BGEhrHJoEsBMG7qzkEEVerrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622171, "uuid": "185aa0b0-2c49-4419-aba4-7361de4d3a98", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622171, "uuid": "44b7ea43-730c-4a10-adf8-4f018ab31c21", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622171, "uuid": "99b86c54-24b9-4c74-b5be-a9c0ef59936e", "value": "diagram-1181659740.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a79e148-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624635, "uuid": "bfd1e120-edb7-4197-a6ba-43fa29434b2c", "comment": "Malware payload", "value": "9bde0363a10a36af13baa1d03edda3f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624635, "uuid": "0fbad352-3926-4768-ae96-4dd02dade0ef", "comment": "Malware payload", "value": "229feb63f089e25c13ffd0a3a77db2ad59a4ac55ab9d5de40ba2bbd69cd2e1c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624635, "uuid": "ff0b3972-9c3a-4935-b980-2f8e48c32f51", "comment": "Malware payload", "value": "c645a9dcb4d1f9ff3cf671d7efd41d9166153dec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624635, "uuid": "048b1980-89f8-4d3b-9ad3-512337c93eaa", "comment": "Malware payload", "value": "b4899368761fa15b7e20ce6b81c1a3e1c426bc6a99590b10c6d6e4513163f4aba375a240944eebbecaea6161be39eb85", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624635, "uuid": "76935345-efeb-46a0-bfc4-c193a1a6de4c", "value": "C083028C3138C5DF37BE6A04A2DC887BBD09D9B53504385EC489655FAD8AEBB0C5F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624635, "uuid": "d05659c2-a409-4b36-bfa0-0c233cf77aa8", "value": "1536:NG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+pA:NGEhrHJoEsBMG7qzkZQxOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624635, "uuid": "12ecf6ac-c2ca-4f84-91e1-cfcd4ec28027", "value": 86099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624635, "uuid": "966aa6e2-9bce-4837-bd1e-bf650023f06f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624635, "uuid": "6a556671-6276-4419-ad6e-ec3dad388646", "value": "diagram-895276043.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e548ac7-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620615, "uuid": "30ad3c20-4af3-49b2-829d-5236467c9bd5", "comment": "Malware payload", "value": "19d7cdfc3ae1cc36889ab1631d6f196e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620615, "uuid": "676c0748-7022-410f-8060-34de78e7a327", "comment": "Malware payload", "value": "22a41e17dc80f3ca66038a85fddf4ae977fee7fd1fa038e5b3f911ec6d92641e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620615, "uuid": "c87a9d47-6c47-415c-b4ae-1ed696c371b2", "comment": "Malware payload", "value": "a6706b8b94d49b4bd1c99a26876ec1f41a395ad1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620615, "uuid": "142aeb02-c090-4ee0-bde6-b46a926aa6f0", "comment": "Malware payload", "value": "48f73647b747d80de6138f5b14050ff783643495995fee922d31020f15d6749a2d172ba5faac71dda5c0b2593c85a32a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620615, "uuid": "4f25899e-4f41-4d0b-94fe-79286b437d98", "value": "8183121413B94A5EB8CE8E296CE31E4F2B9AB8F4192B54D1794D04E1F2374660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620615, "uuid": "1552032e-c9ec-434e-814d-8ce2c1e47a28", "value": "1536:rDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wJ:rDAysJADlV378P3RPVJLdP8BX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620615, "uuid": "d0cea670-52ab-4811-996c-f502ebabc4f8", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620615, "uuid": "f8c16b18-d676-4760-84d0-be291a9beb42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620615, "uuid": "913e5cae-d9c9-461b-8e0d-7f76b78e2674", "value": "catalog-2029821394.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58947b49-a83c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626270, "uuid": "9f7e4a36-bb1a-4b2e-87e3-54a7fd1e5768", "comment": "Malware payload", "value": "84e10dfbe390a8cf61039744e3ace516", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626270, "uuid": "c73cc3cc-701f-4959-a6be-3307cde11d26", "comment": "Malware payload", "value": "22ef88eda41668d4ec645e5d547051d9296e302381107bb51acbf70eba65dcfd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626270, "uuid": "599e580c-64e2-459a-a9a5-e59345f18070", "comment": "Malware payload", "value": "88e1815af4df76b6b97215723ab8df2c9c2eb089", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626270, "uuid": "430cbadc-2b66-440d-8de5-285f2a31a024", "comment": "Malware payload", "value": "3e8fad4ee32871ff7c0d9c1ecbed3973fd581fcba60ba6b795d9a7a737afdb1888357881c00fb81ac54dbae4dcf2a951", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626270, "uuid": "fe6874e3-d759-42a5-b153-4afb7a213de3", "value": "F58302A453BE4A5D798D4D2DACA20D4F3F57B6743D0E68F1B92D0481E2318561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626270, "uuid": "db69aa39-a425-48d5-ab82-bf32d9c5831f", "value": "1536:PDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmZg:PDAysJADlV378P3RPVJLdBxpEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626270, "uuid": "29dbb3cd-1c1b-4c1d-804c-2c8821a866dd", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626270, "uuid": "2f345d94-3862-4223-93d7-f5174d371408", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626270, "uuid": "b4182922-148b-4508-a090-5f785e815424", "value": "statistic-2095009159.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41430f95-a7bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619571685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571685, "uuid": "3ec062f2-74df-48b8-8972-c35cb20f684f", "comment": "Malware payload (Dridex)", "value": "b899bac72a8fc3139f821128633f5386", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571685, "uuid": "2268f39f-30e2-4911-bb12-438924ade5ff", "comment": "Malware payload (Dridex)", "value": "230b36489882504babb3eb4b8db7d82e51afb0d12dd81537ac769e726f1fde8e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571685, "uuid": "b22be263-6c54-46dc-9fa2-a11d1d96ac30", "comment": "Malware payload (Dridex)", "value": "3d1a278179119adc98f84895a4871a30f1d716f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619571685, "uuid": "27b76d70-5198-40b3-a40c-d97a87ee6d1c", "comment": "Malware payload (Dridex)", "value": "430f00541030f04d02c8eb2b023d2ea715867f9b4caecf9ade81ed16f1925fd7e978cd34749fd876df6217d88591aa2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571685, "uuid": "7dd37124-8c17-4cfe-b5a4-f405d0ecfa57", "value": "66F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571685, "uuid": "0c597b76-05c6-43bd-8193-99233acfe94a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571685, "uuid": "ced98fa9-1ff6-436b-92ff-8cb2d5daa31a", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619571685, "uuid": "7c59ce8d-3604-40ed-b93b-d91c11212b96", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619571685, "uuid": "f5e3e8e3-84b1-405a-be50-f457a4524e2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619571685, "uuid": "f7a51c14-177b-45d3-a7f1-ce43135f7a49", "value": "b899bac7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973da36e-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626804, "uuid": "fd9d544b-184b-452e-9c23-22dd79e4ff4a", "comment": "Malware payload", "value": "9fbafd64cffeb3ac86d32dc8e46ac7ac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626804, "uuid": "7841e588-2576-4eae-8d56-66dcf43d0633", "comment": "Malware payload", "value": "230cf40779280c65ec1d9a6b152006a71d8d58698088cbe722b166b3f7fad198", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626804, "uuid": "e59b4e15-a916-431e-b349-4c02b62f4b22", "comment": "Malware payload", "value": "f6ddedeb4a9385bbfc94b368808fe3d9c959c8db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626804, "uuid": "8fa6edd6-0c3a-43ed-8a13-1468820e54a2", "comment": "Malware payload", "value": "09e12bd0501d93587490ce6adebea66e6825c13e4e16d006a69ee247b562483b92c79fc0d551e7e4629024ad73c07cc5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626804, "uuid": "e6da6d31-b65d-4c41-8bc5-ea620dd0e701", "value": "4F83021523B9C998F48DAE3D4CE30DCF7E42A9741C1ED9F16229019AE227C964F3453B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626804, "uuid": "7184eaa5-b291-4aaa-88c8-c2d22dfa0e86", "value": "1536:LDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M25:LDAysJADlV378P3RPVJLdCqXjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626804, "uuid": "dc009e13-fe33-46da-b3b5-63639f268006", "value": 86109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626804, "uuid": "01e0ab82-b409-4258-908c-b74dcb5cb681", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626804, "uuid": "fda08086-4aef-4b93-8154-7e0ea2241ba6", "value": "statistic-527071974.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a084cf-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627392, "uuid": "76096edb-c212-404e-a264-92e88de6cc0f", "comment": "Malware payload", "value": "269859e6d35be1d383959145e09d9576", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627392, "uuid": "d488ca86-a34d-4dbc-9bd8-4643fb0c4e25", "comment": "Malware payload", "value": "231152a303a82416024e44a654f310fba92277c3fd02abd1e2089e32c082e9f7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627392, "uuid": "fb6361c0-aaac-47d0-80aa-c5382fa4ec8d", "comment": "Malware payload", "value": "66657c70e07b556a2cebc2cff5299b509ab1ab5c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627392, "uuid": "3ddb7aca-9e52-4d70-a910-a6b3fc063b5e", "comment": "Malware payload", "value": "8f4169885f2360eff0706e366b62fec9cc330d750f0ba3562a6e7d44a9df4f314a89b8c3561d583f94ed14a7813dfbdb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627392, "uuid": "4f27f317-ccd7-4766-8a8f-5878729387ee", "value": "AA8302A443BE4A5DB94D4E2DACB20D4F3FA6B6343D0E58F1B92D0485A231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627392, "uuid": "8dd8ee35-7209-4cd4-ae00-b50b695b44e5", "value": "1536:yDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd7hsMnSEwJPTm1u:yDAysJADlV378P3RPVJLd1xpE6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627392, "uuid": "25479498-1c5f-4290-a87e-c4cf33fb3567", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627392, "uuid": "35013f8d-420d-423d-a4da-802546334947", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627392, "uuid": "825852ab-c600-4fcc-b7c2-b79be44773f3", "value": "statistic-910697308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fa30b6-a83b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625950, "uuid": "cc177514-4505-4946-9add-5b4edd7a3896", "comment": "Malware payload", "value": "68630ec447aba21faa208d15d4288ae4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625950, "uuid": "d8ef5076-54bb-48d3-bffb-5e414ab4efc3", "comment": "Malware payload", "value": "23288acd725e63cb8c4994d515e926734e61de6bcb4e59437402fa7d55d55118", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625950, "uuid": "4ec05e92-9c2f-4b63-b227-a66023104a47", "comment": "Malware payload", "value": "c52cedc60b3e742e0e9ea075e4afb21344699bf2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625950, "uuid": "aac723d1-df35-448e-a668-70a08ec632e4", "comment": "Malware payload", "value": "e04b91978432bc9a44fd79d7da73dc42a92ab8438e13c74c85e732786e832fb714f21eb459b365db8286d53c4f32ad3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625950, "uuid": "a0ecb5ac-456b-4a0c-bc0c-6101fe443906", "value": "7183021163B9C998F48EAE295CE30D8F7F52A9742C1ED9F1222D0199E227C964F2453F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625950, "uuid": "0be1d912-50e7-4438-8371-e45df4e1f213", "value": "1536:6DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2+K:6DAysJADlV378P3RPVJLdCqXjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625950, "uuid": "f8f97d58-95b0-40b5-a214-9525b1ccdcad", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625950, "uuid": "d46f7a31-582c-41b9-8fb4-9761247b3809", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625950, "uuid": "2fe6ac3a-3618-4040-a491-6701ee1868c6", "value": "statistic-1859922523.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2f78ad-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621852, "uuid": "b50c261f-1a3c-4642-9153-dea6427e48a2", "comment": "Malware payload", "value": "d4d82a297ab1a409907529b27ca1e136", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621852, "uuid": "29264b0b-5792-48ca-b38d-5047c86dc8cc", "comment": "Malware payload", "value": "2329c1df9619865f04a4ed074de558ee2bd00f3e82dab3d61ea190effa55c364", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621852, "uuid": "aed96bac-2e31-4519-9299-d5c0085d60c1", "comment": "Malware payload", "value": "44c3a8d16630e6e4ced67ad1433e23b014591ab7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621852, "uuid": "97f551a4-0178-40e1-b363-fed84d6910a5", "comment": "Malware payload", "value": "669f84bacfa0b54e16745eb58392b3048cbd4b3ebe614022a7885fff01f7680ce799601cb75b69a2ef74c53e2d6cc23b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621852, "uuid": "a77db710-c080-45c5-89b6-67998f34b57e", "value": "7383121413B94A5EB8CE8E296CE31E4F2BDAB8F4192A55D1794D04E1F2374660F28C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621852, "uuid": "f43d5b42-8a0b-45ca-a148-3b7857958dec", "value": "1536:LDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd6IkGV8BAY0wy:LDAysJADlV378P3RPVJLdP8BXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621852, "uuid": "9809b690-e822-418e-96ec-97d6aa8ba7ab", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621852, "uuid": "56613403-0380-4bbe-80fc-a64d475786bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621852, "uuid": "dddf6b06-8e8e-410b-b4cf-84f2de24bd77", "value": "catalog-97165910.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c72ea4-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622317, "uuid": "b4e22814-f3fd-4695-9815-1797e0e725bb", "comment": "Malware payload", "value": "3f1cb53a00b02e58ce53543d0f2ea1a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622317, "uuid": "02d932a9-6a65-4f61-b0ca-dd35d37bf2b4", "comment": "Malware payload", "value": "233dabfbf86ffb4654fe7579db14371772122144f9bfff21c469353bc6641244", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622317, "uuid": "120d764c-17d8-409a-a975-454dbc6eb4d2", "comment": "Malware payload", "value": "d3f0426d63854c59fac76eeab01226e52dba242c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622317, "uuid": "f8101c83-1826-4137-aa08-b872af549c9e", "comment": "Malware payload", "value": "5a6d831e9ad1e0a20a2c2f56ea0d5df86e550b6204429d5d5762abff10f84418eb50f4e86e43420852bfc89e285ef407", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622317, "uuid": "9531225a-4c69-4eab-b678-f61c08d67d93", "value": "7A83028C353DC5DF7AFE2E0592DC887E740EE8B43144154EE8C866AB9E8BFE71856460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622317, "uuid": "78e58da8-fb26-4fac-80b2-f0660b9294cb", "value": "1536:7G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttfKkApVr6wo+Rxh:7GEhrHJoEsBMG7qzktxApxTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622317, "uuid": "cb711c27-c802-4e8b-9e4d-7026a9f76c48", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622317, "uuid": "c357f24d-0f3b-46bf-ba96-64a486eed0f5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622317, "uuid": "f3f3bbd6-2933-475a-a58d-8d8acd837be4", "value": "diagram-1301009733.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af703c2-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622918, "uuid": "84e58afb-327f-47ef-acee-52d91b63ab4c", "comment": "Malware payload", "value": "e694adaec6be6602b69f71ffc874690a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622918, "uuid": "38b2b193-c1ea-47db-886c-414a8462f799", "comment": "Malware payload", "value": "234191e18a93467df84448770fe2d6737a3530d01dda1fefa5a73d38b30f6f1f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622918, "uuid": "9bf9e9da-160e-4339-bdc1-4279a3be4e37", "comment": "Malware payload", "value": "4ccc18c06f69c853ad3d1bb07bf9f3e7670e0607", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622918, "uuid": "7ba6f08b-0644-4e50-8f40-6f5033b46a09", "comment": "Malware payload", "value": "56407949617e14452ab48bc5b4da001205ebec7eda569f7fa3fabccde38759be5c7d264571d1153db95050ef60111eff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622918, "uuid": "a08abc37-d3e4-49d4-96a3-8cb50db4ea6d", "value": "6183018C653DD2DF767D2E08A298887E780DECB4214434CEE4C81A6B5D8EEE76897460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622918, "uuid": "6d514d23-9277-4c32-bcfa-8346fd3d07e1", "value": "1536:mG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttshWgYkCxGcf1aSV:mGEhrHJoEsBMG7qzk6h12xGwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622918, "uuid": "730e7765-eee2-48e4-8c30-a9000e6527f1", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622918, "uuid": "02266e6e-56c9-4ee5-8ed5-8784e904d91f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622918, "uuid": "9bd81c52-5a6d-4fa3-9da6-5fec881e976f", "value": "diagram-1740784062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732ffdc3-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646930, "uuid": "16170084-c8ab-420c-ad07-bf6f7f5ea979", "comment": "Malware payload (Dridex)", "value": "38cd988d8551c038d3413889fe3268c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646930, "uuid": "9ea413fe-b441-4b1b-8c79-7f0651c1e0fb", "comment": "Malware payload (Dridex)", "value": "2356147c61af045430a30a449745ac86bee8dbf898c128444ca974f620a5a01e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646930, "uuid": "fead9dfd-1138-4113-abc8-720c23095999", "comment": "Malware payload (Dridex)", "value": "599e8ee47d931f388f50d523251c2ff4bf217c5e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646930, "uuid": "5facd4f5-85a7-4347-9e81-c5c34831fec5", "comment": "Malware payload (Dridex)", "value": "9a0cc19347c5ec5918e199569ceca60caf11a3aca45f92f10e1ae95df86e5c95b7648996a03c0f5af6233d5b5e36217a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646930, "uuid": "0c0cecd0-366d-4cd3-9f9a-ddafa3331741", "value": "E2F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646930, "uuid": "3ba0c128-a3ac-4c6c-87cd-589df19eb808", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646930, "uuid": "2863d871-036f-4d36-99c7-71aba3c5a850", "value": "3072:yxT2d85tleLD51fC5AHYEoefukoTFMpGmjY8D:ry5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646930, "uuid": "63afd839-485f-4682-8b7d-26af89a4dfa6", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646930, "uuid": "59ae0e20-70d9-4bea-917b-b955212e8c30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646930, "uuid": "e6278457-9bac-458f-ad3b-4bf0b4b08c66", "value": "38cd988d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb947303-a82f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620879, "uuid": "a314756f-0e91-459e-a7a4-c2ba523f5dfc", "comment": "Malware payload", "value": "05be0a5783b3187de257ffd8cacc25cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620879, "uuid": "309dc579-ddd2-4c31-815c-1c82551b7fa7", "comment": "Malware payload", "value": "235f9c075571fb41141bb47cd4b4d78bbf4ac758e8265639f16938a9f6c55dbb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620879, "uuid": "df909038-a8e6-443e-8c3f-7a1809de21c6", "comment": "Malware payload", "value": "90af51f6ad10983b2eae6e0d6ccb8ce4b1852efa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620879, "uuid": "015fc260-d819-4bb4-9a37-5cd47d5d6c86", "comment": "Malware payload", "value": "8fd33490b2363735950f36eff04d1ff9aa6159c11dff2f6162c382e273b825bfa2ad66fd6d2ef3ee7b5c32cf591aefd7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620879, "uuid": "b7f41267-5e79-4243-a3ae-647598f585dc", "value": "3483027103AE8B5DB4CE5A3958D21E8F2F87F8B42C195893512A04E4E32BC559F3887F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620879, "uuid": "b5110a2d-43ef-4a17-8c70-e4fe917a54ab", "value": "1536:ZDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdcDsMrbsTmHvVRmD:ZDAysJADlV378P3RPVJLdcDsMU0dRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620879, "uuid": "08eb7c06-96fb-4358-8a90-ec9ee50c330f", "value": 86097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620879, "uuid": "ba4fa636-c06a-4dde-8aa2-42c68eed910b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620879, "uuid": "9de67d88-cb54-4988-82d3-18a915ef52dd", "value": "catalog-257253972.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b89082-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622609, "uuid": "b4473268-86a0-4ecc-82f6-cb6926838df6", "comment": "Malware payload", "value": "d1c1942927c84ca6de97798ec613620b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622609, "uuid": "36d1435e-2a19-4c7f-81cc-e077e9a131be", "comment": "Malware payload", "value": "23611c1c9351ff789774d48d5df52db1d569b121c14f4d048a68a20055ef59cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622609, "uuid": "70318497-8a48-439f-ad06-0896cb1b0cae", "comment": "Malware payload", "value": "fa9ed33aa5263642358d61cccd7b0d71e40a5a9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622609, "uuid": "a51fc6ce-0dd0-4d6f-ab45-8c8cba625a97", "comment": "Malware payload", "value": "b717440b73ecabd6a395a60e29e01a904767512e657da10c67f76be438b44dfb8634ef9006899bd4721b5d2440f4fd39", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622609, "uuid": "8b49938b-2fd3-4075-852b-a6658879bd37", "value": "0683029C253DC5DFB0AD2E0951ECC93BF90EB8B93048788CD8C46666CD99ADB58DB490", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622609, "uuid": "93109fdb-8447-45a4-98de-123ba28ade07", "value": "1536:8G+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt1rjMw:8GEhrHJoEsBMG7qzkzrjMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622609, "uuid": "e048fbba-e945-4555-b79a-c48e73b582ac", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622609, "uuid": "19445c69-58db-427e-b8af-20089ac5a55f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622609, "uuid": "fa7e18d7-41c7-4e77-bc9b-45ce157e71b6", "value": "diagram-1507474804.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12844f8f-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621428, "uuid": "d20bb460-3ed6-435c-b2a9-ad8d5f619b71", "comment": "Malware payload", "value": "ca1836f58b408ec8cc0e11dc40e8728e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621428, "uuid": "f9b6ac1c-bf27-43e8-a5ee-d1c5b6f375f4", "comment": "Malware payload", "value": "236683eaa9faa955cd9f606acca3011c12c73d867bf903929c4d1e21e63ed980", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621428, "uuid": "9d37f760-a8e8-4f5a-b786-333c718e616f", "comment": "Malware payload", "value": "c81b0f10677d7050b296f8e9e8481f0e72f01edb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621428, "uuid": "f083e0dc-2898-4f0b-90f9-e51a6854929c", "comment": "Malware payload", "value": "653a95d317e3f02645b390f1c813716b3a35c3310255d2b5e76461bc76d484e9fb503beee7d3928cd431338eec12d72e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621428, "uuid": "89a54834-8d26-4b8b-9a9e-17799e2b0823", "value": "B483025053BD878D7DCE8E2968E31E4F2B8AB8F41D1618E1794904E1E2368665F2CC7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621428, "uuid": "276752c7-060f-4d1a-a605-bdee6b2a409d", "value": "1536:wDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdjD2GV8BAYUwCK:wDAysJADlV378P3RPVJLdjDp8BXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621428, "uuid": "f67630e2-21bd-45fd-850d-d4c706b4272b", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621428, "uuid": "4f1d10b0-3f92-40d9-883f-9a1405fa775f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621428, "uuid": "cbb41623-8b08-4916-9ed1-a1c8550a15a4", "value": "catalog-656429925.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9570be68-a875-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619650853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650853, "uuid": "e87d2eff-4d00-4901-8611-281a44b677fb", "comment": "Malware payload (Quakbot)", "value": "a7f21ef2c831af1a86e6dc8de3b335cf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650853, "uuid": "8d2de41a-f3ef-4219-85d8-fc59d916c636", "comment": "Malware payload (Quakbot)", "value": "2382d15e69258b24dea9bd00250b350b5e67f23268c3d40ef15b2e9c613e5f9b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650853, "uuid": "be054b06-be90-4eeb-aa43-d69d76213c83", "comment": "Malware payload (Quakbot)", "value": "3577887704455949e23d7b5a3b487c26226d4cfd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650853, "uuid": "1ab62166-0de5-4efe-bd35-13e351e201b8", "comment": "Malware payload (Quakbot)", "value": "55c42b65001d8600251dbc93f81b2c1486b884ae3f287cb82f2bd2e33c1882074853dec86086296013a6b12b17f97a97", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650853, "uuid": "ecb1d15e-3b5b-4440-9159-83fd450f547b", "value": "38948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650853, "uuid": "f8bc8403-60c4-4bd0-a172-52c2c60182d9", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650853, "uuid": "713df480-9a5a-4605-9402-ccaa4cc98f1b", "value": "6144:jVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWraK:8FNmLKSVpJbPT+4xrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619650853, "uuid": "68de7772-2293-4aae-815c-b8e6ac7e8b1a", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619650853, "uuid": "07877ce5-6991-4b18-9ad6-0108229b1e6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650853, "uuid": "8b0169db-ee17-4d52-bdca-5512c463f8b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ece8f71-a838-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624509, "uuid": "319b9cf4-9d90-4048-ad28-17a784b3b446", "comment": "Malware payload", "value": "fe20887489a12d15cccae720ad81e5b9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624509, "uuid": "418a902e-bb01-4288-90e2-476b7032de5a", "comment": "Malware payload", "value": "238ec2012f9f595364cefe860ccbfc3b14e85e583c4f63422f0a740451d9df18", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624509, "uuid": "5e5283df-2d4f-40c6-bc6d-82c648d8f5a6", "comment": "Malware payload", "value": "81f3a4b43b20b48e4fb84901fc5ea19bc735e06b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624509, "uuid": "a9e64a09-45d2-4829-b6da-cc378c4728ff", "comment": "Malware payload", "value": "e4a0377f0c950d561438e9a9308e137dded223b3a0b06c2cc994a48ec021fb0a9cdc0fe0c74c3dcf44c971f959bf4b45", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624509, "uuid": "40f7aebe-f4b2-44fb-b2b9-2ae4acbcee94", "value": "2883028C653DCADFB1BD2E09A2CDC43F761EFD622008248DD8C866665D49AE70CAB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624509, "uuid": "867f48f9-8718-4188-ae04-45041faf65a7", "value": "1536:fG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttfe6n6475e0NEnP6A9:fGEhrHJoEsBMG7qzkp4q/NEnX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624509, "uuid": "d0b4ba77-4d6b-4a4d-a4e9-1bed42844736", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624509, "uuid": "ff1b9af8-1d1b-47ae-8e82-a5ebcdbd82d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624509, "uuid": "24e1b714-b4c1-47ca-94a7-4204b608d5d4", "value": "diagram-810215642.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2b068c-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619810, "uuid": "05ca024e-1149-4a9d-94c6-f2e5ed1fe69c", "comment": "Malware payload", "value": "83d0b4c9624dce41399f56f68b7a147d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619810, "uuid": "6e96ead4-402a-41e0-82ff-91c967ff9c78", "comment": "Malware payload", "value": "2390016c0b1d0663e551111d333d9e10ef9b3904d100aae2cb07706f1fecdd1e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619810, "uuid": "c9ce449e-1880-4db0-af63-319d246b56ec", "comment": "Malware payload", "value": "babd2a488bc5d1f03dfe34f90358835588d868ae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619810, "uuid": "2c29b362-04b8-4be7-a6d0-c9016739c416", "comment": "Malware payload", "value": "cf69045a803f5c25e9323a8429b982ae75ddf9442d0ce97140d4ed5bb14c7109456bb5429e762c9cb2b8943d7bd88253", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619810, "uuid": "60e40619-7274-4a61-999f-e1640dd36f5d", "value": "35830210036BCD4DB58E5E3888A31ECF3F95F9342909A8F1753E19B4E32E46A0A2497D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619810, "uuid": "7870d128-0700-43a0-a810-6a12ad0f22ba", "value": "1536:+DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdGneL4XqG2DbLXdX:+DAysJADlV378P3RPVJLdg36GYZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619810, "uuid": "91fea362-d0cb-4080-8d77-28e333d4f1dc", "value": 86105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619810, "uuid": "ace96bbf-5d0e-4164-a8e8-0a2653db21d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619810, "uuid": "df37ab31-a7b2-4624-ad5d-ec288afc4adf", "value": "catalog-1549006450.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ca208d-a86d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619647304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647304, "uuid": "6ffd3be7-29a6-4355-a613-a90cdfc8c458", "comment": "Malware payload (Dridex)", "value": "a5b5cd800f296d20d50ec1e2676c96d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647304, "uuid": "369972db-06fc-48ed-a635-3857fdf70171", "comment": "Malware payload (Dridex)", "value": "23b91f447c24ad2ce9d8cf7ce8b608ed387d8491df43b0d2eb6223e3b366b299", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647304, "uuid": "b2b7267b-e904-4ec7-9605-9b70ff1aefd6", "comment": "Malware payload (Dridex)", "value": "97c749230c31f64b59527c2c6fe91f69497a74cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619647304, "uuid": "20d8c04d-58cc-460c-b8e0-603d05ec088b", "comment": "Malware payload (Dridex)", "value": "ac54991105c647aecd563c1e630be51a2006ae3a28e61617dc756383684392f0a52a1f0398e1c53bc525b9ba0f8fc9eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647304, "uuid": "378be42e-1091-4e85-aaf7-ca56e0fc1120", "value": "4CF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647304, "uuid": "05fc41bc-0d46-4bcf-8959-43caf0040ab1", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647304, "uuid": "ae7f58c4-1ed2-4645-8396-5ed429a0813b", "value": "3072:xZSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd21GkFY:PnS62Fl+pkeJl3CvRStrFl+EY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619647304, "uuid": "b401301e-4d81-4e99-88a2-57b66666ae95", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619647304, "uuid": "704a3c56-3945-4eda-b707-4682650f2d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619647304, "uuid": "5855c3ac-4a3a-4b07-bc68-634623698ad9", "value": "a5b5cd80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8824ce3-a859-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619638967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638967, "uuid": "16b5da22-be1d-4003-94ac-f522eef9df50", "comment": "Malware payload (Dridex)", "value": "c134075b4ee2552e94cf99864e9e7baf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638967, "uuid": "c6c34655-e988-4729-8741-bdd4954f5c78", "comment": "Malware payload (Dridex)", "value": "23c129e5e74c58094ec01a73b223929b1eef0fbc9cba057fc3e5f3cd1d5186c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638967, "uuid": "094b30ac-e49e-408c-847d-54d6b9ec9819", "comment": "Malware payload (Dridex)", "value": "f313d37a83da1347657562d6288a0e8d96100163", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619638967, "uuid": "0f914077-8f38-469c-b1ca-bb1fbfbf3816", "comment": "Malware payload (Dridex)", "value": "d05b57ea89ca37b9b60e23d5e66a6d87456003af633c7ed342526f72057a6a9232662499be822c77686fff1f4e71c546", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638967, "uuid": "8e1f8403-152d-48ba-b1c6-fff7f8ceced1", "value": "F0F3CF41D5A6C458EBDB2870C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638967, "uuid": "568a59b6-5231-46df-bc5a-a0d68b7a6cce", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638967, "uuid": "b0f7f50d-9d69-45c5-a4e4-e91c654a2421", "value": "3072:KZT2d85tleLD51fC5AHYEoefukoTFMpGmjG8D:Py5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619638967, "uuid": "a1df5c10-6d12-4309-8bea-7166a75e660b", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619638967, "uuid": "c8cf2931-d9ae-43d1-9983-cc6401f71b92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619638967, "uuid": "f5cc0f05-20d2-4eb7-a532-b3ce69ec53ce", "value": "c134075b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986ddeeb-a875-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619650858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650858, "uuid": "ed50192e-f228-4f0b-a9d8-7408c48a7cfa", "comment": "Malware payload (Quakbot)", "value": "0f918c076861870b61a20a096e079670", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650858, "uuid": "e6ce3d7b-3332-42f3-902e-9c7b03b54337", "comment": "Malware payload (Quakbot)", "value": "23dd7e3eb5368ed774a0f3272ba226dda9eed09d395feb46db0437d0e9ce6b27", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650858, "uuid": "361471ca-462f-4d41-8d42-4af98859159b", "comment": "Malware payload (Quakbot)", "value": "1ca1300d09bfb802e16c5c04f9de291b4e322917", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650858, "uuid": "9a9d53d8-b9dc-4f0e-b11d-4d24545fa540", "comment": "Malware payload (Quakbot)", "value": "19cbc67aa65ee1ca4d74f7fea7c11949d6dc177b48a7149d6af59b9c8736774389c4c3aba42f39305ec393ce2a6a9195", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650858, "uuid": "9644a60f-e3c4-4ae3-923a-13cd6b716fb4", "value": "7C948E396A26E073D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650858, "uuid": "2d4630be-42f1-4552-8114-f8ba97bd0b91", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650858, "uuid": "45586459-98c4-40d4-bcc5-03a54eb26852", "value": "6144:dWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmJ:dWrsTwr03pdf8vhhOKJETlByJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619650858, "uuid": "e87108f2-d343-4e89-b1ba-122da0bce40d", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619650858, "uuid": "ddd7a8a5-05c0-4be5-88ff-9ffe8becf356", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650858, "uuid": "dd49d19c-92b0-4742-90ea-41ab35571cc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65abec13-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619849, "uuid": "120a55d6-61a4-4524-b42b-7f786e7f1261", "comment": "Malware payload", "value": "ffe1cd078932ae7f501464b26d400a5b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619849, "uuid": "e4fe95e1-da1a-4e8c-a453-e174ceb3108c", "comment": "Malware payload", "value": "23dfe401955b10aec73503056b5e3d8d4c35086ecab09450b42610bd5450eca5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619849, "uuid": "e72e2f01-59c4-44c2-8040-b985c429ab97", "comment": "Malware payload", "value": "ea232905435fdd3bc2812316ad55d933d55c57d6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619849, "uuid": "1d8f9270-a671-4953-b4f7-bcece776ea15", "comment": "Malware payload", "value": "7e7f647676af09606d3de7758f5de651b64bea8fd4f003173dea585d852f780c44d5de1f9253350ca76315b3f9bea9a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619849, "uuid": "6254a442-a769-475d-aa79-a529932a8beb", "value": "0C83021513BF565CB88DCF3D9CA30ECB1F5BB974290598F2A15D00E8E6338425B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619849, "uuid": "b3cc21d9-105e-484e-924d-7ce0f3e51eca", "value": "1536:cDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdsRP6sCO0Pyeq:cDAysJADlV378P3RPVJLdC6s90PyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619849, "uuid": "e90b8f0f-fc2e-414c-80ff-427f83032e5e", "value": 86103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619849, "uuid": "3c629fe3-bc16-46be-bb6b-fb203227ea02", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619849, "uuid": "5dc9d6e3-420e-4148-bb55-f65462413416", "value": "catalog-1573027196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ba311d-a831-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621440, "uuid": "46017c5d-1165-40a4-a48a-7f937d3cf16c", "comment": "Malware payload", "value": "ae14344b930bf476523b251fceeb2704", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621440, "uuid": "44a044ea-a539-402c-b1ce-aba1b5f4110b", "comment": "Malware payload", "value": "23e11e9c6340d56827adc9ad87d2c090a56a8319aadd289815fcbfa1b71900b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621440, "uuid": "c76f74ce-508a-4731-b474-a4fde827f18e", "comment": "Malware payload", "value": "85e015af9fbe26997b64dce78dba15f9837cbe45", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621440, "uuid": "c3d578a0-8896-4255-acf0-91418ac72ff6", "comment": "Malware payload", "value": "17d30cd35cdaa1f2c32ea413b7307f5ebec4ebc029aff2be1f2ab7614b7207042d6286b721ececc2224281cca0d3a340", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621440, "uuid": "17d71cb2-189d-4c53-8966-f8ea8f73f310", "value": "3583129073FE8EADB4CD9E2855E20DCB1E5EF574290CADE165AE04A492358422F34D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621440, "uuid": "81d4ad2f-9433-4f26-a526-a22f2b4ef51c", "value": "1536:gDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdIeJx9awOnleWI1HEdO:gDAysJADlV378P3RPVJLdIeJLOnleJkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621440, "uuid": "1a9e24eb-2347-4002-9dee-f5ec632608ca", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621440, "uuid": "0d9b2a05-1fa5-4494-ab38-5f53b69d453e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621440, "uuid": "b09eab1a-4c07-4d7a-93ca-1721e715cbd0", "value": "catalog-668932980.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf1b964-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625178, "uuid": "540ebfa3-0b0d-4c27-b828-2d6941f45a0e", "comment": "Malware payload", "value": "f02a2f69f4e2048325d2aa831e8de50e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625178, "uuid": "f657db0c-a4ae-4b87-af97-6fe76596745a", "comment": "Malware payload", "value": "240c31515715474881948c8a9da273e98e49aee7a89e6390d83cf38fab375e05", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625178, "uuid": "9649c9f5-5e52-4a36-8405-d4e534d57fb0", "comment": "Malware payload", "value": "e9c5013bd3c01234de6f83c85e4d9eb58cbeea7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625178, "uuid": "9d9dfe18-eff1-4d4f-96c3-5e96de467613", "comment": "Malware payload", "value": "f7cc8981e6d60d6bde9e53dea985d5f4d3bc6b0f48eff8f237e8754d609f314069e0903011c1fd52479ad7263cd4ca8d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625178, "uuid": "9131ae0c-9c6c-4c28-a869-91085deff78c", "value": "1583025523BAC958E8CECA2C5CE30DCF3F02A9793D19D4F17229019AA63AC521F2457F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625178, "uuid": "086d4d2d-df01-4dd4-8a81-301d60a07a6a", "value": "1536:mDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdH6q0T/2kOsMmt:mDAysJADlV378P3RPVJLdaq0Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625178, "uuid": "f4bd9ffa-ca10-4a5b-b352-0b3245f02ade", "value": 86116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625178, "uuid": "6cfdd50b-632e-4db3-89da-b05f6f9c0782", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625178, "uuid": "ed1168c1-efcd-41cc-a0b4-707e51eeaf68", "value": "statistic-1285688656.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e656ad1-a86b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646439, "uuid": "298ca09b-849c-4d59-89f6-a3bced2703f9", "comment": "Malware payload (Dridex)", "value": "ebfc8b1d80fdcee4bd3b1c784d89b86e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646439, "uuid": "035af1c1-a9d7-4443-888d-2bc59928f521", "comment": "Malware payload (Dridex)", "value": "240c9d2471d451eff4f974e546585706e51b16bb81f738da72cbe097883ef6a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646439, "uuid": "265bf442-d339-49a9-8737-d58c5a487e3d", "comment": "Malware payload (Dridex)", "value": "ec713e0695409db212d56e9ef273a2b582beddfb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646439, "uuid": "66a230d7-7ea9-4993-a933-1851c5764267", "comment": "Malware payload (Dridex)", "value": "892ddee28b9bbc682235376bb21b2c63e743d06e4fe0abb640c0ab028912c214ec9ebe44fc885a2bd21a667f6cf34c1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646439, "uuid": "7a1a6592-f597-482c-9b74-0f4f9c714ab2", "value": "20F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646439, "uuid": "4f564b88-a941-477d-868d-0ef9a3142929", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646439, "uuid": "04163e61-9eb8-420a-aece-59f446278853", "value": "3072:uWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:u42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646439, "uuid": "4dfc0897-1f72-4fd5-8a83-d87287e8811b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646439, "uuid": "b573644b-46df-41ee-aac2-5b4afdaa4f31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646439, "uuid": "8f4ac235-0413-4283-847d-6f512964b84d", "value": "ebfc8b1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f113589-a82b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619060, "uuid": "cd9d1371-2ff3-4029-9b96-6a3a80a40ee2", "comment": "Malware payload", "value": "c88245ba52b93025159386085e579111", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619060, "uuid": "e017bb1d-a7e8-4473-8dd7-44e731408e9e", "comment": "Malware payload", "value": "241592e631b3f112d48fe21184389d166026a6f5c53caabfe8a3ab3538b17076", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619060, "uuid": "0ff256b0-b8ad-4fff-8c13-309e7652c13b", "comment": "Malware payload", "value": "33f26f7d8fa67a500df93862e93436868835db8a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619060, "uuid": "a6c46460-1917-4126-89ff-5ec79163b4bf", "comment": "Malware payload", "value": "07dbefd05893a60bdc18c0f0a924ec892ef1fbe2bf7c71b4110e6bc34561263f1075cdc790c4f031c0921f3522ae51e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619060, "uuid": "6312ec15-2bb3-4340-9695-1be4c69c532d", "value": "8B83021013B54E4CB9CE9F295CE31ACF2FA7F9B4160D69F661290894E722C474B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619060, "uuid": "5d4173f3-896a-4fe1-8db5-d1e31b37e438", "value": "1536:sDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJnu:sDAysJADlV378P3RPVJLdYDpH+jAJnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619060, "uuid": "1dca4958-b3ec-4814-8d18-e5e50b5bf418", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619060, "uuid": "56c91123-b690-459b-a8ed-00187fe98611", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619060, "uuid": "a7d0b521-4e6d-4dae-907f-0343d812b0e1", "value": "catalog-1007143247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2547af08-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624895, "uuid": "6d6995de-c011-4fb6-8d09-51d48284ba16", "comment": "Malware payload", "value": "b9e8a7b16a68f967451044c4ab72df92", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624895, "uuid": "1fe36a97-84c4-4b9d-a7bd-15a415cf3306", "comment": "Malware payload", "value": "241fbb8050bbb23fe8f1e7c8fd626fdbd602d4375589dce958a332d7b7dfbd3f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624895, "uuid": "87661ee8-11cc-45da-9cbd-4a382e795e73", "comment": "Malware payload", "value": "a9098d0d8f0ed9f7927e36c4bf520bcf45db7425", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624895, "uuid": "a435c9c1-1cb3-4a50-b334-928336bd60cd", "comment": "Malware payload", "value": "6844a3ca13b787d17ca9729c98d442617875422bea2aa692b1de7895242826baf9e9c3c558b2bb67451e842fceff2c2a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624895, "uuid": "2e66645a-9dbb-4e6b-acbc-f860432b28d6", "value": "1F83021163BAC998F4CDAE2D4CE30D8F3F42A9742D1ED9F562290199E627C960F3053B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624895, "uuid": "ef022842-48f9-467a-bbf6-39d516e54b6e", "value": "1536:6DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdiPqXT/WkO0B19M2+Hg:6DAysJADlV378P3RPVJLdCqXjmHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624895, "uuid": "82966ec4-21e2-4e3b-8998-b38a2f0a6aff", "value": 86111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624895, "uuid": "b0d1318b-52d4-45c5-bc9a-69b8951a41ed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624895, "uuid": "d00f0c41-ce42-4e36-ac7d-0b6a28206d64", "value": "statistic-1085220580.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e653c0f-a84d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619633661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633661, "uuid": "0d74139d-4e74-4f16-a9e7-1c67f7e44b91", "comment": "Malware payload (Dridex)", "value": "926ccc854a0fdd301fdf738f0573533d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633661, "uuid": "27a73f78-2b39-4f67-9fba-ff1a8bce0668", "comment": "Malware payload (Dridex)", "value": "24343ca37c521d6335e640d1f6758fd3db66be41534249ef62c9380c175aba5a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633661, "uuid": "77038d01-0553-4df7-ac08-3fdbf56ca3af", "comment": "Malware payload (Dridex)", "value": "337c0be8eb68fa969c0ef808e909bbbb81d0dc4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619633661, "uuid": "70609d71-e415-470c-a1e7-b0eb9da7ae4b", "comment": "Malware payload (Dridex)", "value": "e7c4cf3a9bb5d76d2527c91d6b075dde397f9f4524422cd5bb9dc8862ba62b9a88e24188552cb33fe388f4836a8faba2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633661, "uuid": "9262a3c2-ef84-45d4-a232-df27e43c6789", "value": "A2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633661, "uuid": "6ec2b661-02a6-475c-95d3-91cda23d1827", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633661, "uuid": "396feb19-f511-4c80-ae38-1964f1d01ced", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619633661, "uuid": "9711d053-b20f-4301-a59d-c285b0fb4671", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619633661, "uuid": "d25d8d5f-e9e7-47c3-a799-2550791fc5b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619633661, "uuid": "be346474-057e-40a6-a3b7-1d8a19531cd4", "value": "926ccc85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcfe2c3-a834-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622732, "uuid": "77741a80-6346-4be1-b762-1363b7c317c8", "comment": "Malware payload", "value": "e37e60f9d9d230cfeaa53ceab002079b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622732, "uuid": "f2b5004e-cc44-459b-ae7c-eafed5c15cb7", "comment": "Malware payload", "value": "244315b6afcd1c439726070085577b774b917d887ffb5c269c330ccafb3b1f8e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622732, "uuid": "9c39b174-d4fe-4e40-a2a6-62b1c485450f", "comment": "Malware payload", "value": "b54d0d5798bf1adf9ee6da44ea967850be15898b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622732, "uuid": "2e88fad2-aabc-48d4-8359-f979ce648ccb", "comment": "Malware payload", "value": "b2c71b0ddfa4ba88a9a092ad07ba6d156fc94d4eb97c439c739c4c716954d135e8eee9fc25e02e3ce77fea027ccd4495", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622732, "uuid": "4d9692aa-d4cd-4059-a8eb-73f4ffc2a3df", "value": "FF83028C3138C5DF37BE6A04A2DC887BBD09D9B93514385EC489655FAD8AEAB0C5F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622732, "uuid": "212b8e18-e5d6-45fb-b2ca-ab6166500bcd", "value": "1536:lG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttYds+RKYFxQ3d+pj:lGEhrHJoEsBMG7qzkZQxO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622732, "uuid": "f3f4ba8e-b4fd-42c9-a07b-1c734275d623", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622732, "uuid": "f857f775-59f0-448d-becc-29971dea68f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622732, "uuid": "282a4956-46c7-4215-9daa-f071869f51d5", "value": "diagram-1604159573.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3418c2ce-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621055, "uuid": "1ce5fcc2-1fb6-4ec1-bf7b-d2f55fd890b8", "comment": "Malware payload", "value": "977d487ef8580a1622c6bbad5d724287", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621055, "uuid": "82e97aa7-883d-4a02-b623-c4e34be9e273", "comment": "Malware payload", "value": "24506a131b7e9e90cce222b17a96f80555b4be3289c31d0b23f2bf7373ff6c86", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621055, "uuid": "043f46b5-b4d3-4ea1-a965-824b579a9bf5", "comment": "Malware payload", "value": "633b4fbd4802028cd1fc1708c08f9c32c34d46c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621055, "uuid": "4837af16-9e01-4308-aa61-d2affe840baf", "comment": "Malware payload", "value": "e2eb824a1df8cd2753f1a8b6fe60c1c3b849770419811558d880838d0c6a0dd414db8c51479c3f79a39cb4868aeb8e99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621055, "uuid": "3368ca3f-3e9e-4422-931e-4b27b0f4ca72", "value": "0F83021523BF864DB88D8B3D8CA30ECB2F57BD74251968F2A55D04D8F2338521B28D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621055, "uuid": "474ddd05-bd72-4fbc-bc11-7991c1003be7", "value": "1536:DDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd+RP6sCO0PyV:DDAysJADlV378P3RPVJLdg6s90PyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621055, "uuid": "66dd7888-fe8c-4445-9d9d-e5ea1105f1ac", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621055, "uuid": "143736ab-5d76-4398-8c0c-5f0c7d15f7ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621055, "uuid": "d648de92-362f-4117-b329-ffaee9e28a36", "value": "catalog-370048976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43a6bc7-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626960, "uuid": "a9a163f9-fbee-4bb5-b8ab-52b422d0c8b1", "comment": "Malware payload", "value": "ee8717a9fa3f537b39e76c9b0e0a6b51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626960, "uuid": "1a8704e7-19ae-41db-baa2-2de27fd4021c", "comment": "Malware payload", "value": "2450e2f96779a1f3701a51a2bde3c9d9d5af84307dc907cd03ea411298c87d2b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626960, "uuid": "7cd8cb86-9116-4e0a-ba14-db48a51dec09", "comment": "Malware payload", "value": "d848303d3b3f8bf42161679584f386b9316cd27e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626960, "uuid": "85aa6c45-b482-4dfc-b4ad-4c5a1131a3ad", "comment": "Malware payload", "value": "8bdc843f3c204bbdfd4248df0394d3c41bf33e390d444acf8c9f58b8d1312ee9e824771addf3d2a9463512ccbaaca8b6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626960, "uuid": "99db51a9-96f9-4988-9525-fabdf9f7b311", "value": "E98302A453BE4A5DB98D4D2CACA20D4F3F67B6743D0E58F1B91D0485A231C561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626960, "uuid": "85272479-90f8-42b3-98d3-376298a6c089", "value": "1536:5DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdHhsMnSEwJPTmOp:5DAysJADlV378P3RPVJLdBxpE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626960, "uuid": "f5cec50d-a468-4af0-9088-ef54074b8e77", "value": 86110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626960, "uuid": "893c7560-45a8-47e5-85a6-b3817f7863a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626960, "uuid": "5d2ac8a8-621e-475e-a264-fbcc2d8d84d5", "value": "statistic-62638586.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed724bf2-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621366, "uuid": "42f47768-39f5-43eb-bfaa-92e481f97f4b", "comment": "Malware payload", "value": "8e573ab16393582153976770149596ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621366, "uuid": "fb57fdfb-12d6-4b55-a7f0-be8b86e428ff", "comment": "Malware payload", "value": "2456ec47bf3724539747eb013a10b42145df8eae1dc88ea994b0e10e151abf22", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621366, "uuid": "bf2557dc-05f8-431e-ac9f-0a11bdc42db4", "comment": "Malware payload", "value": "b4291a555f788761b7d3d201e7b758a4ea9ee0c8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621366, "uuid": "3e78594b-f23d-4419-bf77-f2f44fccbe3d", "comment": "Malware payload", "value": "e98cae852b29bdfc2188db843d0c3ee20a9177fba9406444d9d132150dabdc70b2959ecfe20cf47f6dca1055ed8b4cc4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621366, "uuid": "231a8374-a6f8-43b5-9101-b7ccf269b093", "value": "9583021013B54A4CB9CE9F295CE30ACF2FA7F9B4160D69F575280894E722C574B18A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621366, "uuid": "4dbcb66e-8061-4733-be8e-70acb39dad54", "value": "1536:0DXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJ0c:0DAysJADlV378P3RPVJLdYDpH+jAJ0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621366, "uuid": "10365ee5-9d76-4649-8263-00b8552d1a56", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621366, "uuid": "0d9c31ab-5aaa-4373-96e7-325e0d28e40d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621366, "uuid": "0afdb476-a77c-4105-a2bb-98288170ecd9", "value": "catalog-613938191.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ba8c82-a83d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619626861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626861, "uuid": "f2d8cc30-0e96-4cc2-b861-bc3e48c7a97f", "comment": "Malware payload", "value": "335fd8a15e9d6af0c27afc56052ab5e3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626861, "uuid": "e164b989-fe6d-4aef-933c-ae4e1b99d636", "comment": "Malware payload", "value": "2457322211c2cef5c261a40be1105056d5899381fe86d9ec6b0ca805d842717b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626861, "uuid": "7be45283-14cb-4496-bd14-299fef5bb786", "comment": "Malware payload", "value": "67b3b432a3df5d4377ab6d07db2462bda18ac9a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619626861, "uuid": "82b82b80-b08a-4ae5-b831-f910faac796f", "comment": "Malware payload", "value": "3729b6c859d60b9957dd3cbdae7cdb4324e5a0619f5e36bf9fe90ccf5f64298eec771e83d550e089b20c8c70f8bcaa47", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626861, "uuid": "c48f3af9-acd0-4533-ad51-3533175bf48d", "value": "BA83025013BB8EADB58DC93948D20E8F2F56B6B02D5B5DF2B13D0494F1338961A2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626861, "uuid": "c5270ee6-9b5d-443e-bafa-aedf99e873fc", "value": "1536:nDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdMZn7nh0:nDAysJADlV378P3RPVJLd47h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619626861, "uuid": "55c9e1ce-b030-4c7e-b0ee-881e54899506", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619626861, "uuid": "4bc04197-5d9b-4129-84f6-f97ab9bbac75", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619626861, "uuid": "3023efe2-e914-4345-a65d-ab6483e94acd", "value": "statistic-548309572.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e2c62f-a83e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619627399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627399, "uuid": "3f7c2dae-beee-42a9-b344-e44ff0104a09", "comment": "Malware payload", "value": "60b62a78c947e0d61e74773af475d957", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627399, "uuid": "8982916d-90ea-4992-9682-288bad61a019", "comment": "Malware payload", "value": "246bb5b0c45b30f1f6be3af7e2da672681a7bb39d7e38c4e6437f9b5f3e02db6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627399, "uuid": "4c7d17c5-ca13-434b-9440-984756fccf81", "comment": "Malware payload", "value": "e39cd255f25fd00646c188a0142781506a64923a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619627399, "uuid": "0534008d-0a03-4cd7-a657-0e7da338e0eb", "comment": "Malware payload", "value": "8318eb1ab8d631429b45dc742e46d2802fed9ef6ca8f3e5b50303d817c63a591684f46b5fc0069f5de6bf082dac37423", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627399, "uuid": "18c0fdbd-cf1e-41da-a959-6a784124bb06", "value": "3183021163B9C998F98D9E2D4CE30D8F3F42B9B41D1ED5F26229019AA327C564F2493E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627399, "uuid": "0ec11fe9-3ced-4ee8-ad09-a9643af11388", "value": "1536:UDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdpPqXT/WkO0B19M27A:UDAysJADlV378P3RPVJLdVqXjjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619627399, "uuid": "cdd8e35e-82e4-473c-abcd-e6a692932a50", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619627399, "uuid": "36364cc6-7d2c-450f-b16a-23e4b32fec80", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619627399, "uuid": "4c578e51-3e02-4124-95ef-72c68364358e", "value": "statistic-916104345.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5946c8-a875-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619650863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650863, "uuid": "a62bf96e-2daf-46b1-8a31-8458db071e32", "comment": "Malware payload (Quakbot)", "value": "2d8dc5652ec23a6b2e4884e6b9df8570", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650863, "uuid": "bfd681da-5673-470c-9606-b3d5bb7644b2", "comment": "Malware payload (Quakbot)", "value": "247c747ab720ba0236a93e8295df8397d7154cf39c1280468702c140800b8f72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650863, "uuid": "1bff7c33-a75d-4882-9feb-f3baf2d8f5ec", "comment": "Malware payload (Quakbot)", "value": "99c60c70b17162f78d929ea1f5a63b4d2899a083", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650863, "uuid": "338d85c7-cecf-4942-bde8-e3dbfade374b", "comment": "Malware payload (Quakbot)", "value": "29913a85ae9fd6dc4e0b562905e96f25a2b92001dc194661efc82c1d942f26140cb73589b39b88d5d510623eddee5561", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650863, "uuid": "36b992a2-6cac-4e90-8c84-40e822c5820c", "value": "46948E7A6716D162D2BC23B143C3DF580E17D6E53234444A12B3DE583EBA3A4BE26F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650863, "uuid": "95660d0e-49ed-4e35-996f-7c418ac128e8", "value": "d2cb8c6990325bd3ed0846715a3f2133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650863, "uuid": "7e65537d-e71a-4940-a138-060e52cf12ad", "value": "6144:aVWAE0IMoNmL7x4SVpSabPTeboxqoTkEaWrau:zFNmLKSVpJbPT+4xrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619650863, "uuid": "99efb0b3-2717-425a-9668-8321cf1efae9", "value": 412568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619650863, "uuid": "ac7b2f0c-420d-4222-8f1d-c0828786b775", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650863, "uuid": "1d20d36c-2187-4595-9e7a-83e8ff8116f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a6d7fd-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619624914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624914, "uuid": "affa998c-da34-4a90-98cd-382f809bea95", "comment": "Malware payload", "value": "a056d0cacd5e5555aa12fda1c1fe99f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624914, "uuid": "aa811426-7691-4f00-900e-e404638a43a1", "comment": "Malware payload", "value": "247c83e1b29e4e04c53095e3e79435fe9bced51624b2b89bbceba15138c3a114", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624914, "uuid": "d31f596f-fc0a-4467-b509-604456a10865", "comment": "Malware payload", "value": "384020ce0ce28b2934f3060cdc6ab984b8e706be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619624914, "uuid": "59ebdcd1-f368-4984-8235-873bd3b99192", "comment": "Malware payload", "value": "30a4ff67f1d3c96c12ab92bb1625c63851b500a4fe032b79d69e980394c3f3079448d15f0202084365b030dab48fb298", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624914, "uuid": "cfd35b23-f1ab-42a0-98bc-60eb0b54e530", "value": "AE8302A453BE4A5DB98D4E2CACB20D4F3F67B6743D0E58F1B92D0481A2358561B34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624914, "uuid": "05a2e6fe-e92e-4556-951a-4df8e187d9a6", "value": "1536:rDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLd8hsMnSEwJPTmdP:rDAysJADlV378P3RPVJLdyxpES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619624914, "uuid": "8c1d2ceb-b7f6-4127-a2b7-d7a191f0b142", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619624914, "uuid": "d182b9c9-1d70-4810-8663-38a8c00bea0e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619624914, "uuid": "1a39094d-f42d-4a8c-b2b7-ef6f8768568e", "value": "statistic-1094959997.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454243e9-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621083, "uuid": "60fcf20d-b26f-4196-b637-ad939574d061", "comment": "Malware payload", "value": "10b0ddfafb60fc2143631b557ffde1e3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621083, "uuid": "09634fb2-d697-4ea7-bf6d-a82b4a0005ad", "comment": "Malware payload", "value": "24cd3ea72f4eb8948beeff5d8caa5d80089da159617af4cfb018e4ef538c29dd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621083, "uuid": "8b812798-8ecb-4296-8ba5-515289fd744b", "comment": "Malware payload", "value": "544bb2c5fe57eb2375949f7e8304a03a8a770c72", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621083, "uuid": "2d37a745-9396-4245-8853-cb2be130dbf3", "comment": "Malware payload", "value": "8e3ce07bbe2c240bc875f7327935ce6ea10be19940925ebdc8a26ec07691d54e4454302d01cef02475e48a6cae6c8670", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621083, "uuid": "4db49420-c040-4c80-ba5e-73794d73841b", "value": "1283021113BB4A5C74CDCF2C686319CB2FA7FCB4290868F2A09900A9F632857572C97F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621083, "uuid": "e330a7c1-8e7f-4994-8ffc-296996c73b93", "value": "1536:YDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdLDp5xdCO0v:YDAysJADlV378P3RPVJLdLDpjd90v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621083, "uuid": "23401302-4961-48ac-aa84-cbe1cf49e243", "value": 86101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621083, "uuid": "ecab7c09-80cc-4922-adba-c6a1af7f20e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621083, "uuid": "53d352bd-a4e2-44f3-a1bb-6c0b21ded643", "value": "catalog-398031724.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843d32f5-a833-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622478, "uuid": "cf58b3b4-16e8-4ef2-a711-6b82dc5cbfb4", "comment": "Malware payload", "value": "b0126226675818b49ada5077ca45849f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622478, "uuid": "1017b8d9-6cbf-454d-8158-d685327297ce", "comment": "Malware payload", "value": "24dec842859efc48ab8c2e664d023240d769504e7abff32afab15795e7a59419", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622478, "uuid": "7622db76-926a-42d9-b3c2-e5ced5f1c684", "comment": "Malware payload", "value": "9f3c158e9633b1b93837b17374b7f2bd22922ce4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622478, "uuid": "ca0757f7-3043-4a1d-a62a-28ec0d903235", "comment": "Malware payload", "value": "de3e6eead16e93f5675750f250996ae1f1bac754e291e377c17f228df1560ba69dbaffc14d9f820cb0a62e25fb95b656", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622478, "uuid": "8a514d8d-063c-4680-be85-e80a41d9dfc3", "value": "2383014D213EC6DFB16D3E09A5E8C97FB90ED9B4200018CCD4C437679F4A9AB4CAA4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622478, "uuid": "c8f318e0-74a9-4a13-b578-88eea6dfbfd5", "value": "1536:PG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttrKKmo3zuUkbRU:PGEhrHJoEsBMG7qzkH7KRb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622478, "uuid": "bff575cf-339b-41de-acef-e51b929fefbb", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622478, "uuid": "40327774-9871-46fd-95f3-4b0b6b416ac5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622478, "uuid": "e8c73e07-2998-4cc6-9e45-70cdfa93cec9", "value": "diagram-1397402090.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4db533b-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622130, "uuid": "5a338051-6581-4ff6-bde1-50f288eea303", "comment": "Malware payload", "value": "ce18ee7f71f7e3759a80a550fd51a534", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622130, "uuid": "188e2cbe-37b0-4c1f-a653-d021357e74bc", "comment": "Malware payload", "value": "24fb7f055fd0cc2e96bd699d90f2e8919bdf1cae121e83f1312a3c3028bd77cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622130, "uuid": "0d6b66d3-4960-4e97-8541-f5a38bf5fd9e", "comment": "Malware payload", "value": "4bb943ba2eba0bfe58fb2eb4fb4ece290bb82e02", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622130, "uuid": "63d5494a-afe9-45bd-a307-3784dd2f63e6", "comment": "Malware payload", "value": "e18d26669b8acfc3f1d01ead04b228a7b096480a63a864f1a81e35372e066fc926526ed8a935b18a4ac86301b2d8c540", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622130, "uuid": "788d0d66-2ccc-40cd-8517-703b026938ed", "value": "1283029D653DCAEFB1AD2F09A3DDC53FB61EEC623004248ED8C466A65D49AD30C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622130, "uuid": "6858f0ad-4c91-4ca6-b622-501ca9d2438a", "value": "1536:kG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8tt5de6n6475e0NEnP6/:kGEhrHJoEsBMG7qzkZ4q/NEn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622130, "uuid": "59b59b5f-ec91-4b47-b4c5-74c031d7c608", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622130, "uuid": "9e514726-9efc-4366-8678-3b3def8dad52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622130, "uuid": "3483f8f8-0e52-4586-90e2-8d84fcd45bd4", "value": "diagram-1153938154.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395172d2-a7e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619590569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590569, "uuid": "4bfe294a-4079-4d46-a2af-d939d8f25c70", "comment": "Malware payload (AgentTesla)", "value": "2a00eb2b98f73309a62ab5daef1271be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590569, "uuid": "995dd95c-08b9-4eb8-bca9-1a2075f8fc07", "comment": "Malware payload (AgentTesla)", "value": "2522ea700a97b838b02d221e7685c5d2bb6f6657141f54bbcc2d7838a0c4029d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590569, "uuid": "dd1de734-a0ab-4bf5-b9ae-b17fe5c95477", "comment": "Malware payload (AgentTesla)", "value": "cc01bdbeb2f719ac755248d156a7178da9dacac5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619590569, "uuid": "18636ffc-634e-408b-956b-a90edfabca46", "comment": "Malware payload (AgentTesla)", "value": "c71b2c7f08a9a00e1da9bdc2336d263624fa643dd34ff887358499014c8f3ad13b069820e41018045246e6c9fb775a4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590569, "uuid": "9fdd3b72-d21a-4745-8218-faaacee2e5cf", "value": "3A158EAC755469E0E36B5D2263CF0C0643652274793BEA0E8F6013BD1A67F173E39D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590569, "uuid": "add39ec9-4cbf-4997-a0ee-e8c173c023cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590569, "uuid": "bf3984c5-83dc-4a74-b87d-14eae26713e4", "value": "24576:y8IuKjWQVMlLkwul3/kQ4hiKSnIrxmBy2OoLA:BIZj5MxulvSh+nIIy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619590569, "uuid": "530caa46-57b5-4d5c-bf2f-f4adfac0ade6", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619590569, "uuid": "753ad7e2-8e80-4e50-8751-5b5267877d20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619590569, "uuid": "3912cf78-66d7-442b-9904-009e483085fc", "value": "GQTY 98657 RFQ MANDATE 28421.02AWYD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b0b2f3-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619619718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619718, "uuid": "19c04f0d-a47f-40a9-b3bc-b1d212e9d440", "comment": "Malware payload", "value": "92712e62578190b8fbf5a974d8038c9e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619718, "uuid": "d682b7a7-5e4a-4542-9761-7d5102a6da2f", "comment": "Malware payload", "value": "25258af5bd193016a17778fa727e6371c0cc1eca80062b573d8bac65e57b7004", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619718, "uuid": "4721cb29-ea81-4dd4-b4e5-5d0811702109", "comment": "Malware payload", "value": "33388944bc1c084ba2a9ffb7ec5b871a7f21bfbd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619619718, "uuid": "0a9bdcac-078b-49f4-9012-8de9459de0eb", "comment": "Malware payload", "value": "467a20fdd4e53c9bf8ad020f0be3645f3c607e85d34f2356fe7be9b46d2d55e307aad71e4bdafa5ed1b30d0506b4a8e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619718, "uuid": "936ff97b-37c8-4156-8b25-9fa25e1afb84", "value": "2B83121013B54E5CB9CE9F295CE20ACF2FA7F9B4260D69F571280894E722C574B2897F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619718, "uuid": "ce093a54-6082-4e62-9fc6-603c5039320b", "value": "1536:KDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdYDpZP9+jAJbZZ:KDAysJADlV378P3RPVJLdYDpH+jAJbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619619718, "uuid": "1165f14d-cea6-4e32-9000-fde258e9fabc", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619619718, "uuid": "85dc6f29-56e4-4079-b71a-da44b5a0dc7d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619619718, "uuid": "348b45e4-c581-4904-a672-018acfa774ac", "value": "catalog-1456914445.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11d2c83-a839-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619625210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625210, "uuid": "a47803c7-0465-4268-81b4-98c4666db7aa", "comment": "Malware payload", "value": "6c8ca0a7ab9d715327d73ed0b5b08dcd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625210, "uuid": "244be24f-2d3d-4b1a-a115-a32ffb9ec63d", "comment": "Malware payload", "value": "2527df59097bc771b94a7b1f3617a842f818dbd7f216e54572bd434fb3048019", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625210, "uuid": "e2e0bb3e-849c-43c3-9a65-0637d0176095", "comment": "Malware payload", "value": "83ae1a55acf316d6e5470efd7efe5292cce0c0a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619625210, "uuid": "6228ca64-b246-4d87-b98a-dc0dc5160c9f", "comment": "Malware payload", "value": "ec08f5afef36afc04213689a204ff038f71dddfa9a4787547d27de70196a706b8f31710a0f87b654e1bae1bdd88b82ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625210, "uuid": "0df5499e-0e64-4b86-af01-00f6416febea", "value": "D4830250537ACB19B5CECE2D9CD3198B6E9BF9B42A0E5CF1A12D00B5B3668051F14B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625210, "uuid": "ca003e02-95da-4214-81de-16038420d7a0", "value": "1536:uDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdt/8oZePFOLVEr0xkvU5kOe:uDAysJADlV378P3RPVJLdt/8oZeUM0eT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619625210, "uuid": "00810a7b-0a3f-4d82-bb82-a7fd4ad5ac9b", "value": 86115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619625210, "uuid": "ecd7d379-e14e-4ca6-8edf-592263d17cd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619625210, "uuid": "143cb9ce-e7d5-471f-80c3-0e711cd04e87", "value": "statistic-1307449340.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e255c12-a875-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619650868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650868, "uuid": "bd681137-72c7-4acd-a10c-f9433a7c0b0e", "comment": "Malware payload (Quakbot)", "value": "74a3c27ad972df65aac84c22c429e5f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650868, "uuid": "fd9464f6-d8ac-4f58-aeda-e7c7d1dd273b", "comment": "Malware payload (Quakbot)", "value": "252be400f715e8b8fc09760c985bb57d005b39e107326c45635f666e8193c4b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650868, "uuid": "584f2d78-2014-4d44-bd16-d05d7be5dfca", "comment": "Malware payload (Quakbot)", "value": "86db99ce31d9941328bda66408773586a0900259", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619650868, "uuid": "0489887c-25bd-4ff6-aef8-5babc6c4a93d", "comment": "Malware payload (Quakbot)", "value": "6dcd3273ce8bcb45ebc600c21b8c0f387de65fb89ec815e57cfe68add71191ab1c469ed2e7909440312f102a67b6b007", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650868, "uuid": "eded4dc0-716a-411a-86a1-471a27ebe952", "value": "86948E396A26E063D27C27B183C3EB541E67DAE53234441612B2DE183EB63A5BE35F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650868, "uuid": "a3f5d763-10e6-4969-b489-aa978bebcfe1", "value": "dce9561ab9e7e9590a6fc7c82f02f04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650868, "uuid": "74a799c7-43e2-46b2-9f31-eab1553db1cd", "value": "6144:wWrFnKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesNX3wU7HuAmt:wWrsTwr03pdf8vhhOKJETlByt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619650868, "uuid": "d00bd142-97b4-40d7-b13f-88137c502720", "value": 410520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619650868, "uuid": "aa244541-5277-4e6e-9fcd-781bac3e29a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619650868, "uuid": "3c8e0383-e21c-4e76-8c8c-3d115b345f8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3b19c7-a835-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619623325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623325, "uuid": "9d0cd469-4f44-442e-ac27-d1c4888d160c", "comment": "Malware payload", "value": "243d3c6074e1fdd590adb6851671f73f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623325, "uuid": "cd130948-a2f0-4465-898c-c72d29401302", "comment": "Malware payload", "value": "252f617650b088754337b92fc9ab1cc90fe833bed93f7cb3d1290f5743ab20e6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623325, "uuid": "ff887036-2d05-49a3-a907-cee99dbd14dd", "comment": "Malware payload", "value": "c15a0923568706e7e4a0a07087b5a9db9021dc21", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619623325, "uuid": "3558dfaa-9da6-477c-94f5-0a29c44c8c8a", "comment": "Malware payload", "value": "e1387ef60071408e2661a480fe7714e4ffb39b4e40591da48335aa99c3d3e204309b7435b53133c335e32403a72010c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623325, "uuid": "9d37172d-6acf-4bf3-a535-9c63da2b649e", "value": "FC83028C653DC6DFB1AD2F09A3DDC57FB50EEC623048248ED8C466A65D49A970C6B470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623325, "uuid": "492c479e-70f4-4a17-a3de-74a8be0d1d7c", "value": "1536:NG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttle6n6475e0NEnP6S:NGEhrHJoEsBMG7qzkj4q/NEnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619623325, "uuid": "75c04540-cf2c-4500-b072-f3327bfb7022", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619623325, "uuid": "68dbc7ad-727e-48d9-9d4d-f89f218ccadd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619623325, "uuid": "4138e354-eb82-4e91-a75e-bcdf83a78b5a", "value": "diagram-201382813.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccca25c8-a830-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619621311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621311, "uuid": "e339b0cc-9b21-4501-841d-4e6547ccc971", "comment": "Malware payload", "value": "519e31f08b117734f4d8006979c3f050", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621311, "uuid": "7d090598-ab3e-4c55-b53c-c0854c1a99e9", "comment": "Malware payload", "value": "2537ccd74848c40d9bcb14417adfaba09c152446964dd7e34e7465d679b1b453", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621311, "uuid": "261aab2f-ac47-47a1-893e-81ccca93d277", "comment": "Malware payload", "value": "58140cb2d438ea438de26dad2632e986f4afe485", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619621311, "uuid": "6be3a3d9-8cd5-4e0d-a8b8-c79e6c0c1213", "comment": "Malware payload", "value": "3aa40d451d1a691517d59f2036ab72283e75436097e98757a1073316a3734db739471ea623a31870220e5e2372ba49b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621311, "uuid": "796b3cde-2dac-4b52-8f44-90076801bff8", "value": "4D830214137A064CB4CDDF2A5CB31DC76F56BCB82519A8F2906D04A4F6338526B2CA7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621311, "uuid": "cb19d289-05ba-453b-a56b-e6597693b01d", "value": "1536:pDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdVR1EPCO0Uxs:pDAysJADlV378P3RPVJLdFEP90Uxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619621311, "uuid": "291c7161-99ee-4f8b-a055-302ffe2ffeb0", "value": 86102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619621311, "uuid": "09f7fbbc-35c7-4633-80a5-44b7cc46c29a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619621311, "uuid": "3afa8bd9-8912-4940-922a-940dc76cea52", "value": "catalog-552432308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdecc30a-a832-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619622252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622252, "uuid": "5c6e6f63-7b60-400b-a996-c6ec783af548", "comment": "Malware payload", "value": "7a2a4e54448ae932871c28738813b4d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622252, "uuid": "00844023-ada6-4eea-b248-35d01fd136fd", "comment": "Malware payload", "value": "253e01ee3f796b93626f2282efbd4a87b8ca8be53026efff7b479a6b781600e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622252, "uuid": "d5ce126d-e880-4a02-8b5e-2bc7264f8af5", "comment": "Malware payload", "value": "f6b86fc0f32a170b0a6c4e7ef330daacb6f5587b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619622252, "uuid": "5f88d2fa-ed10-4dbe-891b-e8b27984a624", "comment": "Malware payload", "value": "3f1a3076ad8002c8a80876d5bddb87f3e38d4c8a9f2a5efc4700bce5a2b427734de5123843e3e4a06ebbec2046866654", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622252, "uuid": "dd19145e-82a2-49dd-a33f-8cb8e8171b86", "value": "CE8302CC653EE2DE767D2E04A2DD883E781EECB4214434CEE4C8166B5D4EEE75897860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622252, "uuid": "24659e32-1ceb-4ad0-b610-eda2dec1b4c3", "value": "1536:yG+eUdEoDUKcEHJyVmeBPJEsIy1zEszoZBjlABlqzp8ttphWgYkCxGcf1aSk:yGEhrHJoEsBMG7qzkjh12xGwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619622252, "uuid": "3efc22a5-2b6d-4889-91d6-35e72ffd2690", "value": 86100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619622252, "uuid": "6b826179-8d28-4fab-beb1-86235cc7cfeb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619622252, "uuid": "33967510-907c-4fb0-9e81-744b37234e2a", "value": "diagram-1247320803.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd33104e-a82d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619620103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620103, "uuid": "09abea04-4bd9-4abb-876d-55d68469afad", "comment": "Malware payload", "value": "1bd4603870e118f0e1477976d1d2809c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620103, "uuid": "79b343b0-862f-45b4-9269-1401f4955904", "comment": "Malware payload", "value": "2541a3e51f834cd05088ad9ee8345b35b9cc59830cbffcc548e0a58b56954c83", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620103, "uuid": "d6fbd8bd-d8a4-4c00-a6c0-454ca0790f11", "comment": "Malware payload", "value": "20980d6f5830c13c6e2812c08b63f86b3362188b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619620103, "uuid": "b1d0ef43-255a-4608-9953-94c2ce4fbc0f", "comment": "Malware payload", "value": "58ff2b26aa8d332dc604c5605ead477f4d8646fc29b45bf298d4ec2af693c6bba75982ddc3f4f1dd92c24840a08ee805", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620103, "uuid": "9e4eb424-e2e7-458c-bb10-dd664825d303", "value": "F783122013BB9F0870CD8A3E98E31ECF7B5AB8B42D2E99F1556E0456E113C562B1447F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620103, "uuid": "240cc431-775a-4902-861f-a5381b712a70", "value": "1536:zDXudlcsseGXepSl3lvVnSS7rc5Xnv7ea3RPVJLdFcZ8VzpIsOKAou2:zDAysJADlV378P3RPVJLd+Z8Ve2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619620103, "uuid": "eb95cf08-6648-4020-8dc1-6612b95dd901", "value": 86104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619620103, "uuid": "e7de7589-ad3d-4b64-bf65-6a9ed2a00ba8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619620103, "uuid": "4f5098cf-fd20-4883-b43a-687b043db295", "value": "catalog-1770631695.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd74cc1-a86c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619646898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646898, "uuid": "fc81b6c5-8f65-43e5-aca7-991c8618578b", "comment": "Malware payload (Dridex)", "value": "abb3e8a7ad087cf7df34dbfcec6ae090", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646898, "uuid": "c39cee27-ac11-47d6-acf9-d981dba97fc8", "comment": "Malware payload (Dridex)", "value": "256b9c70ca55749581b98658b4ebed6d2cb836a5c45d3826189c2088783f309f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646898, "uuid": "f72afd48-27bf-4a7a-b0da-26751958510b", "comment": "Malware payload (Dridex)", "value": "7d7a4ed79314356cf19315336b2a2733a3b4db0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619646898, "uuid": "d8b0f28d-b54a-4a7b-833a-b4e7ef706099", "comment": "Malware payload (Dridex)", "value": "cf290302c2c4ede0bfbf0e003b55abd33eb59ec17fbe569a90c3bb950c03556d497a3e3acdae31adbb81830729c23694", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646898, "uuid": "6736853b-41c6-4ee4-b613-cfa54b75652a", "value": "EDF3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646898, "uuid": "91e759f2-816e-4a4e-8925-2d3671fe5f9b", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619646898, "uuid": "79615a95-d8d7-478a-91a3-ae78c7fe853c", "value": "3072:/nSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:PnS62Fl+pkeJl3CvRStrFl+EY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619646898, "uuid": "3674fd4b-ed9b-4ac2-bdf2-e4c8c67e71d2", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619646898, "uuid": "97543011-a798-48c5-9fed-01d4c35ceb95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload deli