{ "Event": { "published": true, "date": "2021-05-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-11", "timestamp": 1620777781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a908e30d-4275-45f8-9ebf-5997f48ed83d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4735059-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709239, "uuid": "40ec5cee-4096-4617-b573-696a6ad3101f", "comment": "Malware payload (Dridex)", "value": "0fcb6fd0949c9796969b8e623b5e0454", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709239, "uuid": "6481de97-9104-411c-b9de-834154c13c3b", "comment": "Malware payload (Dridex)", "value": "000be8f543592c7863d8627f0e97ba32046abea126d9e990a9537ebef5c1c80e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709239, "uuid": "bd55f070-8908-46c1-b301-291ff3a8c7f1", "comment": "Malware payload (Dridex)", "value": "bacdd57e19adc110c1072f6d1139c3b58a055d37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709239, "uuid": "814a0160-a3a4-4a73-b51e-d55619647cdb", "comment": "Malware payload (Dridex)", "value": "5afa52aeab6194fadbd8d0e84fc65607738fc5922f4857c6a7483cf1200ee646b7bc417a6d766cb0684ec061f915a725", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709239, "uuid": "03a0b5cb-b9ab-4c85-aa53-2d388ccfc13d", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709239, "uuid": "b573e5c7-084f-4e69-88a5-4d51e1142217", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709239, "uuid": "82929c51-9cb5-40d7-b19f-6de893fbd0b0", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709239, "uuid": "5f1383bc-4208-408c-938f-779f21a7137f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709239, "uuid": "c4fe5986-5d6d-4936-8143-60d04520164f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709239, "uuid": "4060a17f-27f8-48e6-b7be-4911c815eb73", "value": "0fcb6fd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3640385c-b241-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620727871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727871, "uuid": "aef818b1-f1b4-4c7a-b0ec-bc65cfb11a33", "comment": "Malware payload (NanoCore)", "value": "212b4438b24a7861e987a74aeb6b937e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727871, "uuid": "4b08fa7d-4daa-47bf-aba4-b516c5236bb4", "comment": "Malware payload (NanoCore)", "value": "00b6b610ff7d07af06a0888ac2095085de70aae5238bb1e876128ed0ede3fb3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727871, "uuid": "2bcd4b8a-ff15-44e9-a340-088c34fde027", "comment": "Malware payload (NanoCore)", "value": "df3c8093317d50ed2463fa96ca681a037123ddcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727871, "uuid": "321a8882-fc85-4540-8e88-9e0169d9972a", "comment": "Malware payload (NanoCore)", "value": "26c7a13a8477ef6e175fefb94d4c766452d2c8c69367f28f65bc03a1ab368f7eec5c75f374df728edc2116204569cf03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727871, "uuid": "b70feb3e-7459-4fc2-b33e-eaea2c411bfd", "value": "C025EF27324C6F9DE67E9B7AB434017443F8AF03E311E549BED4ECDE0961A4D4A62AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727871, "uuid": "27dc208c-e4fb-49a5-8c17-0db3a7cf38eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727871, "uuid": "e9f8895f-5643-44ef-bf7e-6e7cbafeeb00", "value": "24576:jxY6oqj5PXodOKITvNr9iuEmwE0s4oJVJMiSMUt:jYqjI/IjNBLMXsHDSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727871, "uuid": "767bf143-5c79-4b27-84a8-b725aac40ccf", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727871, "uuid": "74a95138-d781-494e-bcb2-1c18bb160ee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727871, "uuid": "8708d06a-9ab9-4df8-86a8-2407e54aea86", "value": "RFQEMFA.Elektrik.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39665e39-b230-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720575, "uuid": "66968a11-fae6-413b-ba0c-f55c90758f13", "comment": "Malware payload (Dridex)", "value": "33925c2877c56094313d5da6f45c5b01", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720575, "uuid": "ce029fe2-b0c1-4fe0-bad3-b34afd28e218", "comment": "Malware payload (Dridex)", "value": "00d2aee5ba42b8ff393b8aa58a7da4fe151d00a1ffdae02d9431538022d34660", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720575, "uuid": "c77b1909-cd1a-478d-bd9d-bba2b5822cf2", "comment": "Malware payload (Dridex)", "value": "1849c8bf5ca33a05c1ae53bfe33b902d68e45277", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720575, "uuid": "742276bc-de71-4d63-a5f3-a24380c4266a", "comment": "Malware payload (Dridex)", "value": "78bb75385dcf4ea6a6e0378ec1bf606db36ae8f9708a3a9a0dfa04239ce7bdc0f5f50438f81757755a43adf713c54ba3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720575, "uuid": "4ae94d53-5f9c-46e3-8451-cf49838dd12b", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720575, "uuid": "895078b9-df73-402c-8029-bc61491f18b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720575, "uuid": "c9ce9d19-705a-4d5d-bf7c-bf2ad277cc78", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720575, "uuid": "37e834df-0f4e-4ffc-b880-88f7f74a53c0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720575, "uuid": "b9f79724-f850-478a-9d07-22431718bdfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720575, "uuid": "04bbc50c-ca8e-4600-9867-c528ad03a701", "value": "00d2aee5ba42b8ff393b8aa58a7da4fe151d00a1ffdae02d9431538022d34660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1b9e99-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716474, "uuid": "ab9e0a09-d512-494d-adcd-6c26a4a82ef7", "comment": "Malware payload (Dridex)", "value": "65fdc6a5e5330a34a0b9c0f8531b79c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716474, "uuid": "97184638-100a-43b9-94dc-369a6a3186dd", "comment": "Malware payload (Dridex)", "value": "00db56ccbb24785eae72a29c49064933602e32c3f47751388731dccaf3cdd41a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716474, "uuid": "16bd35ce-4849-41d6-94b3-f9cbe9a72b35", "comment": "Malware payload (Dridex)", "value": "3867b862ab4ab4fe664e2e36c21788f06eed511a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716474, "uuid": "0f5f5c49-7429-4c80-8a7b-47e9259bc47a", "comment": "Malware payload (Dridex)", "value": "8080b239f3e9328f1267b913b5a7e676945e6d03186f8f287b82d8c2a0739aa671e1693dbaa8acd58953f4f8d62a7e6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716474, "uuid": "08ede213-58f4-4f6a-8e7f-7acca42f4ddf", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716474, "uuid": "3660b543-26dd-4da9-88b5-ad441c20f05e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716474, "uuid": "4dd1eaad-73bd-42d5-bb6f-d1cc7d484d19", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716474, "uuid": "e59172a2-2629-47d8-922c-be8c851ff0f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716474, "uuid": "709c1ea5-fbc6-4eb3-9fd2-99c53eefde79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716474, "uuid": "e3478f86-574e-4c06-84ec-46f6e731cb3f", "value": "65fdc6a5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a281bdb3-b264-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620743085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743085, "uuid": "3ff54f39-7adb-4086-98bd-b2bd2324a866", "comment": "Malware payload (AgentTesla)", "value": "30f70aa50b3b8186d1f0852bfeb46aa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743085, "uuid": "9df33df3-70c4-4bde-a26b-357179b09442", "comment": "Malware payload (AgentTesla)", "value": "0127ed2d5c88bea1754efc672d6990dab2ea987fa76d6047cf0807b7f8bd9208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743085, "uuid": "ef438cba-d199-47d3-a062-374b000a5fda", "comment": "Malware payload (AgentTesla)", "value": "8e606582f75aba27aad87c6a0628fd8d26969e22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743085, "uuid": "89cc68b7-79bd-418c-87d0-4e66b247ab37", "comment": "Malware payload (AgentTesla)", "value": "277ae2781d17babfa60686705a87904310c3ea9357907cab7beb53e6187a52eeb938c0827136812dd8f1c4cc58258e2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620743085, "uuid": "567aafb4-d5d4-4b19-8ab4-0f99e318ad3e", "value": "D153D05FE111BCB0C0F3BCBD8354D0CA918D6D09905A7E1B6288ED8D5995292B3AE3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620743085, "uuid": "f94e1faf-5377-46b1-b729-de44fc90280d", "value": "1536:whuXOQOTO19mChPUH6I/YrShnDkYZC1hPZ1cl+GkCq:wUJWHZClM+GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620743085, "uuid": "61931b76-95c8-46de-9eda-3325edf9f175", "value": 61993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620743085, "uuid": "802af09f-6794-4706-b82d-72d400adfd6c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620743085, "uuid": "4cc74b67-ee0b-4a10-9518-193fbe70e74a", "value": "NEWPO-CEAUSTRALIA PTY LTD.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5898595c-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716762, "uuid": "07b37649-245b-4fbe-99b5-98c38ebfb771", "comment": "Malware payload (Dridex)", "value": "4445fc836523740b07a0973ea23ca21e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716762, "uuid": "05f37a00-6d31-41e6-947f-055939b96e03", "comment": "Malware payload (Dridex)", "value": "0134439ca7468e1b54c8ca8083b1acd3e18b4e664cad75e7d0bf97ba49003904", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716762, "uuid": "d83b00f5-9ffc-4c59-a4bd-8dd875453216", "comment": "Malware payload (Dridex)", "value": "fa4f9577f2c5d68915a160c4e3c19caab1ea2e2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716762, "uuid": "114422db-6a65-49df-99a3-2a2ff0025d5f", "comment": "Malware payload (Dridex)", "value": "c71aaf17fec08ccc059e6c6e146fd3f33e48c2ce01490a00e29b4d0e0212ca2548f7484ee1f8c1cd2eb0401fdff3169b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716762, "uuid": "98490176-eaad-49e6-b59b-dc626f56fb2d", "value": "B2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716762, "uuid": "bf6740b3-387d-435b-bd3b-c9500109da30", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716762, "uuid": "ad75cd73-cbc9-47e3-ad14-011b083777cc", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716762, "uuid": "7ec8aeff-c5a4-47de-b48d-25a4c269185a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716762, "uuid": "7e5ae292-c614-4cd2-8130-b7fd479305d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716762, "uuid": "78e11ed4-5e6f-4f03-a7dc-2f710bd3a19b", "value": "4445fc83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ef7102-b2ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620774171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774171, "uuid": "f5fc962d-2bfc-4e55-9dfa-f163cd480f05", "comment": "Malware payload (Dridex)", "value": "7d48d0512855dcc90c4b249d56c51bdc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774171, "uuid": "3371b40e-b1b6-496e-9b13-ec5ca2c3a8e0", "comment": "Malware payload (Dridex)", "value": "015ffeaffed4b6a7458a73cb7a8ca0b17ab621cd562f2d28e5c0f896e4b2527d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774171, "uuid": "67176267-993e-42ed-b024-6e36d84011c8", "comment": "Malware payload (Dridex)", "value": "7d34dd2aaf707fbc82a81cb40803381713cf4dae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774171, "uuid": "038de650-c5cd-4bfb-ad6d-2bed09fe2ba8", "comment": "Malware payload (Dridex)", "value": "6926a8be648188cde8c4158720b487e071d04db4d396afb14a1ebb537aa21bb9d2b51abb98892945a4307a2965821b6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774171, "uuid": "90c554c3-445c-4a2b-88a8-d3a46526dd14", "value": "B4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774171, "uuid": "6fa8317c-aee8-4403-802c-7035e6e25f74", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774171, "uuid": "c0671155-ac55-49a4-b080-a909ba6e1691", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620774171, "uuid": "27e03c0e-eda2-4416-8c82-3d9fb0afd02d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620774171, "uuid": "fb697d44-6320-4c38-a425-de12b1d254ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774171, "uuid": "66d469f1-3d61-49b2-a769-48258f974b98", "value": "7d48d051_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b2a012-b282-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620755705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755705, "uuid": "2451e049-8e06-44d7-9a76-1af6ac14511e", "comment": "Malware payload", "value": "e9f58ef41b9e2719c475461459505a94", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755705, "uuid": "c86ce7f9-7624-496a-8ccf-f1f762f3469b", "comment": "Malware payload", "value": "01b7b62a055cbc890b41ff86f08e5e17c199bea02c876c5d2c2d902cdd2da60f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755705, "uuid": "8e3ace39-dc0a-4916-8faa-30d3bfc0fe22", "comment": "Malware payload", "value": "41d3c36854eb3957071ff3190b6f177defb7c37e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755705, "uuid": "b3705419-6b5e-4a1d-8ae9-2f5dd402a817", "comment": "Malware payload", "value": "851e833dc3f0796c1b9721abd36980cf09885b6ab14b25b11f59a6e0da38bc93afcea0cb4923d2f5bc755ebda5257dd7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755705, "uuid": "5c04a1cf-72e4-4d22-bfcd-27ffa24120ff", "value": "4366122E7BC297E8D09D2F71C5A657E492F582172332F69F68D413E8C90078F6B5B062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755705, "uuid": "aa7a752b-e9cc-49e5-9945-d1ea0bf80b3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755705, "uuid": "8038ab98-9b0b-49e1-9662-f77a9f078168", "value": "98304:VyO0IyEJYAHjlTiIGifbM65ZYED0z4jv+8JiivxtK:VyO0rEJZTiIGifbhSzMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620755705, "uuid": "981c853c-abc4-4aad-8489-9f8d68974b69", "value": 6512128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620755705, "uuid": "e6d0cf91-aec9-4562-b1a8-10deb7869c48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755705, "uuid": "589be55a-045f-4349-8855-a353b7606b5d", "value": "SecuriteInfo.com.Trojan.GenericKD.46273706.27055.25059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bda0655-b29c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620766992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766992, "uuid": "7b001845-431e-438b-909c-b4fd322aa0e2", "comment": "Malware payload", "value": "3000a6cfba26fc5903cbed1742709a31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766992, "uuid": "3ff67e7c-d168-4aa6-8e0a-781d60756b64", "comment": "Malware payload", "value": "01b835a6d0eb9dadb0084e9c235792cc61d00ab12e5f13db511ba1a950e8b5d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766992, "uuid": "f8856ed7-7279-434d-a672-79f820ee5d82", "comment": "Malware payload", "value": "6e6d6b9d9bf1fd007408dc1eae884cd3a4929b58", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766992, "uuid": "aacb34a0-eab9-4868-8662-f6c547410cd2", "comment": "Malware payload", "value": "8191b3542cea9e7a440a3dad8d51e9111fe60a5d74ec2293a6cf036f224432128807f9457cb537f85ead094b3653d5c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766992, "uuid": "83b3e1da-dca5-49da-b83b-180a050e0f9e", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766992, "uuid": "12607bd7-e109-476b-80b6-3f7f1e0f8de4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766992, "uuid": "9e22bb43-7486-4b77-b4d8-10a4f2844afa", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620766992, "uuid": "da127ff6-442d-4999-8e3e-82ad0ca437bb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620766992, "uuid": "5c3a4a2d-cffe-4faa-a7e6-b3d7cd9cd243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766992, "uuid": "cbd37aa6-0ce2-4fb5-96ef-4d21010be048", "value": "3000a6cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd88b36c-b257-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737547, "uuid": "7d228638-834f-4b4a-8aca-af2dc9aa79f9", "comment": "Malware payload (AgentTesla)", "value": "667dc2043a6a1ccb0f70810e7d566b58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737547, "uuid": "ef169ba0-3daa-4e05-963b-231077a8270e", "comment": "Malware payload (AgentTesla)", "value": "01ca714d163a5a4498d1174c893b519dce2f0cc968bf7aac2474694b1109f6d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737547, "uuid": "ed2ce191-8697-43a6-a8b7-4cb0dcca2fec", "comment": "Malware payload (AgentTesla)", "value": "6d749c15e64e961690e6614761ff9b8370d3bf43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737547, "uuid": "cc92419c-5fe4-43dd-ad91-67d0421f11c9", "comment": "Malware payload (AgentTesla)", "value": "409034f577e5ffacef70289088f57ab437caf27301f50a6a2e4e893b6242dd4cb7fa2ff8721ff74d14ce5307bfb91946", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737547, "uuid": "71c9d4cd-5fbb-4e52-b39b-e5548f676d5d", "value": "5105232B7360B721D0B94BF9A5926D2217B9B094F608FB6D6E8914ED86D33C18F053D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737547, "uuid": "e1d28e64-1c76-4cec-88db-008955df845e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737547, "uuid": "5a01ad9c-6095-4dd6-966a-a85d62241295", "value": "24576:bG0Sv0v/yNqtvJonFw7CiEvsxa3uNfF7:b/SY/yN8KnFh8Nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737547, "uuid": "28d12497-4f90-4c4e-824c-4d47ddf6850b", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737547, "uuid": "d712b175-24e7-4abb-8206-39bda1eb1b00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737547, "uuid": "4b27f4b2-bfdc-470b-b0c6-c2e908829e5f", "value": "cargo details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb513da9-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620741865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741865, "uuid": "ca2ffafd-a982-4b21-9e7f-56a5f75dbf37", "comment": "Malware payload", "value": "bd2068cfbffbe0eeb388f40ba17724d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741865, "uuid": "41176c3f-6486-471c-b282-965d1f80c1ad", "comment": "Malware payload", "value": "0204588ca4e01c306d247a6dfc7ec1e3a29014e08d2ee0ce73d756ebbc429b6b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741865, "uuid": "baadae50-c3b0-4f10-8e2d-062d0c9a36fb", "comment": "Malware payload", "value": "f8200558ef6bbf31474023d913642fed52b97e2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741865, "uuid": "501688ff-ee9c-4bb8-8325-393c86357f24", "comment": "Malware payload", "value": "f0b54ea818a5faf1dddd3210c1d698e654fd7dc09244ffd115aa9952da798cbc8588b3415502c47e12155b610d7d7519", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741865, "uuid": "74e70739-0b1d-47f3-bb93-7ed274921f69", "value": "196633915AD895EBFA3352326A2B76F759D234B390B0C8844F4CC71CFA459B8A4C85CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741865, "uuid": "13a6ef05-79b1-4bc3-86ea-e402bf4b42c3", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741865, "uuid": "a5b5e1ee-a846-4ac5-aed9-395b4fb1820c", "value": "196608:3RXFGRPWtWAXMp+puiDUN9xdlKMUlA3qT5FfMEEt8Z:3R1GRPkJpunjdYXBT57pZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741865, "uuid": "e06bd2f0-ec8f-4262-a806-7df1e487c88a", "value": 6694341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741865, "uuid": "758e6d14-fcc8-484b-9009-ceaa4a2d6e5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741865, "uuid": "7206b0f3-0c02-4e79-8836-358cf25a9ef3", "value": "InjCht.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e21bc90-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715402, "uuid": "b8f86905-5610-4fa8-9ee2-bd457e7c31d4", "comment": "Malware payload", "value": "a33d4624789cccb798f155a9a17bfb56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715402, "uuid": "f42693de-0ec3-487a-aa91-87ededc57ff2", "comment": "Malware payload", "value": "02738721df55077c4a8b8826e7cdd0243003ba4b34cb71f314ad05a29330c9c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715402, "uuid": "e197d590-7d44-4bf4-8051-e75bbfb86714", "comment": "Malware payload", "value": "44dff21290317cd95f3e2210d821cd033f890b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715402, "uuid": "c70e9c69-a5a4-48dd-91c2-833beea09feb", "comment": "Malware payload", "value": "66f0c4702d6cb35bcbf008202b7bfdd2f755bc5e25cf1f7ec197cd8b4ed5321937669335f8a15dae5e4c0114610aa8b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715402, "uuid": "492213e8-aa0d-41db-941d-6ec8da7f68c6", "value": "4324A500B290F924E575DAB89B2706AE105BBE34181E6943C149377A2375ED3CA37FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715402, "uuid": "9af671f1-f198-4664-8bf0-c40e60113de7", "value": "263c7af0bbeabd79b6d008518dc45217", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715402, "uuid": "bc225f48-ce07-4e51-928c-9a4bbce069d2", "value": "1536:KzzOVLuCTI1Wch/PlwWpjlI7kKOr/ibOwJ3f0eyI+ObRyn:EOVaechVRKO+Swpf0eHby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715402, "uuid": "c5c1d55b-e0c7-41e3-b0bd-e08cc548c392", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715402, "uuid": "3f099c83-6ce9-46da-ba6f-39c65efc0d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715402, "uuid": "e401bb61-51d3-40e1-8d4a-ecfd75807ba3", "value": "attached template.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02637cc6-b254-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620735945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735945, "uuid": "cb7e0038-fc32-4f99-8659-39478c0b1360", "comment": "Malware payload (SnakeKeylogger)", "value": "bc7bf29b58d8e85aee6d5991683d627b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735945, "uuid": "ad5f75e2-064c-4c77-900d-97d3dd1868e9", "comment": "Malware payload (SnakeKeylogger)", "value": "02ceb2e9e9b81072a4ddffbb6a931f8c6efa799c140657455441782f0dd339b5", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735945, "uuid": "ed9ba074-1499-4aa9-8a08-e334d4247c97", "comment": "Malware payload (SnakeKeylogger)", "value": "3ef782bd122ab87ea3ec5515f326455dc2d9b024", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735945, "uuid": "b6a3d2be-9b3c-468c-90eb-34147987db7d", "comment": "Malware payload (SnakeKeylogger)", "value": "09ecd19c29eeeca10ce285b7634b03a2b850b9effec2b4a80c372b7164981927b89c608ce6416c729e8c410bb8e50d05", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735945, "uuid": "b3b5c9d3-91c8-48bf-ab17-7d890cf742b9", "value": "F0937118BF8A42BBCCB94FB419B263424A37F9A668F29A0F35EC0509DF572835D03754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735945, "uuid": "34869f03-5cdc-4b7a-be07-ecd1e28fccf7", "value": "192:yxOefhMB9Viq8E/DO7EB7p+N7sHw7P+zwTZOjAn96M:oJf2X18ka7EB72uW+zwTZOjAn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735945, "uuid": "012f1c8a-03ed-45f2-85dd-5c2561664b97", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735945, "uuid": "df86c819-1edc-4ddd-9a6a-273b7bb23acb", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735945, "uuid": "73bd4902-6754-4dbf-a5eb-1e4a6184d947", "value": "Purchase Order E3007921.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3de14b3-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705721, "uuid": "0c87d0cc-4217-4a67-9c26-ab15cfb06e0a", "comment": "Malware payload (Dridex)", "value": "fb7b8d2610061912e0a2f83551072bae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705721, "uuid": "fc5e1d28-988a-47dc-8b41-0f6840c55ca7", "comment": "Malware payload (Dridex)", "value": "03682c5dbfb9e1ef570fdbc3a1885f67d7fc4e051381c397c1988b36b4f953d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705721, "uuid": "fc067b64-bc74-4102-b004-760532ce5863", "comment": "Malware payload (Dridex)", "value": "54f317b507734909836d340ff9d654816f8cc912", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705721, "uuid": "edf6b07a-ccb6-4b4a-a80a-9e9485272272", "comment": "Malware payload (Dridex)", "value": "dd1e8237b2d265142da1d741a386c27a826853e92cf34fe9d8ae09d5545663d609863571f2be13a727f291ec64695097", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705721, "uuid": "ebc98da3-d14f-48d4-b4bf-2ecc92763c12", "value": "B7F3D0906A9BDF0ED9C13CF96A96A879B173458C821FD5B4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705721, "uuid": "cc90c78d-1bf6-4989-8ce5-1aec1541ac77", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705721, "uuid": "c2b83089-15ef-4d8e-9e34-fce66ff42211", "value": "3072:tesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLUO:Z4+VZQpt5hyPsa1ekiEnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705721, "uuid": "238218fa-fbb6-453c-9fe8-c799d9f09879", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705721, "uuid": "76ff2b2d-6ca6-4cec-8445-758cf45e8ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705721, "uuid": "def99563-ba10-4924-b272-0c2d0d09c3dd", "value": "fb7b8d26_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd16a3e7-b210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620707052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707052, "uuid": "89848174-0f5e-452f-91eb-b10ebb527736", "comment": "Malware payload (Formbook)", "value": "5ef9a3e77b5855883de9e1a54ea8674c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707052, "uuid": "232ce072-da93-45e3-8f76-8d9275e7dac0", "comment": "Malware payload (Formbook)", "value": "044a48e38a2ce6f76042fae04889fb81e2563933d63c28532b4dba27b7599add", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707052, "uuid": "8e038b98-6029-493e-a4c0-5b7d63967f54", "comment": "Malware payload (Formbook)", "value": "f169db5236e2362301c0f8a009da7f175bf598d0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707052, "uuid": "77620058-3128-4efd-a2f7-451636b7da35", "comment": "Malware payload (Formbook)", "value": "bee9716faea87313e268e422fc4da7240238595016e85fb83d37270b9ab4fb4c7681b2d9a0dab84999f4b5de7fd89104", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707052, "uuid": "0fe85234-ecf4-4b75-80cf-d36b7346f702", "value": "BC447D81F240D896D81725F25C7EDA31656BBE8E81798A1E3247BB1918F3343206FE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707052, "uuid": "413f3761-27d9-40c4-a2be-8a67efdb9671", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707052, "uuid": "ee08a559-8742-4773-8529-8731a1e7a8b9", "value": "3072:Rf1BDZ0kVB67Duw9AMcK+3r7E4sf65NiJtmghrOy7BCRIVCNfDHO4GACFLhSizXv:R9X0GA+3jixzswYE3kLC0IgtZ3dzwIGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707052, "uuid": "ac764221-8e83-4ea1-bfa7-416a59c1b891", "value": 277341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707052, "uuid": "ba786881-47cf-431f-af64-23c26bc4d448", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707052, "uuid": "bf5dd567-6ceb-4f8e-83c1-b90568c9cf33", "value": "cks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651dc77c-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694879, "uuid": "de499a16-f7bd-47fe-9576-3e056c14ef0b", "comment": "Malware payload (Dridex)", "value": "438b4e1ef6ef40a01c598f36266fed9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694879, "uuid": "8ddd306e-fc86-49e8-93a8-db4cfa59aa4a", "comment": "Malware payload (Dridex)", "value": "04df1f712d81072785c553d717e58af924dabf9b7d8054d1444772991f164d21", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694879, "uuid": "c8b99b23-e3e0-4706-9d29-2967251ca007", "comment": "Malware payload (Dridex)", "value": "3c04264660e558d784185a26be890f95e9169e0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694879, "uuid": "c42ec2ca-6c5d-4170-ba05-81e410a7e275", "comment": "Malware payload (Dridex)", "value": "a9ec054531c4f3f0f57a9de7b665847a885268b04a9499f6e55fb39c7cd36a978299d03c4d8a1ff6845e58f976a16562", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694879, "uuid": "876db5fd-ab4e-4a20-b9e9-21b323a006b8", "value": "5BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694879, "uuid": "1e98ee29-8c45-4a5b-b316-ce71329e8f84", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694879, "uuid": "f0771de2-b65d-4ab5-9b65-94cf1c7a6a45", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694879, "uuid": "544053db-cf1d-4d22-9b2e-96edff3749e4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694879, "uuid": "9920889b-ccd2-4cde-9521-747cae829692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694879, "uuid": "2b74e2ae-2dbb-45cb-bdfd-fd1fb938447c", "value": "438b4e1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c29d8c5-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694864, "uuid": "8dd8cd6a-e057-4021-ad04-ba514b59cf41", "comment": "Malware payload (Dridex)", "value": "6ef37b879eef1c2d6fa5409a35252743", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694864, "uuid": "840ccb83-d15c-4519-8f05-4ff56466c7c0", "comment": "Malware payload (Dridex)", "value": "04f8f1ef1545485060293f708afe752264e6b32cfe3314cfc39916455651b6e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694864, "uuid": "4d164df6-d28a-4898-84aa-b10e993af294", "comment": "Malware payload (Dridex)", "value": "4b62fceba55718f510ed4b0f112b945ffc35b617", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694864, "uuid": "b748f94a-51f4-4fe4-bf36-5139fd737d4d", "comment": "Malware payload (Dridex)", "value": "da8f890844f6b342cadef0a681e80ddb8912561a27f49398e607bcf0faee7bc1121eff4e8104a46f3f32ef79a6bad15f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694864, "uuid": "e011e6e8-39a5-4fc1-ac31-095616bafb53", "value": "6FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694864, "uuid": "6ec19931-54af-421b-9cc0-fd6d08ad9be0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694864, "uuid": "844f3281-fb4d-4a9c-a148-67404f08367a", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694864, "uuid": "19dce95e-01e7-4124-be5e-fa5128dcd463", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694864, "uuid": "87bdb3ee-5db9-454b-9bf7-63e8d6536842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694864, "uuid": "dbbf02c9-aa81-4f71-8007-df6a3f09a2a1", "value": "6ef37b87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a16a7ee-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717194, "uuid": "271db40c-402e-4b70-ac04-36189b100e1d", "comment": "Malware payload", "value": "315e0ad57c0807ecacf08d749db0dc29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717194, "uuid": "a8885be0-054c-4352-b0ae-f3c06aa9376a", "comment": "Malware payload", "value": "0506ded11587b16b9941bc4bf0748f6266f7a463f832a193596cb73cc176063e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717194, "uuid": "a21b9652-d1f9-4fc4-89a0-bbbeda610d6e", "comment": "Malware payload", "value": "0105cc75ca7e92d848015757715cedc0d0fa0ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717194, "uuid": "e9bd706a-4839-44b6-92ba-67789add5e29", "comment": "Malware payload", "value": "b38d09672b607e1aa7f81d172d9e3d37a618cab715285105b09d406f8460839746d19d2d67e05f103fbcd215c4f30319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717194, "uuid": "2ffc904b-1166-494a-875f-9ad724e90015", "value": "BE35D48631ECE596D016ADB8C85BD7F33392DCAB8B42E74330ACF55A646779AC50340B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717194, "uuid": "2d594577-d065-4a34-9873-fc906e20f39b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717194, "uuid": "b7d28316-ee25-42a1-b9dc-0e7b7f9ca649", "value": "12288:cMMPSCM2sUzMmFC5fFCC/TVTbiZJ14LM1t9OMHfCd7tur0Z:cFeutC/TV+4MTAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717194, "uuid": "37f77e41-2770-4d32-aed0-a6225e197939", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717194, "uuid": "a07a954e-96cd-47ac-99cd-6c1d1c826346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717194, "uuid": "7f088f06-3fe3-4b6b-8acd-8d810cf2b5ce", "value": "315e0ad57c0807ecacf08d749db0dc29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c13b07d-b22d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620719211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719211, "uuid": "0af2a68b-5e9d-4621-bc5c-2c7473cbecb3", "comment": "Malware payload (AgentTesla)", "value": "baa6075799499303313dce93f9c3a5b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719211, "uuid": "b5a94b28-4eb0-4393-a120-aa85b2197797", "comment": "Malware payload (AgentTesla)", "value": "05833df117794dc0da1608f4da3f1826bcf82794e98db1735225b36043711060", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719211, "uuid": "13b6721f-479f-407d-8799-1ef5e2c13e1d", "comment": "Malware payload (AgentTesla)", "value": "d24d4c8b9aa8c2e8ad9df5ded7a0887208ea3c70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719211, "uuid": "020a63bd-9dff-43c7-b051-7d9727c17ff6", "comment": "Malware payload (AgentTesla)", "value": "e1f791b98dcf886ceb667d5ddc6fe93dabd9bf75644101b6ad5ca52fad396d2f83a3337759815c0176903625dccc1c1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719211, "uuid": "3f38b3b5-9e20-42a8-b24b-138ffbed5ed6", "value": "79B423CD898F44C3970627A4D926E0035B82AEBDC6CCD3181FDB971ED1C0EA6B157A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719211, "uuid": "34dadac3-8a40-4f3d-8303-d34b39c53b97", "value": "12288:93WGdKQ1eGDOLCtS5kgO7xTR6zZ2RKeoYg3YGViUk1MfqgnA:ZLdV1B6LCt5gO7xd6zZ2IYgoGXa/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719211, "uuid": "1ace7e18-6a89-4819-b5cf-e97fa6f7071e", "value": 524406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719211, "uuid": "fcbc7637-ad1d-4e58-bdf4-f72c33351ab6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719211, "uuid": "383a54ba-16f4-431e-beaf-7572eb55517f", "value": "FIA CERTIFICATE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f76475e-b23b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620725363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725363, "uuid": "ff3eef65-9c92-4331-80f1-d15ad60d10eb", "comment": "Malware payload (Dridex)", "value": "0d1038cb566739e2b437a69b933d2287", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725363, "uuid": "8ab7ecca-9ae9-4002-90cb-64e18fdd3a31", "comment": "Malware payload (Dridex)", "value": "05a9ba97ca75d4d35a73303050a3dc09f9089f5fbfee1c668477a2ddae3b2327", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725363, "uuid": "2b56335b-770b-4f48-95cc-4e0b949ed976", "comment": "Malware payload (Dridex)", "value": "669a4c6fa9bd9fc6d28d6596d22cdee8d2e24cf8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725363, "uuid": "b72256ab-0991-4beb-97f7-e392e319fdec", "comment": "Malware payload (Dridex)", "value": "038a3db79dd819fe2a376123467146836d90abfe068569f03d1415f084ac22bff913a0bb27ef5e50008bb172dc4ec40d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725363, "uuid": "699e7fa2-76af-4b8f-899c-c2c34ca071fd", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725363, "uuid": "c74268ff-1e03-4ca7-be23-4bd869371254", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725363, "uuid": "eef1d4d2-05fc-49d0-a90d-8edcbf692ff7", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620725363, "uuid": "f09bcd1e-cdd4-4d32-a58a-9297202b9b02", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620725363, "uuid": "bea77121-04eb-464f-9526-e3db349fda70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725363, "uuid": "7611ee7a-888f-411a-834c-5dce0c145d37", "value": "05a9ba97ca75d4d35a73303050a3dc09f9089f5fbfee1c668477a2ddae3b2327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2a121e-b29c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620767073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767073, "uuid": "ae077f08-5d84-483b-8e90-6f4450a36794", "comment": "Malware payload", "value": "282f32dce8db7ea00b2373fecfecbbac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767073, "uuid": "687c6961-23d1-4ac6-98cd-4476f4fa9ff2", "comment": "Malware payload", "value": "05ba25dfbcaf3378107e16e159145afd1f5c76352ce552ba9f2444619a000ac6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767073, "uuid": "36556a6f-3222-42c0-916d-b36e1a32ef05", "comment": "Malware payload", "value": "34952fc90763e4ff0ca6706c5730c963e6b21597", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767073, "uuid": "f4d0a081-d4f2-49a0-ba97-dba018c1edf7", "comment": "Malware payload", "value": "3d1179518e9689425d783495ac7c7ad5ef8216118c820c918aa077071165894bc8fde7fcc5e73c87a76b226953e6542a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767073, "uuid": "e625cf05-5d75-4a88-842d-339daabebc16", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767073, "uuid": "ba8f6239-91a7-49ad-957f-a1b464c82da2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767073, "uuid": "7c058bdd-1fe9-4311-a0d5-6af03be73fc6", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620767073, "uuid": "d4647811-1f5c-41cb-bebf-edaef282d265", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620767073, "uuid": "e44f7a2c-dc42-4797-aadc-6f30a601d2de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767073, "uuid": "3d7a14cd-2ee4-43c2-bead-29a65a035a17", "value": "282f32dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654a3af8-b235-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620722796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722796, "uuid": "639b943a-d319-44cc-988e-75f19aff0576", "comment": "Malware payload (Dridex)", "value": "392763f30bb23fd59109e1c70df61888", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722796, "uuid": "36da8815-cde7-4b6e-ae80-3f8a2e16ea79", "comment": "Malware payload (Dridex)", "value": "05ed6d423552ca65cdc01d9329bade7ef4437e55304a6794baca37d175ee515b", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722796, "uuid": "cdd39d37-d60a-49ee-ba04-658a24a45ed0", "comment": "Malware payload (Dridex)", "value": "5e14aa49a49bbeb9666e5f9fa819ff3821abb739", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722796, "uuid": "45a09cc2-232a-460d-9bf7-b4b4900a9801", "comment": "Malware payload (Dridex)", "value": "4ab4fc1b8fd48a511d70fc8b9002fd19400b8842b336278fc5412a32cf7253b8dddf89f9b84e3ee7d0594c069c4c945f", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722796, "uuid": "38d13863-2ddd-4cc0-9f66-64f64802dbe7", "value": "A023E0B8EF296E2FC2172C77E00910E6E42C3A98C459DA007E65E1A916D11511FFF7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722796, "uuid": "3504ec6f-1e9d-4938-987e-80b2901e1cec", "value": "768:tjT473DejEldueMGDJZVRgk71u3PwQZRfzA9nF/s6:t4vTuetHVFIPw2U9nF/s6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620722796, "uuid": "71a8b48e-e073-4e07-b1db-8614d1203512", "value": 46715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620722796, "uuid": "4e05b607-fba5-4d4f-a1a3-f9e0797a8c0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722796, "uuid": "42a7ce8e-1841-4fd3-9d88-1292d882284f", "value": "Fattura_01399475.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add6307d-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705738, "uuid": "dd9f43bc-df4d-410d-9049-be24219b85ec", "comment": "Malware payload (Dridex)", "value": "1ef70b8f1bc5fb0d8b0128fbb9664851", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705738, "uuid": "b640105b-7696-4cc3-95b2-6003d534bcb2", "comment": "Malware payload (Dridex)", "value": "06a0c5c66152d203c37a45c0de40f98b2102a4d8667c12415ec600d1462247ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705738, "uuid": "257162f5-95af-4b05-b56f-a0a1bfaf0dc8", "comment": "Malware payload (Dridex)", "value": "5bbe27294b2a8195bc8233af7995e85bae6dc43f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705738, "uuid": "2e298fed-acbd-4df6-9c1f-d1fc544a5bae", "comment": "Malware payload (Dridex)", "value": "0f0258051cd85eab3d3515c209675ecc92d2881c843e6a8122b1f759450428e75621e3f21ef87de82e31cb7fc1d9d52e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705738, "uuid": "c58e183b-af42-4804-8ff4-c9b13d8ea3e3", "value": "89F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705738, "uuid": "f1d8b65d-7a53-4045-8c3c-61d52a80e514", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705738, "uuid": "42febe7c-22f7-43d3-b1b7-572dde476386", "value": "3072:FA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:F3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705738, "uuid": "e24d6b59-29ed-409d-bbbb-113053e90bc5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705738, "uuid": "34300720-2e01-4174-a82b-c1b92078b9ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705738, "uuid": "e8d7b6a6-558d-48d8-bce8-b26a1ed2247d", "value": "1ef70b8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10271448-b26a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620745417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745417, "uuid": "e940683e-b6c2-4fae-b33f-42f86a8ce9e5", "comment": "Malware payload (Dridex)", "value": "1a9e56b9c139fa17e8662c58e9c84667", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745417, "uuid": "5768dd27-0dff-467d-a599-f447ddb53592", "comment": "Malware payload (Dridex)", "value": "06f83e565272b560462f7c617e2397134d23532fa514eb538157e5ef17afb149", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745417, "uuid": "15d288ba-68bf-4a37-8974-0e256632ad00", "comment": "Malware payload (Dridex)", "value": "22bb2d92eb778d93fd963cdc5dec1707dded47eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745417, "uuid": "ca398fd5-4b18-4bad-8478-37bbcd941ef1", "comment": "Malware payload (Dridex)", "value": "64c542a05aa3cc5a939def7409d3f9eef5d33f4574e17d92dba8898f216d8e8a8971bb8d78bec2f4a349c7ffdd9b967c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745417, "uuid": "e4e6c503-cd52-482b-b142-5d24caabab20", "value": "F6F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745417, "uuid": "1a5135fb-a16e-40d5-b098-3b45dc38f116", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745417, "uuid": "f61e5f52-5ae5-4f6e-83e3-32f782f3ad11", "value": "3072:aWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:a42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745417, "uuid": "2e3fe8cc-3d2d-485e-a298-64e57a464e22", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745417, "uuid": "844e47b7-4f7c-49aa-9555-ce1cc27a71c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745417, "uuid": "357c063d-76d2-466a-b400-c88c6783dee1", "value": "1a9e56b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d71fd6-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723824, "uuid": "ce903fb2-5e5f-4c35-bb56-230012867690", "comment": "Malware payload (Dridex)", "value": "657183c80a6b2e186ebb794def71c5b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723824, "uuid": "8df96e90-4929-4c3b-a76b-27a9f066898d", "comment": "Malware payload (Dridex)", "value": "06f947313051e0178fdaf046826be0019483e34b6d921f5b60d84f1c7a9015d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723824, "uuid": "1234d423-d05e-4bc1-b672-8c6e68722175", "comment": "Malware payload (Dridex)", "value": "986496e864e8e0749b1b2d1aa9fddae311c5e1ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723824, "uuid": "8baab3a9-48a3-4516-a287-dd461bb19f2a", "comment": "Malware payload (Dridex)", "value": "e6f7b47298392d21beab8a30dfffb2225167f78e12fdc13a183a8bc52f6a42a08db9c9ff222a54f6911f2616060e3f61", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723824, "uuid": "494247bf-9e29-4b7a-9b79-109ecaff37d1", "value": "3BF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723824, "uuid": "85a1e807-6907-4b3d-8e53-66e215b1f585", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723824, "uuid": "936e8690-907b-43de-9333-bc06f05fa83a", "value": "3072:6IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Tc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723824, "uuid": "8da4d254-3903-4a25-a0d6-52fcc2d59cde", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723824, "uuid": "e282407d-4c00-4519-9d23-931cd490932c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723824, "uuid": "a7a73bd4-fe82-4de8-8613-b50829ee46fa", "value": "657183c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1887baef-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620702052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702052, "uuid": "cc463128-fa45-40a1-8c90-4a6f562050b5", "comment": "Malware payload (Loki)", "value": "483606a3262dce394e4bfec106cc7557", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702052, "uuid": "463840e6-b126-4de1-a4ee-1f8494201c86", "comment": "Malware payload (Loki)", "value": "0718648927fe37ba115ab36d5f869bcefb6b274cce2a79e6715961a0bd136237", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702052, "uuid": "284c46b5-51fd-4ab3-b493-783e8d650553", "comment": "Malware payload (Loki)", "value": "14ce7153db1b5941988ce7173cec30168c8cdf73", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702052, "uuid": "1ce04db7-5fa6-4fbc-b123-eb53d7be6b95", "comment": "Malware payload (Loki)", "value": "e93982cd0967175ee5eb66d56a522b4ab205aaf60f49766cf392592a687f06a0a697851c1087ed99efc2aed1af130612", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702052, "uuid": "590e4475-7de3-4189-9784-c9e9a046b513", "value": "B7D407C2C54A5ED8DC860239D13A68BBFD574DB597F264DA039B7D211B322AAB0D3C43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702052, "uuid": "f8fb25b6-0133-4971-a149-9ca7c6846757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702052, "uuid": "92523681-3c12-48c1-a2b0-91ee25cf11a8", "value": "12288:pHFMw7Y9MA59CyMAn0Dn2wxC3k0pywvMNQCFTZTZDv1:pH+w09tVo2wx50pyDbVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702052, "uuid": "29752591-ca5a-4b89-a828-8ec17cddad69", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702052, "uuid": "14d31186-ef92-45fa-8716-64d7213df0e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702052, "uuid": "09bc6133-cf0a-4c23-9178-325ff77afc75", "value": "483606a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc576dd7-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698488, "uuid": "028dab2a-2d1d-4a93-a4d4-d557ada4aeee", "comment": "Malware payload (Dridex)", "value": "f816197eb6b98400a41238e74643f46d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698488, "uuid": "59e69c0a-9724-4e0e-80bb-ec3e963fe7e6", "comment": "Malware payload (Dridex)", "value": "08aaf5e973ab69a04ef033a3e4b81ec9f1e18bdc9995e09df3e92aa042bba549", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698488, "uuid": "7cdfa933-91aa-4784-87cb-384983d23af6", "comment": "Malware payload (Dridex)", "value": "a5b7141e8d824cd750bc32b5623bb605b4fd56aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698488, "uuid": "11842068-5c63-4dc3-93fd-85c5ad527935", "comment": "Malware payload (Dridex)", "value": "bc098e2dc94d27ad2334b59b77557b75116c66961d1320a60a19483c5a5e66b47a9e7364a2518769c4041495d2249645", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698488, "uuid": "28cf7fea-1eac-44c7-b139-5b6dd7691f28", "value": "74F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698488, "uuid": "85b9ad5b-8991-4073-9ce9-d28249363a86", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698488, "uuid": "8aa4e0e9-158d-4fb4-b207-bb8525ce25a4", "value": "3072:oIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Bc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698488, "uuid": "4d5cd8c8-3b6f-48e3-a94c-2c43bf88e405", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698488, "uuid": "64e85ac7-5969-45c6-aa00-dd7e9ddbcdd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698488, "uuid": "fff5c33d-cbbd-41c1-8aa4-bac1b57918c0", "value": "f816197e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3e143c-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728957, "uuid": "27016d25-5fc8-40fc-8ef1-addbb546bd37", "comment": "Malware payload (AgentTesla)", "value": "0c3098e9105cbea5e2d6ab99849afaeb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728957, "uuid": "9e77a0b3-c2a2-4f7e-bd65-139d969400a4", "comment": "Malware payload (AgentTesla)", "value": "091941767ac84ff519693960cd6cb15e799da88cd08477977ec10fad6fe00b4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728957, "uuid": "34f267c9-7b85-43de-a430-ac841b765746", "comment": "Malware payload (AgentTesla)", "value": "35286653ce0368bef6a4344c4275279c60d2471e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728957, "uuid": "46324bb2-e232-49f7-82b4-25b1dd9371a0", "comment": "Malware payload (AgentTesla)", "value": "d2004e3d28afeaa1240c43892b675dc8f4abb132a2c2399d7ddec33668ae83e03787a572aeb0645eb174b3c3ccbefbba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728957, "uuid": "af9d70fd-903f-4c77-8ebd-446ae882d753", "value": "201501B052E50F7BE7FC20BDC01697408BF6D2132622EBD87EE5A4D900D3BC54B66666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728957, "uuid": "ef9c6d7a-1c41-41fa-8e9b-731ef8d09c9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728957, "uuid": "0d960ba0-a049-4438-b74e-bc1a78df16fc", "value": "12288:hXwP6dooTDHmYdVThYsn1obXSYHbARFgjXXQpXk9nbNqzh7cCq+vYP6LyV3Ybf:twaDz6sdYHbAAWXabu7Nvyhlcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728957, "uuid": "a9d502ad-51e4-4d9a-8c39-87e9b65854be", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728957, "uuid": "83dcdb1c-88aa-4fc0-a085-2cdab0e83808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728957, "uuid": "844b8d3d-d103-4acb-9b8f-8caec976e39c", "value": "PO.#4500499953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558f6563-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712891, "uuid": "fcd69af7-935a-4894-b9f3-ca1bb4533f0c", "comment": "Malware payload (Dridex)", "value": "7456a940b92df9c95eda8514ab9f4b6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712891, "uuid": "03709813-a8e7-4039-996e-d4ab5b6de26d", "comment": "Malware payload (Dridex)", "value": "092e1861d0eb14047fff1405ffa5d8022d0312aaec73ba8566b49cca91063b39", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712891, "uuid": "42e7466f-4e79-4add-a799-be60f173d8cd", "comment": "Malware payload (Dridex)", "value": "887745f0488d2cbb638b5500905df618882c94c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712891, "uuid": "8b4af207-3b3a-42ad-bf23-ea3eca718a3b", "comment": "Malware payload (Dridex)", "value": "e0c2c14d4aa321c46ffbaae70e2e756bc8166a84c4fe6ed26d4858b4d67a9145c41e2a0e582c6844434916aa55ee00e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712891, "uuid": "ce24eb6f-1dba-4b35-8cde-9bc18b5c95c1", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712891, "uuid": "7a3e874e-5965-4612-8c23-b543862a2507", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712891, "uuid": "ce9911e0-8237-44e1-a72c-8c1e000a94b5", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712891, "uuid": "8fbf1165-128e-4341-80e7-3208bebe5df6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712891, "uuid": "651581da-d020-4e89-aa5e-2f81e430207f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712891, "uuid": "dc994241-8856-428e-bb80-7b5f31c55095", "value": "7456a940_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f247de-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702049, "uuid": "434a1780-ccb8-4b5a-9353-e71e0c81f217", "comment": "Malware payload (Dridex)", "value": "6cb4b20636bf4eace29ce2e4c9ac7fd7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702049, "uuid": "0929718b-093b-4d73-aa9b-11e9037d8bd8", "comment": "Malware payload (Dridex)", "value": "094a8131d4cbfeaa697ddbef3a5fe79cd99e5e4edeb96e0602feba30d6c810de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702049, "uuid": "8dfa005d-ef08-4f2b-bcfc-5dc0d0f20f25", "comment": "Malware payload (Dridex)", "value": "9ea574e5c26fe2d9ebd97f91d45265fc733bdc9c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702049, "uuid": "f7d50c60-1dfb-4e43-9b12-f2bdd21cde5d", "comment": "Malware payload (Dridex)", "value": "1e60b995d8992b28a4b9bb32b071a2add4fa78a974d58890c0036780c4828cd5e9b5f84a396288e563b62016f9f77412", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702049, "uuid": "0823a927-2851-46e0-9743-f3caec3b982d", "value": "27F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702049, "uuid": "c379becd-10bb-4d57-9021-1f69e7cacaae", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702049, "uuid": "945e077c-1991-4827-99db-134fd488c566", "value": "3072:aiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ZeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702049, "uuid": "162c0003-c01d-49ff-8318-28be154d7bd9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702049, "uuid": "c03b94be-1a24-425c-932e-ec07d3511d4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702049, "uuid": "8dd936d6-5813-4481-9437-f5f316e4b8a9", "value": "6cb4b206_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84474e04-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Snatch)", "timestamp": 1620694931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694931, "uuid": "34f2713f-a6e5-4ef7-bdfd-d61b5d610e06", "comment": "Malware payload (Snatch)", "value": "0ef0070dfc132fc368c950f0bef762a3", "object_relation": "md5", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694931, "uuid": "e02c714a-1a4f-4aef-942a-c8228cea8159", "comment": "Malware payload (Snatch)", "value": "097d28021ffb26cb5b7d2d1377578cd6e2005549e44b5b2491fd310ecf50f7a8", "object_relation": "sha256", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694931, "uuid": "4beaa802-c21e-4fee-be76-0ae291957708", "comment": "Malware payload (Snatch)", "value": "572c864dfc9160e5aef2dcc9359bf909ca4ba1c5", "object_relation": "sha1", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694931, "uuid": "a042ac21-4c2c-4519-8797-dd0414feef31", "comment": "Malware payload (Snatch)", "value": "1fa707fced90268d49d329b3e7b272469efb0405a7451622507a736aba31a8c02ab6fca1660eaa28d0423af1bb85f3d6", "object_relation": "sha3-384", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694931, "uuid": "21ddb828-b219-4305-b4b1-9e972cc109bc", "value": "CDA55B51FCDB90F2E603153158ABA36FA334BA055B35DBC7C6406EAAED736D10D3221A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694931, "uuid": "340eb674-a7c7-4453-bf7b-c7d55854b8c8", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694931, "uuid": "6bfb54cd-11f6-4cb2-8581-98133a517d6b", "value": "24576:O4tzlJ7As0QZi28TP4pK6uoLF/K8ctF5SA3dx2QiD3oLeus/hFeIqf0eaZgHwX+O:OIrfK8mF5ZNoXeXQXYpriCqg92+F1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694931, "uuid": "95929910-6651-427d-861e-a83cf037be16", "value": 2207232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694931, "uuid": "ed5c4808-70d4-422e-aa8e-ce418fdbb37b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694931, "uuid": "78b1927a-a065-4474-9c64-9f01524005ea", "value": "0ef0070d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1f9e2a-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705732, "uuid": "25ff63fd-dde9-441e-8bb2-5396b55e2ecd", "comment": "Malware payload (Dridex)", "value": "d7b2446f30b1e1d2f397acb957df8277", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705732, "uuid": "5b9a80f0-23a8-4939-b34f-6940255a61fb", "comment": "Malware payload (Dridex)", "value": "09841eee3482be2e734f7234f14554582c7a61867c9dd7a86725ef0a0630e460", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705732, "uuid": "81a26214-a880-4f89-8c43-5d9b639b5cb3", "comment": "Malware payload (Dridex)", "value": "7cd49ff00835b9a06df4a22554982cc7382f6973", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705732, "uuid": "00665ab2-e46d-45d2-b221-178173934bbd", "comment": "Malware payload (Dridex)", "value": "b7c9f422c294a8b17c40a0332502b90765437351f585dec241f09e7c39b5659ed5770723fa0d3338d794cdc43e175094", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705732, "uuid": "598a4e0b-dbc0-476f-8fe7-d9a4003a2825", "value": "3DF3D0906A9BDF0ED9C13CF96A96A879B173458C821FD5B4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705732, "uuid": "6b55796a-fa83-40c4-9621-f8eb7720ab32", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705732, "uuid": "593c6f62-b9fd-485b-945b-095cee3563ea", "value": "3072:/esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLUO:T4+VZQpt5hyPsa1ekiEnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705732, "uuid": "9e3d8d01-6719-49e9-9fcf-a0e0da39c856", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705732, "uuid": "acb0b410-fe20-4042-87ad-e9e0eda1fc00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705732, "uuid": "edbbaf00-7fad-4dcb-a66c-635682a80b39", "value": "d7b2446f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02de8f6d-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620714900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714900, "uuid": "b9a8de71-c0a1-4479-a251-7da8db606de3", "comment": "Malware payload (Formbook)", "value": "45108cf39d0fff942412938967a58d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714900, "uuid": "926eb085-a161-4813-bf99-a72c96c67b55", "comment": "Malware payload (Formbook)", "value": "09ef9a06e020a4a6b9a2724fad9999b5c4409fc4c1424d5a22d7a90dc10c79d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714900, "uuid": "0fea863a-f463-4bcb-81c8-30f11c8ddf54", "comment": "Malware payload (Formbook)", "value": "ef773f9b2781968121a3c09d024fd168c5d36f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714900, "uuid": "9e19e864-cd29-4f7b-aa98-6764585ff7f7", "comment": "Malware payload (Formbook)", "value": "a43f288d7c967d56b567d96bdc2435564c3cd58cdac723dd93b87cd5f20694bec76bb517403398bc72e555661d1d2bf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714900, "uuid": "7e7906ea-6b58-42de-b808-4ca39e63526e", "value": "B505222733DC0F4FC5FD90FC1082651251B1A20E7243F6896DA99EE998E27E55B932E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714900, "uuid": "b3a8c297-887a-41f2-a0ce-9a0331bfecf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714900, "uuid": "3079cb5e-ed8d-49aa-b662-50ad90bef5e7", "value": "24576:QAmzD3Yrm+TmPwI+rHhLrYnQKYCqIN0rp8bc:QHv3AmUawhBOQGq5Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714900, "uuid": "5e4aae89-7998-4238-a78a-4a1911f3aab8", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714900, "uuid": "03706c29-296b-4fe7-81fe-f94b68bff874", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714900, "uuid": "e528f43c-6439-46cb-94b7-b8de2a1f5a8c", "value": "PO-UTITECH 0511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88eca3aa-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Phorpiex)", "timestamp": 1620715984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715984, "uuid": "d97b613d-1d77-4e32-9181-b0ecdd463078", "comment": "Malware payload (Phorpiex)", "value": "1daca30b2b6c0ef60e02df04e656e990", "object_relation": "md5", "Tag": [ { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715984, "uuid": "fe5cafa9-f5e0-4fcf-81da-10fa15192b4f", "comment": "Malware payload (Phorpiex)", "value": "0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184", "object_relation": "sha256", "Tag": [ { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715984, "uuid": "ea558d55-0ef8-47c5-88fd-5fada0c1677c", "comment": "Malware payload (Phorpiex)", "value": "c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9", "object_relation": "sha1", "Tag": [ { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715984, "uuid": "4b15f177-70de-4cd0-88f9-48236dfac36e", "comment": "Malware payload (Phorpiex)", "value": "65d2b36586c9778d6a024e8b4a1217b58e0e7a05adf378e78d9233c386c2d1e96ea2980d0e1ade075ec0d8ef0cff9bbf", "object_relation": "sha3-384", "Tag": [ { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715984, "uuid": "3f375621-4ab1-4b53-94f6-c3a176355391", "value": "CA255C6AF75088A3F0221D70486FCA7111E7BC546011551E76AA3F2F39F23622AAF75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715984, "uuid": "4a2bc85a-87a8-45b7-8b79-cc1ba5a65c15", "value": "179f503f2595426f809b8b283fc488b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715984, "uuid": "a573e904-dfea-4727-b0b6-bb5fa58c983b", "value": "3072:A/l1TNbnAm2MdyEa+PIO6NWOhP3E7frdw/DFjBp2P3+cpdF:+l1TxAmNkWaPUsFjLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715984, "uuid": "479477da-1373-4d12-813a-cb82bd455743", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715984, "uuid": "84c6ad5e-1c9c-4b65-9c31-90bd252561f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715984, "uuid": "88e1d60e-c2ce-4af1-bfdb-0c8e7b2bfdf3", "value": "0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5766dffd-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620712465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712465, "uuid": "c29f9753-0fe1-4bbc-b6c0-9f6bb09bc7e1", "comment": "Malware payload (OskiStealer)", "value": "a7a15f15f05d70160a02d8b741c78afd", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712465, "uuid": "9ce039c1-0aff-4c73-8bfc-c9ce622db281", "comment": "Malware payload (OskiStealer)", "value": "0a6fe6c800665070be308f2ab058a313295f94650d14f68182ef89e8b83ed181", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712465, "uuid": "b9aebc9c-3149-4826-91a9-4e5a1d3242b9", "comment": "Malware payload (OskiStealer)", "value": "3873dd8017ca301c65f69524ba302b39867ffd3d", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712465, "uuid": "6be05790-55fc-4029-85e8-dc002329cabc", "comment": "Malware payload (OskiStealer)", "value": "9ce6c0d9fd2091bf0a450045f6e3eb724b043e3a73d85b8f55d195daa3d916740789625a158e0ba48864a7b292be8265", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712465, "uuid": "5254edb7-523e-4fe8-9708-f90c8f873807", "value": "F6C42325198EAEF857CC23771C80E267D7A18274C5D0814DF0AD3E17187FDE8B9A7629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712465, "uuid": "ceba9569-24e2-428b-81b8-a30556b0c62d", "value": "12288:wzBCCti6FTS0bHUFcIvxoVHSioq8yx3JKYdIr+cuJW:w1CCti00F9ZmHSioq8yFJ3dc+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712465, "uuid": "a7866fab-f95b-49a2-963e-b6e711b72333", "value": 548609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712465, "uuid": "fbc3de52-e08e-4062-a896-071ae49258e4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712465, "uuid": "6e393a3f-e130-4584-9917-c87ac83ff9e5", "value": "DHL Delivery Document.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3533d16-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709264, "uuid": "a6ec5b6c-cf64-48ea-ac38-0acacd4256e7", "comment": "Malware payload (Dridex)", "value": "92064832bbcb3233ff12c8bab678d8ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709264, "uuid": "8f7e707c-04e3-480e-8c06-d01a7fd9ed0e", "comment": "Malware payload (Dridex)", "value": "0aa9e70d151af23a16e3b0e39523784e487c294a34dcf077c2620d8df71ff398", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709264, "uuid": "d7be470b-b589-4c24-8d9a-76f6710f5b38", "comment": "Malware payload (Dridex)", "value": "05f6967342efbbc72201775bbbb69d3f3354f278", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709264, "uuid": "bf489140-56ed-4f2d-bf9a-a6687fce1fad", "comment": "Malware payload (Dridex)", "value": "6d903b3525e4b5096f7b1d66c3c430543a41fcd587c39bd852cfee2f6be98c9c6358c4816b4c18d58543fc643c87cc46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709264, "uuid": "25d38780-15ef-424f-a8c6-903f895c0165", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709264, "uuid": "1550c106-0156-484a-aad2-2f2ea29f6d7a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709264, "uuid": "85f19333-0014-4235-a4be-86bcb40d10ed", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709264, "uuid": "3fd1ffc5-e2cc-4fa6-8e27-3378cf64bc20", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709264, "uuid": "a9d32f1e-095c-4775-860b-e8ab30d14993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709264, "uuid": "6a7eca60-ad02-4120-ba1a-478642510474", "value": "92064832_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fa0853-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620716786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716786, "uuid": "c441a55e-3794-452b-b8ba-ee8bd7f22d74", "comment": "Malware payload (SnakeKeylogger)", "value": "49a078d96000b6194840e8aa117e655b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716786, "uuid": "edf7c809-bf9f-419d-a233-80e4d1cffd2b", "comment": "Malware payload (SnakeKeylogger)", "value": "0cbcd540338a4d4e05691649cd32dfbc5abb133864ac018a0c0ed4fdbd67a60c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716786, "uuid": "d4cb1d7b-2948-48cb-a2ca-7254f2ce1c84", "comment": "Malware payload (SnakeKeylogger)", "value": "8e48e372aa570d9b95968426abfd7df8d4ba1d6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716786, "uuid": "4d9c0ad2-b07b-4153-927a-3d3b93d79229", "comment": "Malware payload (SnakeKeylogger)", "value": "9a51a2183858e952e3545d1d8c8ed5f8a2698121cfeaea51c45e46251467e7fdbb9a8d003878824a0a96648202cfc7a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716786, "uuid": "9f6052a9-7b7a-49b3-a7fd-9e4850c8ea96", "value": "75B4230261ABDD3B163ABACC4B3D0B58D6DD344D3F75A4C831E7BE0D891A69132D8E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716786, "uuid": "5e37e441-5d78-4e9a-8026-365e84cd7902", "value": "12288:cmCZIViPB8B8IrvVihNN9TsCpUUe4LUSFDE+6XP:cmUw0apiBuCpde4LUmDE+6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716786, "uuid": "573a16d9-8030-462a-a4f4-c98d0b4299b8", "value": 519524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716786, "uuid": "9d9365fa-68f2-451e-b249-1d1ef8a5caea", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716786, "uuid": "4151c8ac-018d-4e9f-aff3-25a4f8bf3737", "value": "49a078d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af4dd80-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715477, "uuid": "b967f7f4-b87a-43c4-8e43-2078ab4f403b", "comment": "Malware payload (Formbook)", "value": "57b41fa4d01cfec21e6393820b424bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715477, "uuid": "b000ed1d-3742-4106-9f6f-0561cebc4918", "comment": "Malware payload (Formbook)", "value": "0cbd5a01e0352396f6e6f7a6162d901dedb50d1e7c80bb0ae88c411b6b0c1365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715477, "uuid": "3db8a29e-6295-49ff-a19c-aee00446d833", "comment": "Malware payload (Formbook)", "value": "08a2c750523fe591456d79ca37c1d84fa5800e29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715477, "uuid": "fe226610-dae2-437e-a9e8-c5f9ff0a39d3", "comment": "Malware payload (Formbook)", "value": "ee30d6f67758fc17bfecbd3be267525a0653df27946b387d3fcf15ef57eeb6111a692db0ffd1cb5b6e2884988c2e560c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715477, "uuid": "3a6e7818-45b3-42eb-8c1c-74b3131953e6", "value": "54156DDC7104A8E9D2071C7367CF8C11812425B9A53B9A0F5752673E5AABF133E3AACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715477, "uuid": "0b4e44a4-bef7-442b-a00e-c76c9b7a8512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715477, "uuid": "dc231f2a-b6da-4cf6-8d4d-fed43d12c0d9", "value": "12288:coLLoS60/K7yh0V9w1SUGFoFD7j4i1LIgZtBrgnunRAH3lLsAiSityjK:coLAPet1b3Bk0RVdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715477, "uuid": "5b4b089e-a242-410c-ab13-75443d41c18b", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715477, "uuid": "2c0ad05c-70ec-4bce-8366-84dbf2d3d3a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715477, "uuid": "7e8322c1-0abe-4e77-9916-f3b17c317996", "value": "Purchase Inquiry 11.05.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5fe2a6-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620752631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752631, "uuid": "162f7ac7-d84f-4ebb-8ef1-7236b48085ce", "comment": "Malware payload (Dridex)", "value": "4dd8ad9a86dd8915d96b8ce5145e4be8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752631, "uuid": "b2786bbd-ca5a-46cc-9f44-c17f55a0ed33", "comment": "Malware payload (Dridex)", "value": "0d970ea9316250bb31fddb3c33643806f6e785878a05344c90ed343f89359908", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752631, "uuid": "a14eaece-9303-4765-8840-2cfdaef047b6", "comment": "Malware payload (Dridex)", "value": "2c6d447b7cae19338c7bb97b5c3c8f105fa53de2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752631, "uuid": "9276859d-088b-4af2-a214-546a9dc817e4", "comment": "Malware payload (Dridex)", "value": "ea36b79f79a4925e456c7221500c67e478a708434afa76cb75ede5e68126ebd1e21b99c883d45e358d47cca854e37a2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752631, "uuid": "26606349-4062-4837-b6a6-9e2be2524bbd", "value": "C8F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752631, "uuid": "686ecad8-2fb1-4f64-be67-068c4fda31a6", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752631, "uuid": "11656b03-ee7b-4472-a6b1-6cdfd860a2ac", "value": "3072:cWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:c42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752631, "uuid": "58d06eec-bd09-4073-af90-628b86aeaf67", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752631, "uuid": "dd1032db-2cc6-408d-9291-ea30ecbc71f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752631, "uuid": "791b8d4d-d121-4b7e-82e0-269b9b4dc417", "value": "4dd8ad9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdacde55-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620717039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717039, "uuid": "424e5b8b-6082-42c0-8e4c-72c6ad7721de", "comment": "Malware payload (Formbook)", "value": "5f4725f701ced44640eaa5c979bc01a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717039, "uuid": "fa628784-b0d2-4425-980f-0eff4ac3b846", "comment": "Malware payload (Formbook)", "value": "0da69c7edc37d3b66c49f77a5aaca03f37732725108f7a7acec33eab349fcd7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717039, "uuid": "20838455-ed57-4e2c-944e-c4f4645307cc", "comment": "Malware payload (Formbook)", "value": "5330b95ba87c40296b16f8313ad552172c896237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717039, "uuid": "a988beea-7c45-4b92-aa6c-7a4d919c559a", "comment": "Malware payload (Formbook)", "value": "e175df3d705ddc65bdab2cb8e3c544a6aacdf23729e126e07015d8d8fa91e45ac8bd5d39c7d910924e374561344a42e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717039, "uuid": "a62ef05f-80b1-4de5-a74e-4f57b78db1c9", "value": "0405220A3BF4A7A0E5BE63B818B0290517B5F1465912EB4C7F4865EC1CE3FD686D07E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717039, "uuid": "2e021d66-d26f-4708-93bb-fcf80edbea8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717039, "uuid": "0cc2fb02-4666-435b-b841-81213361d612", "value": "12288:gEuyisQVKXeIDLY2BYF/UKGS3/B+9Gqbbykkp0/qTlxwDjBot6hwACSb04AD1jx:iK7DLY3mcBs9byLO/qhSPSt6hESOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717039, "uuid": "46721886-de4f-43f6-b281-25af121c1cec", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717039, "uuid": "fb88733c-85c5-4447-b480-65c21ac22ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717039, "uuid": "20691a38-a8c0-476f-890f-ea2d8efdaf88", "value": "5f4725f701ced44640eaa5c979bc01a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0502ccdc-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620727359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727359, "uuid": "9b0ead96-ab08-4309-8c67-7e88c6a751ae", "comment": "Malware payload (Dridex)", "value": "00300a3b82b50c253829c9578f41f744", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727359, "uuid": "dd8120ca-4feb-4b88-992c-8f21510b2d86", "comment": "Malware payload (Dridex)", "value": "0ebae81ff270895e421562f88558d3789b8a924e1a44c4b1e69f7360645bb2f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727359, "uuid": "129cc2a9-849c-421a-8585-6bcc016e86ad", "comment": "Malware payload (Dridex)", "value": "b4d8a0e04647f9f3d929aca6a25c045ff758ee03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727359, "uuid": "397bbc85-df54-4638-a05a-2c4e1e24733f", "comment": "Malware payload (Dridex)", "value": "00c71def34e3c54cf27ffb162fb6e0b3a640648ec5a42f7f45e41dac26b2408602f745690d640ef50eef19ba19e7013c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727359, "uuid": "790dfa05-47d6-4593-a1ee-874539a49384", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727359, "uuid": "d5f23433-20b2-44df-8df0-fae0802ed6e8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727359, "uuid": "5224d0c6-0e06-47bc-b9de-cc103ba99a57", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727359, "uuid": "d61f1acf-4c5c-43f2-afda-28a1e2ff0699", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727359, "uuid": "1e73c129-f6d1-434b-bab6-24240d70317b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727359, "uuid": "bbc001a3-2f1b-47ed-8e00-580605a0d196", "value": "00300a3b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932fe8bc-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770547, "uuid": "7de7cb18-1df0-4c3a-8bdb-c1069cc308cc", "comment": "Malware payload", "value": "ff26cf6f9f834bdf577d40e21a4a5202", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770547, "uuid": "4db22a55-7804-4f16-8f58-52e5097befbf", "comment": "Malware payload", "value": "0f2fb73f34a23f922159a84ead1429375d9deb176e8e2fd2b70c741e18e38c3d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770547, "uuid": "928b6e2e-ca15-4490-8de4-6f5ad4afe8a1", "comment": "Malware payload", "value": "97120d37e00c79a5877b54326df1edfca4f333e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770547, "uuid": "450bff01-f8e6-472f-bde5-add9c97da750", "comment": "Malware payload", "value": "117e32b7a4dbd6cd9cd18dcfddcd25b4477043f4011a2f30149e8ba4e1af1d75fddb31bcd3ada57c5d492d1199d7a5ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770547, "uuid": "232b0b7f-0fb7-4e75-a783-0b25e7152d2c", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770547, "uuid": "630b0df6-18b2-4b3a-8991-3d9e5f90b849", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770547, "uuid": "47165b4e-41f3-49a1-ba1d-ae5152ab5184", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770547, "uuid": "23ec8923-2d31-4ca9-9445-99eec6e2acc1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770547, "uuid": "662a5187-5e09-4e9d-aa06-736efe960573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770547, "uuid": "804bfc85-751e-49a6-9e00-26d8bf6a3629", "value": "ff26cf6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9422f3da-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705695, "uuid": "ee7af6a1-c12c-44ad-a812-436d20224529", "comment": "Malware payload (Dridex)", "value": "f937ecaaa9a59034891b6639988fd595", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705695, "uuid": "a7d25ba1-49ee-4ae6-a384-e0f8d7134fb5", "comment": "Malware payload (Dridex)", "value": "0f79110c842a93aba8c947509b1635b2219c2515761c427c75eb292e0ccd4d09", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705695, "uuid": "28e9b22d-63a3-44e7-bfe6-1900ac705957", "comment": "Malware payload (Dridex)", "value": "f38ccf3a26afc43462519a6bfe55985ec96168a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705695, "uuid": "ad736833-26ba-435a-b88f-c93f178aa1e6", "comment": "Malware payload (Dridex)", "value": "30ac5d0bfc5f08347d56b3ba4b0b6deca839ad1b37193d4fecb82035ffdee88c4c11cd79ee912b529276efbbaa0aaca3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705695, "uuid": "58cf3cb6-9d1f-46ea-a1c5-5b7f28e06267", "value": "3FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705695, "uuid": "472ae023-6f10-48cb-9beb-903c5cf43d45", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705695, "uuid": "07f69ace-54ee-4c65-a455-d1f8dc2c9ae2", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705695, "uuid": "4ce9bd4c-12a2-4fca-8d84-d3b27d14ab93", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705695, "uuid": "10734f8d-60f2-413e-90fe-0fb264842ad1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705695, "uuid": "6c8706a9-97dc-42b4-9f51-16a20379eb76", "value": "f937ecaa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30bbd48-b269-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620745341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745341, "uuid": "8985f9c9-11a3-43d2-8db6-699e784890f2", "comment": "Malware payload (Dridex)", "value": "06e8764516c4368a3bacdbdca35ad361", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745341, "uuid": "1ac25ee9-5dfb-4a3b-a273-3266135e59eb", "comment": "Malware payload (Dridex)", "value": "0fe2c6787e58efce9f90f27f9aa9c89e46d95d057044c9884b293ae04fd69d83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745341, "uuid": "54972bca-d910-44c2-9501-4e50a4c715f0", "comment": "Malware payload (Dridex)", "value": "165f9ffd5b04d113b641710ce1f9f9244728027e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745341, "uuid": "10e7ecb4-4f94-42b5-858c-1021135515f0", "comment": "Malware payload (Dridex)", "value": "ac95965a595e37b07bd82bb72bdfd2ff415abcd5502d44b32eb767960b4ac7261205308e6b389d419d8c4a4238c19e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745341, "uuid": "617d91da-cbd0-4a51-873d-82ad901fa714", "value": "F8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745341, "uuid": "2ce511ba-41e3-446d-baa4-d2f7ed99e6f6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745341, "uuid": "7adbe4b3-e320-4138-9282-f6008c110199", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745341, "uuid": "31750d5a-cfa7-40fd-b383-8e1c5b98bf2a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745341, "uuid": "651c20b1-daad-4d13-8c41-5290cd7ff45e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745341, "uuid": "3db5ad7f-ca3b-4699-8cfd-1ecfd15654f4", "value": "06e87645_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e852da-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709270, "uuid": "cebbdb4b-1d7c-422d-91f8-ce34ba139537", "comment": "Malware payload (Dridex)", "value": "ab807d2a90e2fb4b125c9f533d358b2b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709270, "uuid": "aca81275-e9cb-4f19-8b72-209c5b2ef4f8", "comment": "Malware payload (Dridex)", "value": "0fed1b21546ce224789d3b2ac0ea8f7afa33e399cf37edcf62b65ac4d92cd7e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709270, "uuid": "e24975b2-316e-4634-b681-82960176a948", "comment": "Malware payload (Dridex)", "value": "3dee511758517b9ca81682db50fd3594d2e8c47f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709270, "uuid": "88ce99f4-4288-4429-8364-46263e7dabf5", "comment": "Malware payload (Dridex)", "value": "04fec9d1738216453877535423462fae7318e57ad4fd0d0540dca7464f524155d12b4aee88eb2b676169c86f34c62032", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709270, "uuid": "5a19bad6-c841-468b-ad4b-6aa04c6b4a85", "value": "16F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709270, "uuid": "22a0a95f-d9ba-48a7-ab05-bcf60b0db645", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709270, "uuid": "9a96a8a0-6ae8-41af-9cd9-7eef45549f0f", "value": "3072:eIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Hc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709270, "uuid": "eb5c4c09-4b41-4f68-b000-15b84b1e3b2e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709270, "uuid": "aa4a2b8c-db30-4148-9087-3e1652dae0e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709270, "uuid": "1e7993d6-7ddf-46a9-9d89-9e17942412c4", "value": "ab807d2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867f2250-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Avaddon)", "timestamp": 1620715980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715980, "uuid": "651d69cb-659b-48eb-a7a3-f7d9f3b6c233", "comment": "Malware payload (Avaddon)", "value": "2d2a5a22bc983829cfb4627a271fbd4e", "object_relation": "md5", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715980, "uuid": "c3904114-f9cf-4b2a-a939-d92af885de86", "comment": "Malware payload (Avaddon)", "value": "0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b", "object_relation": "sha256", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715980, "uuid": "5826d20e-9633-487f-8f7a-2d50b3f7abb5", "comment": "Malware payload (Avaddon)", "value": "c0fc01350ae774f3817d71710d9a6e9adaba441f", "object_relation": "sha1", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715980, "uuid": "21673aad-5fca-49be-bbf6-13c782a66f6f", "comment": "Malware payload (Avaddon)", "value": "9cb04d7291a0af9d63b486dcbbc3f91c46c9b8099bb94c2ad9514afa443107faf7015de4e225a580de25070f6f2d1ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715980, "uuid": "1eded033-ca95-4b83-8cad-8bb82fc4cdf0", "value": "6AF48E223A43C43BD97601768E5CBBB540BFA8304B261ECB67C87F5E4A205D25E31A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715980, "uuid": "bd8b7a7a-818f-4728-b49c-111b71006958", "value": "b56503b8c4f46a3a086734c09c6bd0f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715980, "uuid": "43dd899a-c8a2-4fa4-b9fd-2c93119c00b4", "value": "24576:+Csq9+OXLpMePfI8TgmBTCDqEbOpPtpFaoxfq:YxOXLpMePfzVTCD7gPtLa4fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715980, "uuid": "7845ce3b-6be5-4d07-81b3-3fa805fbd26b", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715980, "uuid": "38c94541-56c0-409e-8b79-c2075bdccaa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715980, "uuid": "c47b31d9-56a7-4017-a290-f2ab7d7fcf97", "value": "0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cccdfd5-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728849, "uuid": "87fb5b05-e5b3-484a-b083-196e7cb9efa6", "comment": "Malware payload (AgentTesla)", "value": "4212c79d57ff6347883dbc23d4f3846d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728849, "uuid": "7b901d5d-be13-46df-b5d4-5eabe2b090b5", "comment": "Malware payload (AgentTesla)", "value": "113c1364bffb0f75376c6728d53bc47304fd8f8077dc0765f1b924f04d5456e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728849, "uuid": "3e2d9ef7-8d6f-409e-8945-b04a6428f272", "comment": "Malware payload (AgentTesla)", "value": "17cc7ba6332e18a8572a82ab4bc1e039d791d308", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728849, "uuid": "5eb980d3-9b41-4e82-b347-701d8fbeb4cb", "comment": "Malware payload (AgentTesla)", "value": "913482167e7e3c9fba47976b51f870e397d7ac0d23806535ec33d5f75e97a0589f9488d01eca0aee4d85963595f661eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728849, "uuid": "15fdbf30-f63c-4cbb-8043-cb968a6030f0", "value": "BFD4EF21279CABA1F17E9776C031050453F6F61BD736DE9CBEAD40DD5C22F8186A2B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728849, "uuid": "08c4eb55-6af2-49f9-8434-47af9ac17416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728849, "uuid": "151dc25c-9b6b-4e9f-9710-913bbef0bf40", "value": "12288:BgcqHwK8BXpCfDG5iQzBFJsHzeKsom5yZdhSi33QPjxo+Z62:vxhpCfDGcQ1FGHSKso5GXi+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728849, "uuid": "d6fda684-d57b-40bb-8563-b654e718c375", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728849, "uuid": "7126fe82-fadd-4378-a53c-4372d2d7359c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728849, "uuid": "01514630-5a9a-4108-af46-2a40824708fb", "value": "8DL3LHg4SB6Q7z2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5ff763-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729438, "uuid": "404033e9-6c47-4e65-beb7-c12a9b351661", "comment": "Malware payload (AgentTesla)", "value": "8eb7c6ab99d209a1f57014f438e17581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729438, "uuid": "0a3877de-3bfe-43bb-8b9e-af97468dfb45", "comment": "Malware payload (AgentTesla)", "value": "11651b354e8f6611ab8aa9fc86ec94bfd0112cdfe8ebb4bbb2d8a6119a003ec5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729438, "uuid": "c06534e6-3707-443c-ac2b-7e161dcb19d2", "comment": "Malware payload (AgentTesla)", "value": "e22da9380a096eccd01d91d0e9630d21a92f9c62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729438, "uuid": "85677de6-8157-4579-adb3-f07cd91ee449", "comment": "Malware payload (AgentTesla)", "value": "fa195431af9e6459799fb994f0e38328e582ce91f3bb734e43b0d8ea4d3f2a29ccdcc9e9034b4da476b156b0ea2b856b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729438, "uuid": "a824b42c-30e9-491f-8938-fc0371a6efcc", "value": "FF15013237685FD2E27EEB3E4850104443FAA81AF321E69D7DE605ED4869F414BA3F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729438, "uuid": "539710c3-9015-4214-8c9e-33b7672ac2b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729438, "uuid": "ba5be632-7ef4-42f0-9ab8-9f729fc0597d", "value": "24576:aaVtsjeaGCcUWmILP6sIBWoY8igHYScNX:aGa7jWmkP6sIB45dSAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729438, "uuid": "f39a1b64-2b99-4f16-98eb-6948b03882a3", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729438, "uuid": "0950e19e-d96c-4e02-8faf-179428905243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729438, "uuid": "8c2167a5-ff8c-4659-9318-028d09c141b5", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbf414b-b25c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620739668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739668, "uuid": "0e34e98c-0589-4516-be8b-5bd155baf34b", "comment": "Malware payload (Formbook)", "value": "8779286a2458c5d46a9ce7322923771b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739668, "uuid": "da8b7e23-0832-4ef6-9eba-8b2c8b0ee089", "comment": "Malware payload (Formbook)", "value": "11cb9937a480ec8467c15fc73cd7eacd7e80c8c3bffb1c9dc72b9f0a5b64abd6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739668, "uuid": "60ab6001-a1d4-4051-ab49-af31208c83a4", "comment": "Malware payload (Formbook)", "value": "bfaa4064c8b52df26d4722ffd52f1428af136702", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739668, "uuid": "2bcd47c4-8913-44db-b408-80d71810d474", "comment": "Malware payload (Formbook)", "value": "2a5a8682f0e18c0fd2849ea4b2570510b3d4b466c38d9a2c8c21cea9a486dd87f448119f634e49b295d1a937c84e7fcd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739668, "uuid": "ce8352c3-2323-40cf-9777-73b0c48a8331", "value": "BE9533A6C8DA1F99E2FEF4F250DE4E1D5A2ECD9A3F138937712C7078A0335705A95428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739668, "uuid": "34220734-f64d-4f7f-bd1a-baab715da5ef", "value": "49152:HEX+XszNtcpDjE3pD0EpTh6OqaxS0tGh6Q/8Hm:HEufEpNVS2PQ/8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620739668, "uuid": "745dbd68-93e6-408b-abbc-9bc358d706bb", "value": 2008392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620739668, "uuid": "f22bcf28-a3f8-44b9-9405-a6a977ba9e57", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739668, "uuid": "7b15cf92-900a-45e8-a196-3b3164ff1d0f", "value": "Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d4fca7-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717128, "uuid": "fb5ecbc0-ca9a-4af6-a6b7-857ec3556f32", "comment": "Malware payload", "value": "fa2cb0991ac0fb9b2271c41fd7847d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717128, "uuid": "3e26f261-ac65-4639-a1c0-5308310d9a78", "comment": "Malware payload", "value": "12436f9b057e4bacdd77a13dfe83c31dbb0bf0a9902e8cdc1bab53363b95be54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717128, "uuid": "34417a8b-7411-4f2b-9eb6-0c5f08b7a34c", "comment": "Malware payload", "value": "b57eed49e5ff3a52f343c417ce45d319691422ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717128, "uuid": "5625010b-60e8-4808-b931-a414ee9af02d", "comment": "Malware payload", "value": "bcfa7b989a711441293d5e280f9a7da264ab8f93fbb0f1c5cc600a771daab41621a3426a1857ec45dafa33e0b5a25934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717128, "uuid": "d3cfc322-e5f3-41a8-87e7-8bde498d07fa", "value": "18B24B1952D4B019C49306B3BE72D8603B78F7B16845E10DE4E0520DDF52AB9A4EDBDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717128, "uuid": "8eaedbf3-fe19-4804-8538-74dcd03d3f54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717128, "uuid": "4cc4f576-6e30-48a8-bc6e-3b019e204303", "value": "384:YpVY4+ct/631V52G3NXqbCkx2JT1te5+w5Ntd51kfligKZSCNF8JLN5XnOICs:4VWcgFzzxTDeEwVhkf7CNF8JP+Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717128, "uuid": "c8cfdc44-1814-40e7-81b5-2e5bfeccd64f", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717128, "uuid": "e74523c2-dadf-4992-980f-34a1423dbaaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717128, "uuid": "8dd337b1-c8c7-43cb-94d7-c2efa3833a8a", "value": "fa2cb0991ac0fb9b2271c41fd7847d03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454f60ff-b23a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620724890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724890, "uuid": "74a2e6e5-1c4b-4d1e-8719-53d340872538", "comment": "Malware payload (AgentTesla)", "value": "a38866790c8c35700168dcbf70c451a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724890, "uuid": "e5d30acd-5c83-4ce5-9bfa-63065b55c9ef", "comment": "Malware payload (AgentTesla)", "value": "1252078421caf8c3415891ca9012a285c509a1b952b56cc84d163000155def0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724890, "uuid": "29e431b1-9079-4877-96fd-a6026e1d6505", "comment": "Malware payload (AgentTesla)", "value": "1c465c58bafc50427e4facab66bbbbc576dfee0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724890, "uuid": "1bb49860-de46-4a38-85d6-9fb2aa41902c", "comment": "Malware payload (AgentTesla)", "value": "7bc4219ead4701033b24af9d1fa87d936212a33777b0f21a5b953ca7011a634ae8091a4699b1afe213cae434ca926eaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724890, "uuid": "57fe77e2-6af9-4984-8620-748868d06384", "value": "D6E4BE1C26A48B45D5FEA6BCD870D3104AF57B06D417EF5E7AA030EC2CF7312EA1295A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724890, "uuid": "818d44de-a767-4a1c-a1dd-d55d189a8ea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724890, "uuid": "d11fa743-766d-419f-94e9-ef9ca126be7b", "value": "12288:J5RnOipP7SP51eR6vhSV5lXXO8zAxrQ0ZITvK:xxWBkRtC8zAxBoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724890, "uuid": "c020ebd3-5abc-4649-bf0d-238630ce32d6", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724890, "uuid": "ec83132c-f2b3-4c82-adb0-fdd5ed7aacf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724890, "uuid": "1642bc1a-52d6-41d2-9e04-b088f0bc66f6", "value": "Product Range #2828915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43a02af-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620712728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712728, "uuid": "55a0072a-cb7c-4ea6-a86c-2660c4ade9c4", "comment": "Malware payload (SnakeKeylogger)", "value": "68796e7c477abed051de013cc3835e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712728, "uuid": "a87cbe49-5f59-46b0-83b4-d7b46def294d", "comment": "Malware payload (SnakeKeylogger)", "value": "12e9811c0f147a84152e2f39b93f0113ada404ba385277ca067ee028e7105c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712728, "uuid": "e24392aa-0939-4c8f-bce5-7df821fa6929", "comment": "Malware payload (SnakeKeylogger)", "value": "edc4e4afd09f12d78d8555990ccc76652a04145b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712728, "uuid": "ad8ea626-662f-44f4-bb3b-3929bb4196e6", "comment": "Malware payload (SnakeKeylogger)", "value": "20bac5ee21fa9dbdfb2ba95752b2498ec1981eae825a0cc859e3ad50aabf30ab11cbac3e433b7523b8c94bbef68db549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712728, "uuid": "1d8ca96a-a06b-43ee-8190-1fadc2643a53", "value": "37F4230327D8EA25D1FD1BB5A4113A0043F4F61AC162E79A5F9562ED90A37CBCB827D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712728, "uuid": "48586377-78eb-40fb-aa21-2828dc5d00b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712728, "uuid": "f9e2e10d-b8f1-4078-a419-c761caea22f3", "value": "12288:SE4yiIQF+nIDG/AtfyWmj24iOp2/lpAeYXtN1qxGaIZygKeFS8VzZ6TeK:dbWmjxRpAceYXL4FIZEe48VieK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712728, "uuid": "c23cf058-a3a6-4c6d-a8e2-d5a6b2af33f7", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712728, "uuid": "6194df9b-59cb-49f8-b4ee-1bdeef926b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712728, "uuid": "ba8b00a1-99ac-44a0-9065-b14b0b8d3fa5", "value": "q3qhElKDnGNNjTi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b90e026-b218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620710378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710378, "uuid": "9c6d7ebd-0f9c-4a4b-ba64-cc4ec1ffcd5f", "comment": "Malware payload (Formbook)", "value": "25f5d6b3860fa7eea0eaa6c1db7510b5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710378, "uuid": "0cdfbe40-8748-4860-9e71-471bf32cbf69", "comment": "Malware payload (Formbook)", "value": "131f71a5bffcef74526453ca575430216420e912f1b94ee0ac2c1c45e8209bd3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710378, "uuid": "b0167ba7-3359-4290-ad0d-d2fc2b09b21f", "comment": "Malware payload (Formbook)", "value": "cdfa4395f7169f7852782b7776ee133e2ed11daa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710378, "uuid": "7960d20f-bd5a-4c34-ae1a-f0fae2b74c2a", "comment": "Malware payload (Formbook)", "value": "b8e87b411e422888bc9c6d2f195437064d73553742276a2b9374ea185466f6433df84e083c732bb268f39c07e76d1e47", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710378, "uuid": "88fdf472-c3c6-42f1-b255-ebb9fab6f4ff", "value": "C8553396ECD80F22F5AEA7BA5D5AC8B4109EDE524205C9BFB30C37F57471A71084632E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710378, "uuid": "ac6cf393-3445-49e5-b669-8fd260b2f6e6", "value": "24576:mmJqmANGIHYZvRomxvTkhmDzsCLrIDatxEbq3UcQr6tbL9Aoa:mkqm/I41aovggzsCLry4xEkU9r6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620710378, "uuid": "686d6f86-9177-428b-9d81-8fce88090d8f", "value": 1340928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620710378, "uuid": "11ba3cfc-8d6c-481d-8ff0-eecea234884b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710378, "uuid": "d695f7fe-7ab1-4020-bb81-8af1461942ae", "value": "PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65e999e-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705726, "uuid": "4c7f3ac8-297a-4e31-bbc3-6d3ff9e1b73f", "comment": "Malware payload (Dridex)", "value": "583969d5972554a89aeb04027672eac7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705726, "uuid": "8cb9ed31-c94a-44d6-af33-f6d96b04fd0b", "comment": "Malware payload (Dridex)", "value": "153bc63de3c452a0ea3c16706d1326c5c863bb365668cd4e6f332a96b0a641c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705726, "uuid": "71930789-c308-4ba8-af9b-58f0b0eafb53", "comment": "Malware payload (Dridex)", "value": "877ef4727d496439883514427b9ce28a43497071", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705726, "uuid": "a61afeec-7508-4f3c-aec5-751250fa8ed8", "comment": "Malware payload (Dridex)", "value": "7d0e650d8fd146c0967cd45fdff45e0867dac3e44cedac68251f51e843a9d5c79c242199ae54b881ccf0daa256babbea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705726, "uuid": "0528d659-f3af-42dd-901e-13354ed86577", "value": "DDF3D0906A9BDF0ED9C13CF96A96A879B173458D811FDAB4D0CE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705726, "uuid": "ddfa7049-63c0-4661-9fc1-c8d98759b26e", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705726, "uuid": "eee6f710-d891-495e-b366-bd47ad6e1393", "value": "3072:nesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLpM:L4+VZQpt5hyPsa1ekiEKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705726, "uuid": "97ffa9c3-c049-4965-9928-f7aa73918236", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705726, "uuid": "fc26f738-1952-4fc3-ac42-d8093508cb8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705726, "uuid": "d9adc43f-c749-4fcc-98ec-83ec7b513913", "value": "583969d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bc3055-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709290, "uuid": "b73944bc-9529-4a82-bca9-e03c3cef95d2", "comment": "Malware payload (Dridex)", "value": "666570a3356acede74d2958112945ddf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709290, "uuid": "fcdd1fac-222f-4d74-a77e-4a7a96f02907", "comment": "Malware payload (Dridex)", "value": "15b5a8f390968729db5d5ccbd8b6f88db1c13dd7a72b5142bce36bf74de608bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709290, "uuid": "f0256837-211b-4d61-9437-2b7ad9ec34be", "comment": "Malware payload (Dridex)", "value": "1a832edc5a04897dc2ef6c186b914119e907f216", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709290, "uuid": "a8920bfe-316c-46c5-af59-4b31b7c09b01", "comment": "Malware payload (Dridex)", "value": "249681f1594f70e18a5d1f68cb2ce538d9004951e6a49ef71ece34125904c8b89d176148aeb316830be3c0bf6560d70a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709290, "uuid": "5673c3fd-8caf-41ad-8c0d-d3be92c14990", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709290, "uuid": "c172d377-9eac-4f29-a6a2-4496a0799429", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709290, "uuid": "82f2ebac-b54d-4ccf-a16e-e44cc49a823e", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709290, "uuid": "d453d2de-483b-4f6b-92c2-9f5845f9cf95", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709290, "uuid": "797df737-913f-46df-9df2-1ddac885f158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709290, "uuid": "e1ad7f34-808d-43fb-8c8e-5335f7498522", "value": "666570a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8551edf-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620715178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715178, "uuid": "50ac5501-d20c-4177-95ac-fbd024461ea2", "comment": "Malware payload (SnakeKeylogger)", "value": "77cd39074e5ddd4568443652971bbc2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715178, "uuid": "7c6b6d5f-bb3c-4df3-986e-8941e9a90626", "comment": "Malware payload (SnakeKeylogger)", "value": "15cf93a3ea31f933d7d11be347db05e0286c1993288fe62a54be8db6df290f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715178, "uuid": "bcff22d4-9d14-4c3d-b16a-b157c96e5b08", "comment": "Malware payload (SnakeKeylogger)", "value": "046b789f751215c6ab0d5da88dd54607ee806b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715178, "uuid": "b6e4ff40-3d1f-4fa3-8768-2b53dfbad9b4", "comment": "Malware payload (SnakeKeylogger)", "value": "4d25106868190e974162df7e75a115a608d85a251af58bbf7a93ae0871d08f5fe68a1cb7a98feacb9c33361ec41fa96d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715178, "uuid": "a0215b87-adf8-47f6-b5bf-01989cc699c6", "value": "1D05234337D4AA14D0FE1BFB9071260417B4A10A9226EB4D3E8859FDDAF36D9C346BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715178, "uuid": "d156b8e2-8617-4c1e-bf49-b5493ebecf89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715178, "uuid": "89611072-0755-42ce-b8ac-e99216d7f2d7", "value": "12288:pEEyiaQhi4EeOpLSuNUkhPqSlOmD6RVC04nqloClWFnjDcNaYqzwTGNDsfkP:+4EeOBRUAPqSll6rCxnqQFjCnqe5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715178, "uuid": "a965a590-8683-4676-a831-f39022a5b25e", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715178, "uuid": "d62f9454-ff5c-4119-ba36-e9d4f79446ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715178, "uuid": "8deb9afe-c841-4096-b3e6-e5bc1f585b5a", "value": "DOCUMENTS AND CERTIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38037f12-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702104, "uuid": "0ca49488-a466-4ee6-be77-b838f025544f", "comment": "Malware payload (Dridex)", "value": "12cddbfe60122e148882c47ba1bd2fff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702104, "uuid": "5b38bf21-cd5e-4f26-bfc0-b7b8fd82a684", "comment": "Malware payload (Dridex)", "value": "168d8c49b4d4d3f96fe643babf23b8502a61015d540eafaac53c21d9815f40ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702104, "uuid": "b8ee0b51-ea93-4b1f-9f4b-24d17c4f1f4a", "comment": "Malware payload (Dridex)", "value": "edf909ce3a16db43d2d35450eec944ad0366c919", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702104, "uuid": "9ec45e61-16c2-4221-afb7-14adb8d9c34b", "comment": "Malware payload (Dridex)", "value": "4d909646fe1f84d3ff8428aebe6685d48df17778d20e013d841e9f4325da9052a2a2132513c6ad56c8b09bf9ba2df235", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702104, "uuid": "7cb17137-24ba-4be1-a362-6a04ddcf05fd", "value": "0CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702104, "uuid": "95217308-d1b0-4d86-bad1-b100b73273aa", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702104, "uuid": "b33c26ff-0162-4b2b-aa90-2002641a5e4b", "value": "3072:bA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:b3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702104, "uuid": "89592055-df37-47a0-acc0-e81587713a1f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702104, "uuid": "07b31483-10cc-4612-b899-090856363ef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702104, "uuid": "ede20624-64a4-4f3a-a694-2d6283affd7a", "value": "12cddbfe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7e6091-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698512, "uuid": "a36db09f-9e31-45b7-8d0d-bab74979d41b", "comment": "Malware payload (Dridex)", "value": "392e7935b9cac4f6b0c93531b8c6ba53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698512, "uuid": "d9912d0b-d446-4bca-b3ea-6f5ea3923c54", "comment": "Malware payload (Dridex)", "value": "176eed77a7cac3cefb5030ffc91a7f88c254825692960e3e7403ea17ecc2c38a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698512, "uuid": "069cb642-e464-4af6-9918-041f2d0f224b", "comment": "Malware payload (Dridex)", "value": "75c6b2b68a6ffa58441baa5da0d2684b1615880e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698512, "uuid": "d13757f1-c4ed-4c00-b784-c645d0789e8b", "comment": "Malware payload (Dridex)", "value": "10ad7f46162cdfbc6630534610fc2d382f70bd860f0b6deb7d859cd64bc6a10eea01e316a8dfdcdb1e2ff42308653b34", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698512, "uuid": "49a65d65-b282-4b83-86cc-20dbdb74cbd2", "value": "E1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698512, "uuid": "284e8bdf-3107-4720-b6f1-035f6b183ac6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698512, "uuid": "5fd3fb21-835d-40f1-a716-7b5e139a7fc0", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698512, "uuid": "130a272e-67f9-4e16-ac2c-0548beb6aa81", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698512, "uuid": "41fd34fa-aae4-4dc3-8c36-9558fd5f0263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698512, "uuid": "88c65384-7dfd-400f-8925-5c2528a0dd80", "value": "392e7935_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c05966-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620752541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752541, "uuid": "8f4e8ab1-8084-4d55-bacc-0c1ee1e93742", "comment": "Malware payload", "value": "19f0a8647da6f19021f3572f4b3a016e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752541, "uuid": "84604be0-32f8-42b7-8f53-2755f427d216", "comment": "Malware payload", "value": "17a31c84eff5238b6a6bb8b9efd19aad69f8f5256155636bffae792411aea657", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752541, "uuid": "7b8e47c4-6537-4ebd-ab8f-4880119725d9", "comment": "Malware payload", "value": "c1f331b4be4e375b665a208bc58f3bdc99185ee5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752541, "uuid": "5485eae0-db45-4d6d-a62b-98f174e2e9e9", "comment": "Malware payload", "value": "dea41cfdeed76831e323d4fd184007e78bc48ebdf409dd2fbe07270374cd7235821c424c73ecb54f33e31231c59d1e2a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752541, "uuid": "e14912b2-f611-4cbd-a77f-4783c8c270f0", "value": "0B85C98112C90AEDF54D4FC188DF534725F3A019B5E10668DAB766FB3C6BD891A30E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752541, "uuid": "43f5828b-654a-4e21-a1b8-c7ac881394cf", "value": "6144:cZV4inZzD+OZZxxEaSZmJiTe93AwlKy/TqaPMAyQq6QkbrC09xe+LffN7MqKcHHB:qpDfHDGJw8aPFyQNQCJHeEnC3TEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752541, "uuid": "8c10115c-5844-4c21-aa8d-9ca4f6fd876a", "value": 1864892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752541, "uuid": "dcaeaab1-d400-4cf1-bd83-0eec100e4716", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752541, "uuid": "899bca72-2b99-4364-a6cb-328de14d6d16", "value": "Attachment_11297.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0718496-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712641, "uuid": "755f1253-c5fe-489e-afde-73dc01950fce", "comment": "Malware payload (AgentTesla)", "value": "547cbdf762cc722c1229355355a4c297", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712641, "uuid": "8e5f1753-f9b4-4264-8cf2-1b82e825e0f3", "comment": "Malware payload (AgentTesla)", "value": "17e25c1fbc33bbd475b94bd2e9136525d73788c3909e3f5564596f30b95bdbd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712641, "uuid": "ca6c90c9-6dbf-487d-95e0-55880cb475cd", "comment": "Malware payload (AgentTesla)", "value": "de955d88c883ba2881875837316fdce527dd6157", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712641, "uuid": "262675d5-40d4-4b60-8428-040b5804da6e", "comment": "Malware payload (AgentTesla)", "value": "2a2bd0d6c22c942d48c0b9a716ed19fae7c5ea03ad7559685b60224884830f96ac333c0e5ad39f6b7c447d420a4b532c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712641, "uuid": "44a3bece-d557-4860-ab28-f2ac5f659b1c", "value": "C0B423531CB381525E483630313226A18F6B4F1795E5BA697A2DB1FEC6C7E8BC54FE02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712641, "uuid": "8ac854bc-9bcf-40cf-a4ba-80a2fe1b42ee", "value": "12288:C8bQjvKPAwUBlFk2LNiHRYeIlyCci4GtBwh4i9DNKvUEwPRJ0KpAIMY:YGNaC2xSRYegyCcVGYbNcUEqnFCIMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712641, "uuid": "4fe54235-bb3d-4df4-83bf-971c915ed8ca", "value": 538851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712641, "uuid": "b4d99579-3515-4ffa-9368-5dd936b7de23", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712641, "uuid": "8acca74b-85d5-4d03-9468-ab278ba96fa0", "value": "Maersk SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d5f92e-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1620717189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717189, "uuid": "111553d1-7175-4930-beee-5ad4d79df92d", "comment": "Malware payload (CobaltStrike)", "value": "01fbd69aa44b75f2948a817f340d599b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717189, "uuid": "0b17e17d-a921-496a-9d45-d22f22e80948", "comment": "Malware payload (CobaltStrike)", "value": "18b056a1951f2e7c4ab96095d25e015da4e456493d0591c94584a9063c399025", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717189, "uuid": "74acc497-1828-492a-b20f-ba7922a0561e", "comment": "Malware payload (CobaltStrike)", "value": "e537f77672e7a0f6ec8fd3063524bf29e42867e2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717189, "uuid": "9209cb5b-7383-4e93-b4a6-3fd20fb4a8d9", "comment": "Malware payload (CobaltStrike)", "value": "f174c4a0eff7d3947b611144799f5f7b5ecd0628a090e913236c2bf7f5e8c09d10fe7b1bf0c6a47b65f1b70042eb63a0", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717189, "uuid": "15fbce7f-aec8-4321-b736-6625e62e6b63", "value": "37A4F15B73A2B0F8F16A8175C8D21606E7B2B83127619B9F13A417262F376D18D3E770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717189, "uuid": "90b82ed3-d947-4d2e-b377-97155e96d699", "value": "e65a95c59aa483750033184c186e4f9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717189, "uuid": "3f5390a1-708d-4a21-9df6-4408e32688b3", "value": "6144:oQoY7z0MVihidNhYkQRKUJTB4a4svREAHGz8xA4XgPwhparyyb49tTFDbEA38i7:kY7xYidNhYjwvsRHo8xnXQ2B28FvEzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717189, "uuid": "0fcddb3e-2450-4209-adfc-0d1ffcba9895", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717189, "uuid": "8c955c5e-2d3c-47eb-b424-391ebb404814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717189, "uuid": "99aa5063-babf-40fe-942f-faddc9fb2815", "value": "01fbd69aa44b75f2948a817f340d599b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23af7dbf-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620711949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711949, "uuid": "d309d421-7b07-4d48-b4c6-bc86c1338fc9", "comment": "Malware payload (AgentTesla)", "value": "9c6ce741d5fbc5bc964665b701f0d907", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711949, "uuid": "94120291-6d89-4718-91d5-7156d152d2dd", "comment": "Malware payload (AgentTesla)", "value": "18e405748042315362386a7b818630e2c03e995db51cf2351ba70f16adcb7340", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711949, "uuid": "a8cdd7e2-0b67-4f6a-9237-1c19e66aceb9", "comment": "Malware payload (AgentTesla)", "value": "138119bee486b409c85957b55a8884ec836e2b23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711949, "uuid": "1217ffe4-0f30-4c63-8d66-7538b5dca299", "comment": "Malware payload (AgentTesla)", "value": "5bfc5ef2f5971211bcbe94b92f625fc3d4faeb6564320d6d83298f505a00af21f0725935007f19176bbce6075ebbbe85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711949, "uuid": "f38b28eb-d96c-4847-85d7-1e472c5c32b8", "value": "6BB4235016C2322E4D411FCA64E0E445ED1F29DA6827F80AA5A28FCD2135BF5E1F6FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711949, "uuid": "25ffd315-f994-46fe-82e9-d7d807d4e824", "value": "12288:Py59XO5kcHAu7oJBpIeOOFM4mOFg8TIqo6uvMljQ4:P69XKTHPkJEeFMUTtgOU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620711949, "uuid": "cbfd6b4b-4d51-4fb1-a4fc-35effd4bb085", "value": 495791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620711949, "uuid": "7f992252-1785-4431-bb7f-2065920d3b1a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711949, "uuid": "5e38b253-6870-4a7f-9d17-deedb5b49c35", "value": "numero de referencia de los documentos de envio..gz....pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccd42bd-b250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620734647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734647, "uuid": "403bf62c-7624-4b30-8960-1e621c5d1b4e", "comment": "Malware payload (Dridex)", "value": "bd3139556943f62299b7d880e01fbda2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734647, "uuid": "db0c4573-2e32-42f4-ad73-cc3c1c5e8ceb", "comment": "Malware payload (Dridex)", "value": "18ebf41311a7d7263a0f23bb85177952ca8d88ec3cc5e4f14a645ca070d3cf4f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734647, "uuid": "29c13494-c33c-492a-aeeb-c1f130146dbf", "comment": "Malware payload (Dridex)", "value": "820efb3e61524354e58da1cc1e1ef3748d92032b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734647, "uuid": "7ba66784-431a-42a5-893b-b13a34fb24c5", "comment": "Malware payload (Dridex)", "value": "330d33db276c17a3ca52233a7330a1c399faff258798ab87024e876d6f26de1ed2a3f5c7fb281f1b3fcd11be450dbd89", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734647, "uuid": "369c0f00-586d-4c82-81a1-d3a56bcfdd75", "value": "5AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734647, "uuid": "fb8b37c9-3000-4790-ad61-ba0dcb3c7ca2", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734647, "uuid": "f68d0028-4479-4580-98eb-3f85d4f99844", "value": "3072:kWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:k42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734647, "uuid": "1815470b-2194-46dc-942b-c2b8e0dd8572", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734647, "uuid": "2e2083cb-38e7-464c-8a79-f774222b947a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734647, "uuid": "4444e1da-b463-47e3-80b7-f8f96fbeb16f", "value": "bd313955_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22b6b15-b231-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620721180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721180, "uuid": "a694d8eb-ff0f-4254-aec1-1ff28ddeb444", "comment": "Malware payload (AgentTesla)", "value": "355160860209999220faf31b76ba7a80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721180, "uuid": "69a14d33-78b0-4a17-a258-a37d56a19d5e", "comment": "Malware payload (AgentTesla)", "value": "19368f9d401db77bd90b14b17b435c319e7fefb557920323d5ed954057d53e76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721180, "uuid": "442f0b91-04e5-4157-af2c-d7eb4d60b986", "comment": "Malware payload (AgentTesla)", "value": "cf78e87db6597bdefc57cb7892e563f0eaad3b5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721180, "uuid": "95c386ec-d847-43c9-b5fd-646034d87b91", "comment": "Malware payload (AgentTesla)", "value": "6780538fc917f8bda97ec39d3fbba7eed67f3fe847191fd18f2612f4f94114077767eee3df025e866ded80fe943304d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721180, "uuid": "cffe479e-790f-4f98-96a5-9c2cf8e086fd", "value": "D3D4DEB1BAF5E036C6459A32A0917CB143F45D45EC21E922ECDCF2D81636FEA6F16207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721180, "uuid": "65fa0a73-f75b-476c-9e00-a76139297dc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721180, "uuid": "97084d9f-0da3-48c6-9107-3a54a8c4b663", "value": "12288:+CGDHFMw7Y9MA59CyMAn04fSRm17FWpLVtzMCaLlRNS:OH+w09tVEaOV2C6Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620721180, "uuid": "cd2a0c60-b2f0-442f-8314-1dcdf4d98a04", "value": 623928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620721180, "uuid": "a30668b4-ebd9-4492-b21f-482dd887314e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721180, "uuid": "e160401a-603a-486b-81c1-c91034197c67", "value": "SecuriteInfo.com.Mal.Generic-S.22901.15789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fb9079-b22d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620719380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719380, "uuid": "8302a09f-e3aa-4e5a-9f11-baa8fe272ce2", "comment": "Malware payload (Dridex)", "value": "e55f445b7843d957602e385a853b16c9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719380, "uuid": "b2c3f8ed-bcfd-40b0-8f88-245e173876ff", "comment": "Malware payload (Dridex)", "value": "194a0f1830c596f857212d880ab6b9b15e008999f11d7afdf6ff98ae8c3941e1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719380, "uuid": "938812a8-3135-42c0-aa39-be7d99f0224f", "comment": "Malware payload (Dridex)", "value": "bf28d65eb78a65432c0235435c2a6e9db21e69ba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719380, "uuid": "952f6488-9792-4a96-aa55-82d844df7a92", "comment": "Malware payload (Dridex)", "value": "2de7d6645835477046f1048890380015fae6ddb4173b517c6ae8e4d8e8c27bafba03dd2bb61bda4d944585fef90cd3b5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719380, "uuid": "63ed780b-967b-4ab5-a041-7ace0d7cbb87", "value": "F1F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719380, "uuid": "f22a3a1d-cb44-4311-a156-78298d186fb7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719380, "uuid": "16049247-758e-4ca8-a5e2-1908fec117bc", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719380, "uuid": "79841006-2187-41fc-b4bf-3287f973b988", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719380, "uuid": "3f8c349e-e57b-4c92-b4aa-d282ef61a881", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719380, "uuid": "96451d34-eb23-4a45-b99b-02da8a78fbd6", "value": "194a0f1830c596f857212d880ab6b9b15e008999f11d7afdf6ff98ae8c3941e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81982ab-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716493, "uuid": "b916ba40-a393-4535-96f7-fe215bbb0419", "comment": "Malware payload (Dridex)", "value": "7e64fee00137aa1d45a3459786e62d02", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716493, "uuid": "fbb3359b-767b-46dd-98f5-f2b8d2dde10b", "comment": "Malware payload (Dridex)", "value": "199519753679b28fae1019337407e872d2b6b4f8fe5c5e658cbf96179442e472", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716493, "uuid": "87e8a133-cd4d-4cd4-9038-3b6ef620b9e8", "comment": "Malware payload (Dridex)", "value": "027f7e5a8fbde1b3883d75274ecdf98f2732a22d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716493, "uuid": "6b1a9b47-c39b-4bdf-8bf5-6e92120604c3", "comment": "Malware payload (Dridex)", "value": "96a4d7108b587af598d2533f2a7670d5ff6a1c53e94cd6c66f108215b8d6d961e71f69b88690d30e7a5d5fe044037ce4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716493, "uuid": "fc0a88f7-bfc2-41bb-9ecd-aeb5fc022b76", "value": "B2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716493, "uuid": "76b95247-5380-4c14-a2f1-0868d8ff83e5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716493, "uuid": "44772cee-5b25-4921-8e91-8ae641e5d2e6", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716493, "uuid": "99aabe43-fd5e-47c3-ad48-a38675946ffd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716493, "uuid": "23ece67e-36ff-42d3-840f-f7014b994b09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716493, "uuid": "85d28cd2-5ec5-428a-852c-4ee3c47ed5c7", "value": "7e64fee0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42601417-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715436, "uuid": "790b6999-94e0-4120-b25b-0e2510e25af0", "comment": "Malware payload", "value": "1a85f5cfb8baf35b5b7c3df5ddcc5820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715436, "uuid": "df39b491-6f39-43d1-8e65-67080f8c4558", "comment": "Malware payload", "value": "19f921ce773f8a14b995cf5255b4673a53da226dab47cd0080de4a6a1a325eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715436, "uuid": "8b7fbeed-5766-41e1-ab34-fea93d794744", "comment": "Malware payload", "value": "9258193c744b486b68075528664bdc59700a32bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715436, "uuid": "da708d81-bf94-40e1-a539-a27eb94657b9", "comment": "Malware payload", "value": "01ee12bf13f852e68fb493989eaa9b9eee3d95551cec1951b5cef4daf433847919667af84bf97a65e6f688a263b08aa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715436, "uuid": "76ef13bd-aaff-42a7-ae0a-60ea3bdd9f11", "value": "E9353373713DD4BAFCC684306EF1B2109FDBF72410E1E69B2BA06D513643859627EAA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715436, "uuid": "84caf4ef-9c12-4c43-bf52-622d6db7169c", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715436, "uuid": "0eabaed7-38be-4434-b466-cd5a097ca7ce", "value": "24576:9JJaPw7eHBJSY2zg3QBaGdEp3Ee7qFRSnJS69QRAAzE0:8Pw7ehgY2SQoGdERYE79QRAKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715436, "uuid": "e6ee64a8-4901-4aaa-bde8-3b0b7f6ff433", "value": 1075553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715436, "uuid": "a6f6bae8-60ec-4864-a412-7a92093c4418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715436, "uuid": "9c6aa018-2173-46d8-8ab5-e84d8dc3a083", "value": "Payment_declined.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b93c21-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698470, "uuid": "33ca5e93-b460-4b54-8acc-e31efe9c8b4b", "comment": "Malware payload (Dridex)", "value": "b6603fa0e5914146d12c2ddf406c75d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698470, "uuid": "950581d3-9a56-4b87-a1d1-a9d38724a71a", "comment": "Malware payload (Dridex)", "value": "1a9bba6488643cb5eea08123e2979b7e627904761651e7949c0e96113b0b7439", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698470, "uuid": "8d7e2b84-137d-4d36-8541-b8d1facea341", "comment": "Malware payload (Dridex)", "value": "21a917c27d4f20a6da3fd0f6b77d7142d6af5028", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698470, "uuid": "776a40ca-e421-49f9-a978-0d84cc9074bd", "comment": "Malware payload (Dridex)", "value": "4325c4eed58fd7548234401541ebb5ad36c941ddeb480addc88bcef2e3c8ceafad0b9d9d0859b2e837be05fc39a74df9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698470, "uuid": "dd3a4154-a7a6-49e3-9313-28e5e7b9df2e", "value": "40F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698470, "uuid": "d839872e-ce24-436a-b119-c54245476dd6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698470, "uuid": "539a2eba-809f-4de1-80dd-4187f9bba74b", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698470, "uuid": "83f23786-71a9-476f-ad7e-50c19dd9e86f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698470, "uuid": "b65ee7db-dd92-465e-8cfd-185b11028529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698470, "uuid": "5d6dae38-dd24-4989-979b-c647aa6bb6ce", "value": "b6603fa0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ed23f1-b23b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620725341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725341, "uuid": "bfb94a80-308a-406e-b077-54f3483eaeb8", "comment": "Malware payload (Dridex)", "value": "56a0c66c879f266344f1ef567c4b63cd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725341, "uuid": "f9f02759-0cdd-4cdc-8300-4a2e2a75d9d9", "comment": "Malware payload (Dridex)", "value": "1ac7d23fdae3bb3e7b02665458c4ee0fc86ade4051724693eb9656484ff8edbe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725341, "uuid": "dc265524-dee8-4190-ae61-ae18121b5210", "comment": "Malware payload (Dridex)", "value": "b4eb69206bf89cefabe46350f6bd71ebf295c39d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725341, "uuid": "8dad3086-73a0-40cb-aab9-f90c804e5acc", "comment": "Malware payload (Dridex)", "value": "c65ac41592b0aee48ab07ee3415185c74a2a44e7715b37f286eb549178b0756eb530184d67a536df3a6b2458655317ef", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725341, "uuid": "46fda756-0f13-46c2-95d6-bca4036d4259", "value": "0AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725341, "uuid": "e23b6972-cc7a-453e-9126-754ccc8aa5d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725341, "uuid": "c8aac24d-34e5-491c-a8b8-7bf2ad4bb1a8", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620725341, "uuid": "b02b2d72-94d0-4715-b200-6d4bafc09349", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620725341, "uuid": "efa3dade-bfde-48c2-949a-f5b62f0d2abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725341, "uuid": "f5eeb4bd-75af-41b3-bbf2-fc409b5e6fbd", "value": "1ac7d23fdae3bb3e7b02665458c4ee0fc86ade4051724693eb9656484ff8edbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1f15b2-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712741, "uuid": "417f9246-920e-41a3-b1b7-72e9eb5ed128", "comment": "Malware payload (AgentTesla)", "value": "55385be6f23ee762851aff8f8bc992e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712741, "uuid": "d6c8eee5-ab9c-4333-8e2f-06c709d44fcd", "comment": "Malware payload (AgentTesla)", "value": "1b1962b3c8eea96ca51f4f29ae1e4bb0c0e08b703a0cf0dd2649985874710b6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712741, "uuid": "65be80b9-57ca-4fce-b75b-d205b6d39a6f", "comment": "Malware payload (AgentTesla)", "value": "0762755a76c8f8f2f2d15cecaf34c1bd6833f460", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712741, "uuid": "b57faf16-2eca-4bb9-a3f6-4ff1f5585acf", "comment": "Malware payload (AgentTesla)", "value": "9dbb59bb6114bc8bd1091562e6d9ae6c10b0176b241bd74331373fedf99f11ddb3efca43f020fd24edd0ef48736c2bab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712741, "uuid": "c8c401eb-fa32-42b2-afd3-28dadabc184a", "value": "9005336EF00BB75AF0F8104E204687D9BAA145BC9A63121F558E31ACFC31C9DF69C59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712741, "uuid": "fdde2e04-5881-4a52-ac1c-7014ec9d219e", "value": "24576:p9p+IRKG9oLH2lF0kPZ5KbN/mcFJYI1QJqx194Pc:pRfoIHPZ4N/mv294E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712741, "uuid": "3fdcbbc9-a0e8-4519-b145-7acbb2eb6125", "value": 811724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712741, "uuid": "79bcd3bd-2a27-4c90-a3ff-ddb1b20bcacf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712741, "uuid": "f4fb1dca-fd6f-456a-bbca-eb1e20af1587", "value": "Scan 22371.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a021e74f-b251-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620734921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734921, "uuid": "5744877b-42e0-4b8f-b929-dc934ab265aa", "comment": "Malware payload (RemcosRAT)", "value": "623b957f20ce6053878bcc86fc8b073e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734921, "uuid": "4d0a9720-8890-4a1b-87a6-cbbfe08d0286", "comment": "Malware payload (RemcosRAT)", "value": "1b8733a553b25ca6338c13d25d938778f515f4c87229f3b632077c450c36ea98", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734921, "uuid": "b3621677-cf33-4ab6-b34c-5fbd677403fa", "comment": "Malware payload (RemcosRAT)", "value": "2f93c1e73f9a5470903663ecf1212789f95c8227", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734921, "uuid": "1b6c3351-bf70-42e7-86c7-7189b31661b4", "comment": "Malware payload (RemcosRAT)", "value": "660a22bd8f1eb951f1133189ee7e441ff4558def748f289e1b5d83c4859ca63e61db09ec4b700c3b6b97b33231918c0b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734921, "uuid": "1adb7fed-43a7-4feb-8e8b-8a18ba218325", "value": "F2852030A7247A55B7E668F49C9E30C52787FBF663B1DA4C910A209C2F793265C72387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734921, "uuid": "10df713c-dd32-4431-8fbb-0162f4237c0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734921, "uuid": "2aba9853-7771-4af7-9eb7-712d8c0c5c0b", "value": "1536:vXDZwHrOtSNJqi9pNmVsGCA5QIzTHchUUCKFGicXQlKnUHBUppHxPcQE6ONU0NKR:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734921, "uuid": "6ef8f3a6-96eb-421b-b949-0c85c21a5815", "value": 1795072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734921, "uuid": "f6b90098-2e61-4f64-8ddb-cf97360e8805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734921, "uuid": "fecde8a2-1125-4a60-af7e-ed2c6457ee3b", "value": "SecuriteInfo.com.Trojan.PackedNET.726.12479.23271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6984da-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715208, "uuid": "95ddc3f6-c672-428a-98f5-89b6bc0133a0", "comment": "Malware payload (Formbook)", "value": "cc4f82b3c194664a4fdcb38fe51113c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715208, "uuid": "e45cd946-ae88-45e9-961b-213870d2aefe", "comment": "Malware payload (Formbook)", "value": "1b970675ad40752cf63ed9b0f4d79195c17816f03c84099043e705b91261eaa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715208, "uuid": "2ffa20ac-08aa-4899-8ec3-79f4c59adbd5", "comment": "Malware payload (Formbook)", "value": "312b582d59341202aea5b604aba5452d59219e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715208, "uuid": "fa136c7c-fefa-4120-a4f9-1eb81e286521", "comment": "Malware payload (Formbook)", "value": "47cc50930949ea10465c3ef7f9fe2fde314f84e32fc28203201a5de5e16a1c3e7c1a0e225036e284ed3917a693c1b11e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715208, "uuid": "eb0f6b13-b5d5-430b-ab26-58f0d390e651", "value": "A805231373D6DB49D0BC83B62893945147F0F2289F26EB4DAE8855AA08D7BD1D6833D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715208, "uuid": "798af612-63c9-4c8b-b4b0-bbcd4a30844f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715208, "uuid": "ce63ba11-739e-4d85-add8-4591057c6098", "value": "24576:f/LJatkYVkxLRwN8eOdBeAdVqSghbBfXg5:f/JYVTN8DdwAKPBo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715208, "uuid": "cc2cfeb4-a8fb-45ee-94cc-47855f585bb2", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715208, "uuid": "68e7cfa4-50e0-4a77-b8a8-d1b1a5124dfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715208, "uuid": "ff75ec4f-a67d-4118-b548-08210242a1b4", "value": "New_Orders 122020 2 x 40 HQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f3ac0e-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715340, "uuid": "69a3be19-e8af-4203-a8c3-4827851fc646", "comment": "Malware payload", "value": "60d014bb9981fef3b7eb88f64cf8f4fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715340, "uuid": "c434eb1d-84b8-4883-ba26-633a4b154c54", "comment": "Malware payload", "value": "1c6c8607e92b11d98f26540f84a922a74938bddbf5ab3c6f32619168963b4f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715340, "uuid": "bc6ce862-18d8-4b75-ad5a-8c617c792e4b", "comment": "Malware payload", "value": "5a872dc9324fa05b3dde0e2bc639d65a129401c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715340, "uuid": "6d95f00e-5219-4367-b922-87e386b4af29", "comment": "Malware payload", "value": "9aa00fea773d8f73afbc8a098edf1a9660092eefd6789981c5451d8c12e371227359395ec6e0f36d0eee105fac4754ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715340, "uuid": "a2ed8dae-f189-48fe-8738-437e656ee4f8", "value": "CAD412496E09A802CA4E6D37D1E50EF043313D76E052D6796B8C3281DAF3BDE7A5D06E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715340, "uuid": "534e1145-ae74-4c8d-858a-06638ace307b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715340, "uuid": "78f15e6a-3993-47a3-b341-b41f34ac6946", "value": "12288:o1WHFMw7Y9MA59CyMAn00su197k2851Jw4+I7LXoWiGmQDwzPr70qkSj5pqBQkMF:lH+w09tVyuzAz5+I7LXoWiGmQDwzPr71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715340, "uuid": "7c5a4f5f-bfde-4dcf-b885-259f5cfd495c", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715340, "uuid": "c230b029-9ea9-4f40-8502-0c3dace4ab3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715340, "uuid": "e6c18688-7e94-4cf3-a718-f5dc19f7b42f", "value": "Ujmadjok.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad548a9-b2ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620774291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774291, "uuid": "f0b9671c-c861-4c2e-89d4-aa57a22cff4d", "comment": "Malware payload", "value": "594cc33061b9a738a69e62b3029ba391", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774291, "uuid": "fdc8d299-626f-459d-8fbb-aa9e88193e17", "comment": "Malware payload", "value": "1cc9206aee0cf0a74d63ed8425bac478ef37ad693941e39b6a477876b4f5b4eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774291, "uuid": "bd0e17ec-ffd2-4676-908b-2bde536db131", "comment": "Malware payload", "value": "3d7bee19bfc8567671a3025d2151acf874961796", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774291, "uuid": "06cb5d17-41e6-44cb-b1ee-701ed1a1f5a3", "comment": "Malware payload", "value": "21515eceff49379c2073a524068cebe460cabc14f855dba7416165567e970133a279c78d9cb082dd37a62a3c1e6203b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774291, "uuid": "f6750e03-9611-494b-b52c-571079e00567", "value": "E7F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774291, "uuid": "45da0980-1649-496b-a477-7d97f70c78bc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774291, "uuid": "0519e5e9-6c3f-4bba-9245-13fe5ea6ba77", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620774291, "uuid": "6260a07d-fa9a-4d40-80bf-646bf98e423d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620774291, "uuid": "6ffdab30-ce26-4b5f-a269-27edbca3705b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774291, "uuid": "e64b5ec3-665a-41bf-9657-33b2ec9b5453", "value": "594cc330_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebda784-b247-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620730597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730597, "uuid": "a21e87cb-e38c-4404-97f7-04635e9d12c3", "comment": "Malware payload (AgentTesla)", "value": "a7a26d57df53b79b97f904d5b5133f66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730597, "uuid": "55aa1139-2467-4308-bdb7-bb933a316526", "comment": "Malware payload (AgentTesla)", "value": "1d685f076d57a177ad5b642cb0657de08e8607bd2b892c4b39146c6f2ada6473", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730597, "uuid": "e4d228e6-8e35-4eb7-aa58-c5d16fda6749", "comment": "Malware payload (AgentTesla)", "value": "fea58a1854d5011f3424d0401750aadb4565c586", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730597, "uuid": "335470a7-0d00-487e-8d2f-c327beb71fe8", "comment": "Malware payload (AgentTesla)", "value": "8a787bc400cfbef0d403b03c4c152fb78c101df62fac24bc82eae8b50b4fff2556aaf2d752e623003a4954a6098004e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730597, "uuid": "7334faa8-e86b-41db-82dd-bc029ab9a84f", "value": "8674126FBBB0C9BFDB401BB26A7D4304DBB1A918B4E5AF4B93802F463761697050E153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730597, "uuid": "1a319894-2633-4c75-b394-67284ab60af0", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730597, "uuid": "50dc4ad2-460d-472d-82fc-855a821decdb", "value": "6144:L9X0GgKN7R2XEYRI4GSx5kYjG3ELyHbWEdozcA6bSxFDY04yf2wPivPPV1I8nIqF:l0VKN4XEYRI/ZY4YEm6mxFpP6PHI8hRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620730597, "uuid": "c97f9cdd-d2fd-4974-9fe5-1f1d7e15b323", "value": 338621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620730597, "uuid": "f502f1db-c447-4d34-bfed-2d36994e300f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730597, "uuid": "0afd1351-9262-417b-917a-d006f55fed32", "value": "a7a26d57df53b79b97f904d5b5133f66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801c9cf6-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712963, "uuid": "1334f7c3-b5a8-4faf-b546-8f20ca31807c", "comment": "Malware payload (Dridex)", "value": "7b47fa9dd61ea3dbc3af24e4974f88a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712963, "uuid": "77b1f89c-8dd6-4f29-b368-5e988741386c", "comment": "Malware payload (Dridex)", "value": "1daff9c5c19dd15dcefa4d4d8d9cb76b255edc9b492dc87bb4869594884b6bbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712963, "uuid": "aceedf1d-0495-4b62-8ac7-c6dd9468df09", "comment": "Malware payload (Dridex)", "value": "9ac8e66030ba30de1db26d7833806ca43a8896b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712963, "uuid": "c8dd75e4-57f4-4bdb-af12-0d57bdb8e97b", "comment": "Malware payload (Dridex)", "value": "2e34a6670b1751052bb185dbc7b2974e6e76c2cb736928e394d2236331996f6db3c7fac053a896e28e6137322910a27c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712963, "uuid": "e4037331-cd00-4eba-89f4-3b4e4d1265f2", "value": "67F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712963, "uuid": "797606e9-1864-47c2-80f7-fe73ad9672c2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712963, "uuid": "146ce919-9a9b-48fe-a17f-a5badec38a5e", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712963, "uuid": "dfbf1c40-9a2d-48c5-b43a-31551140ddd5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712963, "uuid": "5d8d1a19-c395-4d76-89f4-a54bfad04023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712963, "uuid": "cf9c152c-909a-4eb5-971a-f3004aee7e60", "value": "7b47fa9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83519dfb-b238-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620724135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724135, "uuid": "902f163c-8803-4ded-ac85-998782390143", "comment": "Malware payload (AgentTesla)", "value": "5d94d033d76c2cd9e3720d490277f4a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724135, "uuid": "9b8c9b4b-9bc0-4a63-b9e4-8743ff96d0b2", "comment": "Malware payload (AgentTesla)", "value": "1e1a29f908a679a993ae72972f21e145bfe8acd18243495e4a23639cf9e6ea59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724135, "uuid": "66abf93f-243b-4f4e-9a5b-ecb904d22cd3", "comment": "Malware payload (AgentTesla)", "value": "a102b08230b76e25074046dbe50a4f98bdb070d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724135, "uuid": "545206c2-5438-44f9-84cf-46d11f5a11d4", "comment": "Malware payload (AgentTesla)", "value": "77ef732616915fc6ed185a6746ede3af43c3bf8e0e1c903302fbac220bb25efb07d75c7b7ee8ffa5912623d27cccced1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724135, "uuid": "4db8a6a4-4e71-47de-bec1-14dc87bda5f2", "value": "06852D84066D16AE768D71B3EF59F38C8D1709BA507FE0EAB424671B5B00D488FA1BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724135, "uuid": "f0995a50-6eef-43bf-9637-8b1b446da286", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724135, "uuid": "3031a1b0-8a95-4414-abf3-541cfdfc4d65", "value": "1536:yAzViuf5SnFhRrI+fUUUVpRgPjnLo0ucVhKhJKmhkP73guqxvdhJNxtW/A4s/ScO:vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724135, "uuid": "d14a506d-96f2-46f3-b8d3-64c0cf5a9360", "value": 1847296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724135, "uuid": "9aa96639-98ee-450c-8a35-c45180e4f3dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724135, "uuid": "28098f7b-f809-4a5a-aca6-2815266ab973", "value": "scan doc_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbc0532-b248-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620730974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730974, "uuid": "08a20531-fa9c-46d1-9734-37991f831392", "comment": "Malware payload (Dridex)", "value": "e37bd843fd6157acaa8d143594c6c3e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730974, "uuid": "197c1572-a72e-473c-890b-8312ee5a5986", "comment": "Malware payload (Dridex)", "value": "1ee607bb332f4725a08f305937b3cb79dcc68298bbcc2d09a5f214dbc2a99fa7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730974, "uuid": "9b9e9bb9-fe48-4ae6-9cbc-a89c01979ecd", "comment": "Malware payload (Dridex)", "value": "dd759c07df8e2a395e1f6f8a580217b51cb65fbf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730974, "uuid": "981c081c-b7dc-42fa-b94b-31ba297469f6", "comment": "Malware payload (Dridex)", "value": "73b08d6f928fdaa7674848ab4fefcddab6e017c340214f2fd3824d4c082da19c87c532cd0c7b4e2c7ed0c764dbcaa0c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730974, "uuid": "8926749e-6df8-4ba6-9f0a-c870dc7839a6", "value": "DBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730974, "uuid": "bb01ec2a-472e-46bb-87b2-eadd20bf0e4e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730974, "uuid": "078cadb1-b869-4f9d-b6cd-70038ec8a540", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620730974, "uuid": "02bd403c-b3e5-4d3e-bdb7-95f8d78b0bc4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620730974, "uuid": "7b61ca49-8685-4acd-b47e-b3c378d54771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730974, "uuid": "c808344e-2db1-492d-9df5-9d16674466ac", "value": "e37bd843_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b1db5e-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705666, "uuid": "5ccf2653-f9bf-4b15-a018-8936abedbe12", "comment": "Malware payload (Dridex)", "value": "606ca33ccabe257c81c1954942343824", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705666, "uuid": "002928b4-b369-4c32-a57b-42c63182f349", "comment": "Malware payload (Dridex)", "value": "1f802e069fa6e6b53434ea46749ca4e565c895d1d22bffad28cacc9de14b551b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705666, "uuid": "cf6ef239-3afb-4720-98f4-bee351a14efd", "comment": "Malware payload (Dridex)", "value": "3097418b8e5c44fe425d70c129a6bc08ef545c20", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705666, "uuid": "3e766cee-520e-4163-84ae-52a5595bfac6", "comment": "Malware payload (Dridex)", "value": "f8a016f562eef65c8663ac1f5103f5b15339d457ed39dd39d5569a89285ba52198cad155990f0686af8d8f6bd9964a2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705666, "uuid": "bb8b04a0-43a9-4f02-96da-caf98b18788f", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705666, "uuid": "996e796f-f496-4ff9-ada3-ef53df6ab2e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705666, "uuid": "9f39df5e-1306-42b7-9552-60c893201c44", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705666, "uuid": "d58194a9-2cee-4bd0-8948-8228774219d8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705666, "uuid": "ee13e149-9e40-4845-9fef-01991c33d034", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705666, "uuid": "06456238-37c6-4972-858a-35953490aa78", "value": "606ca33c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0677e871-b26a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620745400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745400, "uuid": "08d085dc-73a0-4f0c-9fb5-aa3cdde29d5b", "comment": "Malware payload (Dridex)", "value": "c159ced9307274bedb24336d3540c8dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745400, "uuid": "600e988b-3a38-4bde-8d67-897618fb67b8", "comment": "Malware payload (Dridex)", "value": "1f808a9a0afeeb879ef444c89048f89b024e08c553b429c58c783a77c1a27114", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745400, "uuid": "507c3bf8-069e-4430-aca9-0dab2430c6ae", "comment": "Malware payload (Dridex)", "value": "220d43f3e4648fc192c894e8cace19bd4be1a450", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745400, "uuid": "c9c484b4-bfc4-48e9-9a49-e50114df6f9a", "comment": "Malware payload (Dridex)", "value": "4763bea8bff22a676514069cab0605d50bcc6e9bc249f8b835a8fcd9dd5ee864f5901cc60a55065b50d00174a0003818", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745400, "uuid": "8aad2c26-372b-4704-9ae6-46ce2c751531", "value": "E9F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745400, "uuid": "8fbfb16a-b97a-451a-85bc-4222df0bfe51", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745400, "uuid": "fda8742d-9842-4c81-85ef-cc47e9646a3e", "value": "3072:KiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:JeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745400, "uuid": "5f96e675-ea37-427e-b1b0-bdffd15495dc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745400, "uuid": "398e0bb6-b87b-49ab-a41e-57fbf905f2e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745400, "uuid": "643ba5bc-0d74-4761-892a-95cb3b04f0bc", "value": "c159ced9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa9430c-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1620752529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752529, "uuid": "098baf3c-4cf8-40b2-840f-0f57a65956b9", "comment": "Malware payload (Vjw0rm)", "value": "1d4ba76a11388a108e28b4bd497b0ae1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752529, "uuid": "27c0f9ef-32e1-466d-99b3-ac693bc93df8", "comment": "Malware payload (Vjw0rm)", "value": "1ffd739d31490b0f576461d22ce118ec41c1a6ac8187de6ca694557416e47f2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752529, "uuid": "fef8716e-c503-4ee4-8aac-69492cf2276a", "comment": "Malware payload (Vjw0rm)", "value": "3215560a49d8b730c02a761654b974ea1fa4affe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752529, "uuid": "a3bf41ec-2200-44d5-9a99-628d533ac4c3", "comment": "Malware payload (Vjw0rm)", "value": "3a6be2423e083027aaacbffbe04f3d214af88a9e081eecd8cfee7920b2bd37e967996e5085b3ea603ce988cb3aa76007", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752529, "uuid": "a7f5921e-0eac-424c-b287-83d851d17460", "value": "6281109C284B863C57D67B8B802DD14CCDF548B47F28D2B6148CDAC5360E97987B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752529, "uuid": "d5edf07c-2f8e-47c8-9390-433afc02471e", "value": "96:SABNo5Dwk2c24ZRMHXE6/BII+Ys+fJfFmDdQqR7bJyKhFaOS4UK:zSh2c24ZRMlBI7Ys+fJfFEfRfpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752529, "uuid": "df827a8c-cb81-44c4-b487-daf19271545b", "value": 3875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752529, "uuid": "5cd9c330-74dc-47c9-9ce8-fa0dfc4cc7be", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752529, "uuid": "188f1b4d-ce6e-4716-8803-73bdbeec2826", "value": "Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69146041-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620694885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694885, "uuid": "a3afa289-eef3-4c0f-8d2c-ebff8a249ae6", "comment": "Malware payload (AgentTesla)", "value": "a91ca12372d5c3209827484ec538de1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694885, "uuid": "f01929ba-bd36-468c-9972-f232e5275203", "comment": "Malware payload (AgentTesla)", "value": "2018a78eea0e3d38b14f5c700ec5a51e8d4328dd8c3d53f138daf5ee79b592d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694885, "uuid": "1be7159c-7476-48ff-8c09-a3f84a8e20b5", "comment": "Malware payload (AgentTesla)", "value": "9c8f178c5f4b236ff3a2d2a5ef32a40fe168f472", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694885, "uuid": "8ad81d1d-60b6-41ae-9bc2-d761630a592a", "comment": "Malware payload (AgentTesla)", "value": "f14a6298a47d7554b9174e8e16c3878dfd8a539aff233163fd1b2c4203abc276ab8b4d551db9bcbcc6dab7f9bdadb661", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694885, "uuid": "ae206320-8750-4c6a-acfe-1f980664e5f6", "value": "D9D3132CC85061EEF9955C7E4B8796EA1BFF696087253C627E4483FE61B09D437082E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694885, "uuid": "f0e6b14d-514a-4d57-8765-8d332718fcae", "value": "3072:fvhi06JulOGKSYN2dc+rRfPQDEqTok2o8tepG4+:fvh/6uOjSYN2dc+rRfPQoTBtaGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694885, "uuid": "47b3cd7f-5a22-4c96-98db-e0853e5f324e", "value": 140787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694885, "uuid": "31129921-4eb8-4bcc-b320-e5866b537fad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694885, "uuid": "74f748e2-b23e-4139-a97d-265d788df841", "value": "a91ca123_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5ce3ba-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714866, "uuid": "54ec7a69-45c8-4f49-90a6-e1eb04b7acfa", "comment": "Malware payload (AgentTesla)", "value": "d4b305efca13dfb12e35589233263831", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714866, "uuid": "d8209da7-6edd-41e3-a72b-ce1831383c63", "comment": "Malware payload (AgentTesla)", "value": "202a874c92cd603d7743eec18025972cde4f15ac56792856a77d6f9e27b96ec9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714866, "uuid": "b195c002-47a2-48c9-a0ca-5c81a5f4ba54", "comment": "Malware payload (AgentTesla)", "value": "de03a2ee2da13c9acb486a82a971a944c48290ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714866, "uuid": "ef69d2ba-a5d9-4c58-ad05-f4ee99dc75a9", "comment": "Malware payload (AgentTesla)", "value": "83f3a89a6f6e3f219ddaad4d67a8ad14dd167c89633f9ee0992e94a604a9620c5d69aefa1cf9488f64d0105bd75672b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714866, "uuid": "69c2be9a-bbd0-421f-8089-8cfcf3af0788", "value": "5C15120362E821E0D06D57BC5C5236901378F956E621DF5C3E8870ED9AB32E646B2FDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714866, "uuid": "fc0435ed-d44a-43ee-a387-b730a28c5e63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714866, "uuid": "0e7e37b8-b2c5-4fc7-9d6c-f86f52c2d420", "value": "24576:W1ZrSpkTXsgwABjQtBISfyacdDXOQGDAxEBXwEvLJu:OhSiTMxr/fyacdDXdGDAxKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714866, "uuid": "24e56192-9d72-41cd-b033-534423ed2883", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714866, "uuid": "8fad0fc7-f370-445d-81ae-d2a6ece81f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714866, "uuid": "5c1b3105-2c8e-469a-b63f-bb9ee12f448a", "value": "Maersk Line Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b967fd1b-b28b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620759874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759874, "uuid": "6307fd70-5356-4d3e-8217-195b0bee1d77", "comment": "Malware payload", "value": "9f65bb66134fe838667875a524e41e39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759874, "uuid": "0ba350de-1a16-4869-b933-8e64b97cf5e0", "comment": "Malware payload", "value": "2070bb126837c53e5fed1db0480adc7bf7c7713c6abf8f3247ba9b2ef62b5224", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759874, "uuid": "457191bd-b367-408b-b368-0dbc6adc5bd8", "comment": "Malware payload", "value": "d04a95effcea447be0a53500bb9fa3e5359c8f56", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759874, "uuid": "9d7895a4-57c2-4006-b633-d0b8feed9212", "comment": "Malware payload", "value": "c8263661f2a5b00c56f01c94ace977a67968aec1ef6822bbcca2716af37c2e799b8a8ee40a47723535e56c0a38c277a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759874, "uuid": "e28febac-3005-4122-beea-efe2fb8b3ba9", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759874, "uuid": "b71db0c0-3e4e-4165-8ae9-6d3181a5bced", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759874, "uuid": "a725706b-f08b-48aa-9a49-0f6e382abfda", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620759874, "uuid": "181211e2-2c50-4c29-bfd7-e89e20b55a37", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620759874, "uuid": "29f3a4c6-24b4-4496-8b57-7d74f4d2c933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759874, "uuid": "9096e6c5-b823-4f2e-b6fa-acaf3b971358", "value": "9f65bb66_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d76c37-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698455, "uuid": "0b239065-4895-46a9-8afc-09a90a18c797", "comment": "Malware payload (Dridex)", "value": "990e7608246469908ecf6aadfe90c842", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698455, "uuid": "78577d96-d3fb-4cd3-b335-29cc118c9631", "comment": "Malware payload (Dridex)", "value": "2091a4dae9ece8c78cfe886801c2971942653953862999817a77df32c2794daa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698455, "uuid": "74bb4a29-c1af-41ad-8345-c83958358705", "comment": "Malware payload (Dridex)", "value": "81a89ac134daf1a0466b4f4c06385cc6271d06db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698455, "uuid": "66876e92-23e5-47e3-b18c-48db2bcab689", "comment": "Malware payload (Dridex)", "value": "3ab9fe06ab446d5527fb76ffa6396bffd4233af83b122802abdb2733852f49a43028b207b105414011c3d03b94e78ae4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698455, "uuid": "e027dcd1-abae-4391-9aee-57a980fba863", "value": "9EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698455, "uuid": "f170c389-176d-4ce1-9c86-14c2999f6229", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698455, "uuid": "abdb11b8-8aa2-440b-b0b8-dd0e5f7669f7", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698455, "uuid": "10364cb5-c85d-4615-b12c-672578550842", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698455, "uuid": "df50f7a7-4865-4f0e-964f-44f4af7d26ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698455, "uuid": "ab6a8efd-fa05-4c0e-9f4e-5ff6063c939c", "value": "990e7608_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f31426-b26d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620746898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746898, "uuid": "717de272-1124-4dc8-9762-742d2b7a7a5d", "comment": "Malware payload", "value": "654ad230cb5595252ea00ebb09402199", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746898, "uuid": "a49fcc7f-9971-4049-a632-68e76edafe08", "comment": "Malware payload", "value": "20ab8ade3568e55e354831045744f70f09873a5bc3a746a8bc2a7dce67419d1e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746898, "uuid": "5b83ca72-2fe7-4e06-8f10-f6696525645c", "comment": "Malware payload", "value": "c4011776b3e524f198bbdb2febd48105a06b51dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746898, "uuid": "1968435a-afe1-4535-ba88-4572cf2893d1", "comment": "Malware payload", "value": "1cdcfb4c22e2d48544a01f5bc86e0058facea94cd0c8f9a9cfa84fa944e2fa0dee8e0ebb93efe63c5f0e90708f67d58f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746898, "uuid": "5c4beec4-7370-4288-87c4-7e98996d46ab", "value": "061423A1819F66F9963B2395AD23ECFF374791A0CC591E8F0A01D72F5DD620C5A2760C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746898, "uuid": "0ca94fcf-5ed5-4e4d-ae40-4ee25133c9d6", "value": "3072:TDIXNtNBZ/N+wuZi/j+GPegsBxLLWj4jITx+xUMsIWDMAsDF85yHACsk4Ygtl:TmNBVQwki/ivgsBxLLW8ITVMsIWDTsDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620746898, "uuid": "68133719-ce86-44c9-b437-2f20b29ee75d", "value": 195328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620746898, "uuid": "852d802a-99cc-499d-9092-7e077aad8865", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746898, "uuid": "7bde22bc-1343-4623-bdc5-9e0ecce9d71f", "value": "slot Charges.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19f6b0d-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620698443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698443, "uuid": "1f131398-800e-4999-94b4-2f8fed74200d", "comment": "Malware payload", "value": "13a2aea79f6c8e9794464661761191e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698443, "uuid": "d9a04487-ca19-4650-b2f0-84d00a09a362", "comment": "Malware payload", "value": "20c79af8e022b1642942e273fd755940f93eb95607de05a6cef284214351da51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698443, "uuid": "ebcd20a1-8db4-4a4a-82ee-64e014ec4814", "comment": "Malware payload", "value": "b9589ae11896e5bc570cb11617deae47f2bbbce6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698443, "uuid": "cefbd827-5749-4205-ae0f-0be4d05e872a", "comment": "Malware payload", "value": "ed1877394d5568bd139775bd63d4694cd876178f6a4d4915bd20552d55b3749a0902454dc8a0b2215a5d06a11c17d2a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698443, "uuid": "41085f25-1033-4090-86d1-899de0eaef50", "value": "BE8312EBEF015D00EA3B9DC866F15E749192D8E013AB193BCDBF6AD8B0155C6761E050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698443, "uuid": "12676ef0-0057-4acf-b960-0a2dfad66585", "value": "1536:z/gJU+/3kGH0gabaNS/5tlvA6MdMGtJe8jZGpjV0CieujuM5VX4sKi9Wo4k:z/6hJH0gar/5t5A6Cdfz8pV0CvMFKGyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698443, "uuid": "e46316e4-f95e-481d-b458-fd9b01657248", "value": 85393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698443, "uuid": "b530ce4f-581d-4143-9cc8-7cd15b2ac903", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698443, "uuid": "f93ea9d5-f6fa-42ff-81bf-5369b28cee22", "value": "13a2aea7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d23665f-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702059, "uuid": "7d095f73-4b43-45dc-ba59-18f014472300", "comment": "Malware payload (Dridex)", "value": "b803f6b76b0d68107b6a3ab77668c553", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702059, "uuid": "377d5806-94b6-45c6-aa30-899ab2248471", "comment": "Malware payload (Dridex)", "value": "20e058bbf35102a3f8d214533a58d989bd5b87ef5e6cb9258b96cbcd12b9331c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702059, "uuid": "173ddb4e-796e-4160-b1f2-a026e2dcde9a", "comment": "Malware payload (Dridex)", "value": "62a260ac27a51df6cc6010328e9af839ac4aa686", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702059, "uuid": "84aa80d0-7b42-40bb-9741-8aa4e93e11f5", "comment": "Malware payload (Dridex)", "value": "7540fa22038f3077adf93ca7977a895adf21576cdcb797cef1a0e36c3c05b3c8548fe5a97744e0c81aab4135b051914e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702059, "uuid": "5ac8850c-a4df-4eac-a904-6cb10b5a00f3", "value": "2EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702059, "uuid": "d29c3303-d5f9-4ce2-ab5f-f58ad32c6a9e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702059, "uuid": "fe378c1c-0eee-4225-8545-97e261307052", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702059, "uuid": "3c08496d-8910-4850-9c8c-e794b7114faf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702059, "uuid": "528c3522-5d92-444e-a140-abd7723406ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702059, "uuid": "b0c59293-2415-43fc-b234-bf5778c2b874", "value": "b803f6b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bc0acd-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738158, "uuid": "a1b66695-e871-4485-9998-58088ac6622c", "comment": "Malware payload (Dridex)", "value": "4b6eea3dca1b380025e1f20fdea20edb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738158, "uuid": "adc7646f-be50-4f1a-9e02-7ef18f2d9028", "comment": "Malware payload (Dridex)", "value": "21c7dbe42a69bf51c8e0dbb985afb18520fbc8184ea714b8ff001429a9abaa83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738158, "uuid": "971ad338-b493-4923-8e4b-f1304a3337cd", "comment": "Malware payload (Dridex)", "value": "17bdf6effdb89deb63326dda7e2e5cb8f59006c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738158, "uuid": "0022ac58-d4d3-49e4-87ec-54e8765e520d", "comment": "Malware payload (Dridex)", "value": "e121035b711dbc366304893f3df11b36db199b4da5e903b36bbdc28b57f75811aef0389f1ae99ccf538bb24354f35658", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738158, "uuid": "fe7260db-0e2e-4329-afca-62d0d545b8a0", "value": "C5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738158, "uuid": "c04da863-064c-439b-91bb-c24f7b9cdc84", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738158, "uuid": "1b05d394-1be5-411f-b2d9-32962e4933bb", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738158, "uuid": "83a8df00-05fd-45da-8f1a-77baf43bec8f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738158, "uuid": "23993aff-cfb7-4c3a-b086-c860a32c7c5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738158, "uuid": "b4827bdf-4d92-4cea-aeb5-271ad7feab9a", "value": "4b6eea3d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88d3840-b25e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620740653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740653, "uuid": "daa30438-1f5f-4aaf-81bc-39669be8b39a", "comment": "Malware payload (AsyncRAT)", "value": "35659c75533d97c671bc77259389fcbc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740653, "uuid": "20d10ec3-6e9c-471d-9709-8dfa94642303", "comment": "Malware payload (AsyncRAT)", "value": "21ec49051d82d172f4077b541adef303b06cfea513c0e87e5b63694354ba4f9c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740653, "uuid": "6b10df2d-faa4-4417-8fcc-8d98bf0a961c", "comment": "Malware payload (AsyncRAT)", "value": "5757f79a174b691c4c97456b7f8c6c4306842054", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740653, "uuid": "95ce03fa-6d9c-4659-a814-9c9f9c12a820", "comment": "Malware payload (AsyncRAT)", "value": "dda431b1e714b19c6b794f605c6c4e33e6de406eb03ce63ccb07c57fa2481c1c85a2b00b365b58499ebb86cd77bc8832", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740653, "uuid": "055411bd-3abd-4a9e-bd75-70c13d785c8b", "value": "81F4F13637686FE2E67EE73D5864108853F9E406E321E28DBEE901DE5860F4147A3F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740653, "uuid": "61bf5402-826e-484c-88bc-03d8cb2f16e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740653, "uuid": "59f2b152-e874-4a53-9a59-83d387b1b8ed", "value": "12288:YfuqfYfI3a6BvGFk1YfUATTEmaebm8GjJsiNuZdCJry2HiNInTayeOl4wh+NcKwK:YFJXusOCFem3hAcK6UU39cvK6nf+8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740653, "uuid": "d208e5ec-2c30-4464-87cf-2e278e295b82", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740653, "uuid": "bcafbe90-a29a-40ab-bb0a-3760d14ae319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740653, "uuid": "a7a14304-c806-4063-b8bf-7c8f5f5f097c", "value": "ObnpXM56D6qKPFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d061dabe-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620712238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712238, "uuid": "b766c616-e9e9-46e4-a185-ca6ae4abd591", "comment": "Malware payload (RedLineStealer)", "value": "c71735c5ec39ab472178ab89a3ee7d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712238, "uuid": "77f45fec-2cbd-4036-8dd2-de7f86e0f539", "comment": "Malware payload (RedLineStealer)", "value": "2338fcb4421c49d3f357db82478b5ab01429e2bb4bb59e0feb2331ce53863b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712238, "uuid": "3ac9d6b9-a13a-482e-90de-4fc40e4697ad", "comment": "Malware payload (RedLineStealer)", "value": "5be49cf757e37dd3973bf836413a9a37a3518ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712238, "uuid": "a5b9aa2f-c63e-4f6b-a8bb-4ba5ec1aed21", "comment": "Malware payload (RedLineStealer)", "value": "5cfc9d252cc07704946ed9b62052143ed2fc18c667afdb0e1db573b752c8a3e785a0a447a3062dc9fe420dfc85696b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712238, "uuid": "f2835f62-f59b-403f-bcfb-08f84708b21b", "value": "C8E5D4B176FA348DA2E4666950D0A2FD5F7F7F113838712E08612D03D384D269F693AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712238, "uuid": "8ce65cf5-0e2c-4fc0-ad20-540aa09d0eda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712238, "uuid": "10c306fc-64ae-45f5-b390-926c67af5b21", "value": "1536:lCaA0srYlsINTaAqrVJ57kzIao1xjYq5uSHlgnp0fTArjlhIwMl5UdQW0QVRXy+n:bz0QnjTabQAWQA+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712238, "uuid": "c61a1620-722f-45b0-b397-3183c96be02e", "value": 3112848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712238, "uuid": "b1f3c6f1-5a31-4b66-b2de-281c99b70bb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712238, "uuid": "bf5f7a23-e3cb-4727-b147-26f8e6c8dd74", "value": "c71735c5ec39ab472178ab89a3ee7d35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd684b2-b2ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620774132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774132, "uuid": "18cf8446-bf64-47a8-8985-01264463ecca", "comment": "Malware payload", "value": "6b53c72360104b468273c64034898282", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774132, "uuid": "bc551ba7-5ee3-43ec-ad1c-df072adbc72e", "comment": "Malware payload", "value": "2375bd90d4a4598247a7bde51914617bea29c253cea8bc04d5ef3f9c142a3b81", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774132, "uuid": "1de13f86-d4ae-40a5-adeb-93f2da2a2a30", "comment": "Malware payload", "value": "3dce0151f5376022a78a28f04a9b0fb376de2d64", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774132, "uuid": "aa7313e7-b852-4a05-81ce-a01b405089ae", "comment": "Malware payload", "value": "b5fccc189e0c0cc756e1d3c7a1e9e1179180e1d2d7f7855cf29ae75af733eff92b19240a1d320a85e362a7b588f9741f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774132, "uuid": "e791486c-8cee-4be5-91e1-99060bf29bf3", "value": "36F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774132, "uuid": "812ad1af-cf2d-4d57-98fd-f068d989cd61", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774132, "uuid": "b740fd8b-f3ed-44e7-a53f-497aea1cec1a", "value": "3072:WIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620774132, "uuid": "2fe23cfa-52cf-4c19-85c3-3693754ead24", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620774132, "uuid": "aa7e1efd-c352-4257-b808-c804e27923f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774132, "uuid": "ec5556ce-c199-497a-9073-9c896905791e", "value": "6b53c723_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8904dd48-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714696, "uuid": "a35f0084-a935-490f-a947-c69e91ad89e0", "comment": "Malware payload (AgentTesla)", "value": "b22636ecb9c4e98b1ff9ae107a61ae4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714696, "uuid": "6c83c66e-d757-4aeb-8c9e-177cd6e5feb4", "comment": "Malware payload (AgentTesla)", "value": "23c5fa32db0bf735dc516251ecec3446da4e5ec114f01dcf6da000ee4b6ccf0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714696, "uuid": "7b8bf291-46ac-4863-b564-622f9d8e07c7", "comment": "Malware payload (AgentTesla)", "value": "a69a313545a3316b73ec0c605363d37d25644075", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714696, "uuid": "4145a09b-9f10-4fa7-836c-4188ac9b0cff", "comment": "Malware payload (AgentTesla)", "value": "70c65e2d00bfa12334d1e92ab12b25e5fa204e89aaa54544c3529cb488b25be0ad88cce4165f4c14df1037eb2cf7e466", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714696, "uuid": "65280830-2f87-4b90-be03-8a54171a6d49", "value": "50E4BE1C26A48B45D5FEA67CCC70D3204BF97A06D516EF5E3AA030EC1DF7712EA0295A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714696, "uuid": "860c8dad-94d0-4e3f-a8f0-9a5d2b43a145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714696, "uuid": "9167ba94-ecbe-4979-a8af-6779a6e8588f", "value": "12288:V0/RMbUau6VCInr1aBbGGCubd22mjTKwW+IP7k:9TnsVGsbgj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714696, "uuid": "a9139566-a33d-4063-b805-2a1adb1c0613", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714696, "uuid": "6746d83b-9e2a-42f1-8771-8bce8cfff817", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714696, "uuid": "02b6d864-3e52-4b09-9ee7-4b9796644576", "value": "SHIPPING DETAILS.. PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c37c9c-b28b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620759896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759896, "uuid": "24615414-706b-46e0-b971-792676cf31d4", "comment": "Malware payload", "value": "42b9e18dad71c290f8e927397c5358f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759896, "uuid": "d52fda8f-29ba-4b1b-b5f1-160900d0cc14", "comment": "Malware payload", "value": "23e757e62ba14c0b17f8e3cb21de3d8a2e994dce326d496f9a0d66fd8a6cd28f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759896, "uuid": "1f7cdaae-fc8c-44dc-a984-e8699223e3e5", "comment": "Malware payload", "value": "47b3d73d50a14dab944a640c26032baeee12167a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759896, "uuid": "94db2be2-4c10-4053-aeda-768bdea17c56", "comment": "Malware payload", "value": "8bb963409a68dbd1528e94e446e0d5b1ee50b3f43c7267ea5b2d0a74d09f6ef44f165fe3b2a5f03c6ea125fc3fa1d300", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759896, "uuid": "c3916e65-c080-4fe6-868c-fc66b3cc2617", "value": "FBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759896, "uuid": "7de2a54c-71f6-4460-af0f-2c624149fbd2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759896, "uuid": "3cddbbc0-c9f9-4162-a5ce-d3195a81f169", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620759896, "uuid": "b5198698-8d92-44e2-86da-ce5ee32b63fe", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620759896, "uuid": "0032e471-115f-4708-ba23-731542b6ba73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759896, "uuid": "9c9b804b-1f9a-40fe-bfbf-dcac160f98ee", "value": "42b9e18d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8a73a4-b282-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620756037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756037, "uuid": "2b5170c9-9c95-4b00-ba62-2e0966306175", "comment": "Malware payload (AsyncRAT)", "value": "2660d9c452151cd90432e72a653e04ea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756037, "uuid": "628681ff-18c4-4704-9455-6cb2bdfdab03", "comment": "Malware payload (AsyncRAT)", "value": "23f66a4b5f6fd2f6f87715588d259ef6f251d1f4acb0ade40e9662d549962783", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756037, "uuid": "a009d401-bf66-4a58-940c-2d2e48b7c22d", "comment": "Malware payload (AsyncRAT)", "value": "5368e7f0a6858aa6c38a1b1b164c60cf2cc8ab5e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756037, "uuid": "1785da51-20f3-4097-abe4-d533e203f464", "comment": "Malware payload (AsyncRAT)", "value": "7b35cbf174162ed66ee03c51928b9f140c7251ebfb3c64e80d08c4e2924a3227cbe7a65f1c3cc5dce0ae5b6cae07ad46", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756037, "uuid": "8cec4a94-d62e-42eb-b617-dcace37cb334", "value": "BE64E02D32F1C567D7AA47348EE2FA6422F6FCA1792C7247F461F35F1A3A2858052394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756037, "uuid": "2d2c356b-d545-4e55-a5f8-b9b032e0602e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756037, "uuid": "d8a9f5f6-fad2-4190-8dc6-c6b0f1d6ffbb", "value": "6144:PKIEATjx6AXpvPv3TTPKaASIhX3bnw2J1qLXXrlXOlv:yIEAwCPXi9FV0zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756037, "uuid": "8406f18c-7569-4828-bd80-3e5f47d77a2f", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756037, "uuid": "6ddde504-62c3-4885-99dc-f72afec7bbc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756037, "uuid": "61c7015f-4702-40c7-9598-eedcb22e14c7", "value": "2660d9c452151cd90432e72a653e04ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ba551d-b23c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620725959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725959, "uuid": "7a18a336-9227-4472-b4b6-dabca26146e7", "comment": "Malware payload (Loki)", "value": "11cb03dcdbee9948416b99fb379500f9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725959, "uuid": "a8b877e8-0521-4d3d-afed-eadf050a65a9", "comment": "Malware payload (Loki)", "value": "2453cfc716c92bc04c4379dc31dcf845d626bec41e779f6c3b451ed6414b33db", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725959, "uuid": "8571efd1-7f10-482c-a898-99748315d58d", "comment": "Malware payload (Loki)", "value": "95227453619062fae9f9f144a5ded161f2087538", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725959, "uuid": "519d5dde-9574-4437-8daa-215c39e87489", "comment": "Malware payload (Loki)", "value": "c4fc8c6dc481c76a5ddbfec640d272163624dfd677ef60d470d11aec02ecaaf1d2f554261bf15340145be4ddb599a22a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725959, "uuid": "59d50bd2-2cd2-4efb-a40a-67337c185a0c", "value": "9FF4220337CDB2E5D0B44BB96CA1366553B0B964A110EE1C2E4831BEA973AC44672FDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725959, "uuid": "af326cfa-a8f8-46b2-8bf2-79568a57b240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725959, "uuid": "90cbbb13-79e1-4fae-b1ed-088fd3dfd361", "value": "12288:uEsnyiVQE/cOgYM7pBbZO/ap7iIiQqzg/cPyaQ+qS5LTYBrHrW6gnTUjS5n:POhMdBFxp7piQqz93QnSQhzHjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620725959, "uuid": "49463f44-c44f-4f34-8769-9272e1cf660c", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620725959, "uuid": "db608dfa-9595-4dd8-82de-facdd2be42f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725959, "uuid": "1754a332-3480-414f-9b1e-bfc33c145e4d", "value": "CAO DUONG CO., LTD P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221e013b-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702068, "uuid": "1133d3e7-6847-4b7f-9b15-735dca026ad4", "comment": "Malware payload (Dridex)", "value": "c79653fab3083ec0ca9b6ea053c5811c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702068, "uuid": "01855cfd-89f8-4052-9019-c6b7733ba928", "comment": "Malware payload (Dridex)", "value": "25b0004afca54aa115195e0b533699cef026841129ccf68cc2469f4ad7e6fb09", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702068, "uuid": "dcebabd6-d18e-40de-b5f4-982c531be852", "comment": "Malware payload (Dridex)", "value": "d6bd5b1ffd67482afb9dd0870ea64a50a029a6f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702068, "uuid": "42138d12-881e-4436-bf2c-d99dcb41c660", "comment": "Malware payload (Dridex)", "value": "267863a19964f88d8e3dde3b7bd755a01397fdbd3a2f8561f9a1ce990621760741ea2371c076f1cb5ebe402bf8568f2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702068, "uuid": "8f440c9b-6700-4d4d-b5b6-afd6a3ab47a2", "value": "D5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702068, "uuid": "e7c50884-d28c-4b42-8bbc-a1f18f1edc1b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702068, "uuid": "06d2e81f-9f86-40b1-bcef-ec262fa80d46", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702068, "uuid": "f8e97869-362d-4506-a6f9-5855ce2ed10e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702068, "uuid": "bd3c2a04-cbda-4794-ac34-438f3c2b65f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702068, "uuid": "131783df-2e2a-4e67-9190-115b8d74a2f4", "value": "c79653fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8016cb2f-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717258, "uuid": "2ba16865-ec36-4e1a-9611-7a178c1c4470", "comment": "Malware payload", "value": "8d59535a990550b19043fb4f1464691b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717258, "uuid": "97ee9c30-d6fa-4eb3-b63f-a049844ac2e3", "comment": "Malware payload", "value": "25d46c1dd0621d4e7e3fb8bb122cb671c61cc1669dea64494bbcfaee936b170d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717258, "uuid": "73be4dbc-a544-4035-bd3a-446de9eaf380", "comment": "Malware payload", "value": "178ce6e56882fcb19a846327512465d7d735b072", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717258, "uuid": "9214291f-9ca2-46db-8608-c0fed1c1f935", "comment": "Malware payload", "value": "c855b970acf4e07381bd47779ee56d45a5cbee565e69c0f151fc510f46c318112fa19bee04d8a7a84de4d76239a49a84", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717258, "uuid": "b0d0b36d-0672-494f-b23e-433de6708922", "value": "F024F8D9B6927025C362B4F4503F000AB2BF599AF4484DACF298D8E16DF8949427BF7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717258, "uuid": "f566aadf-e936-4401-903f-89dfadc7130d", "value": "3072:fOB1UfLgA3IJUp3PsOL7m2sHg/5B3wAAYcwtqthzaKz9/65C+PoBfD5Y:fAU1Yuf3m2WyHADwt+gC+PoBftY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717258, "uuid": "040d0637-13bc-4ecc-b26f-d8400f14fbb4", "value": 212194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717258, "uuid": "ae0bc090-ee39-4e5a-b357-f638dfd4b3d3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717258, "uuid": "f2587956-6d24-4d4c-96be-6518da560864", "value": "cb_gapi[1].js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396997af-b294-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620763525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763525, "uuid": "87760560-a808-4e21-a6f1-424e4ccc04ac", "comment": "Malware payload", "value": "7e47a74dcac91b969936598c813a8dd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763525, "uuid": "0cf662c5-8ee9-4525-aed7-d54b9b26fcd6", "comment": "Malware payload", "value": "25fa4f445a522467a2ae93388907c9d7ef7e14a68bc3a0db7ae29198d3abfe06", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763525, "uuid": "8809bff4-bf9e-4443-b89f-ebdc547392b9", "comment": "Malware payload", "value": "e4bafdd0e911e6dc0f5cf7c8e621a08db19c57c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763525, "uuid": "47376f03-e34f-4b60-87a2-d9b08e3dda7d", "comment": "Malware payload", "value": "324aebb6ee81200f184ac9f003b78defe1aea1a12c99d9034e97e951c82f110956c71d84c90636e93ed9ed53f875c381", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763525, "uuid": "31935263-7e80-41b2-a5f2-f82281b15ddd", "value": "E0756B3568DB65BEF23B7EB02DCC3CD68C99F9735628606766444337EA40A80CE2957C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763525, "uuid": "08801483-420a-4928-9a7f-25237a6e034c", "value": "fadac24313d02cacf364c6b14d22b0e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763525, "uuid": "903247c2-45cf-499b-8866-8b2089d2cbe6", "value": "24576:J5JiHUEWTnziXSWkm6GpKXclGuz3u21KsH2hOiSXNB+1:0HUEWqSTm6ilf1VXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620763525, "uuid": "a570041a-3187-4d05-8ce0-1f7e460f132a", "value": 1580036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620763525, "uuid": "0ff8c156-89f7-4af9-8eb5-92e1bbc32308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763525, "uuid": "aa6cf841-f9a2-4160-ae1b-f4c73be9a276", "value": "7e47a74d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7298c6-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702062, "uuid": "22a71ef2-b4b1-463a-ab9e-38e9377475b9", "comment": "Malware payload (Dridex)", "value": "5cc5825d30cacb419cf0c8f5fba5feb3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702062, "uuid": "6381e014-6a86-4c89-96e7-81bc160b9a19", "comment": "Malware payload (Dridex)", "value": "266c15dd14a51a0096e7a1deee5f5471e438ca86ef2746e0f05bea469bf5391d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702062, "uuid": "b503d697-8159-4fee-8572-41cfa4b492d6", "comment": "Malware payload (Dridex)", "value": "71696e5a76d3f199e36ea70cc58246729f1f744f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702062, "uuid": "ef1ce5b1-45b6-4518-ac8a-93fdf1addfae", "comment": "Malware payload (Dridex)", "value": "392bc8069e6afdcfe9199c3fc468b509da094061bdb47cb680f4ae741a12f846c3d7da6fae485ec3eb7b1d0920f35223", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702062, "uuid": "e23817a5-66dd-4d6f-86ce-881113f271a1", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702062, "uuid": "01866dd4-635c-4809-9798-8258538cb29d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702062, "uuid": "f83c9a95-36f1-440d-8114-ceb062ce277b", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702062, "uuid": "b1fed783-8dec-4b39-af05-092968743a1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702062, "uuid": "06a27983-1497-4611-9527-35b1c0de38ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702062, "uuid": "720814a6-1d55-4f98-b598-49dac96e1c17", "value": "5cc5825d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73befdf8-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735705, "uuid": "6a9274a6-12d5-4c98-93ea-db88b902cad3", "comment": "Malware payload (AgentTesla)", "value": "8c817545d7ba60333a000ba5ce565776", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735705, "uuid": "88fb97f2-4a8b-4b9f-b6ed-2b5e752f9cd6", "comment": "Malware payload (AgentTesla)", "value": "26799266072f7aeaf11cfe54773cd3f387dd383bb8900cf1708a8db00740d101", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735705, "uuid": "068cd171-af45-4eaf-b3cb-0025ffd61f19", "comment": "Malware payload (AgentTesla)", "value": "e2c55dc26dde7b0e07b950d9753ccee89d0216f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735705, "uuid": "a8d7086e-1a11-4906-bd3d-761914f39511", "comment": "Malware payload (AgentTesla)", "value": "d03f95f772013f0f20ceead93e82941451549482e4f23c87c57883a8a04e9c5eabc2d17eaf36b36cf5677b7843721243", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735705, "uuid": "271a033e-6bd7-468a-909c-42be210ed6dc", "value": "C3F47CFC751464F9D35B5C23A3CF1C1682241274A93BAA0B9B2103BE5A5BE173E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735705, "uuid": "f9784699-b40c-4af7-ae75-b91d14276a10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735705, "uuid": "6c255d26-16ec-43ce-8693-cd5b1842fb0b", "value": "12288:loLLoS60/K7yh0whhMw6KxwDn2iK4Ao/0icSN60PeyoQdX4YcRc:loLAwF6M6nzKe4SNjWyoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735705, "uuid": "187ee6bf-98c5-431f-a3ca-2937d765c6f5", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735705, "uuid": "98133d8e-01d5-4144-aff4-9ce0381a800b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735705, "uuid": "533ad5db-1786-48cd-9328-b650763a356d", "value": "QUOTE B1020363.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea97c8de-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691237, "uuid": "26913560-b093-43e8-84d0-05feeb4dca50", "comment": "Malware payload (Dridex)", "value": "64d34242bbebb3a3761bb2973c826ee0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691237, "uuid": "5a26e53c-fd70-4556-8012-360ce7e426da", "comment": "Malware payload (Dridex)", "value": "2729e1b62e80d9bb6d6606deafae9407fb3084516e6c1b9cea8bee86e3718a45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691237, "uuid": "9942f660-8f74-4cae-a41b-e2550761ff9d", "comment": "Malware payload (Dridex)", "value": "8615f4d6d2a19133db68a827d171e1aa92a9b48f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691237, "uuid": "d348b52a-cf82-4fd5-b334-d4d2f03b30c4", "comment": "Malware payload (Dridex)", "value": "8a7b0b86961dd854edbae2df45599c41e563b61a95b0589836acbf0d4400ce4595cef52dab7109569580650e55519436", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691237, "uuid": "06c0f1cb-10b3-4120-8f6e-7b8d972c0340", "value": "6FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691237, "uuid": "ba5e19c5-62cf-4a70-914d-89e3496804dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691237, "uuid": "78d32c46-7a15-4532-98fe-9fcbf63f1ccc", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691237, "uuid": "236dcc42-1cf1-4961-9ece-b3a3651b7604", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691237, "uuid": "b340bc33-1dfa-4d3f-8afd-3564d371f08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691237, "uuid": "8d648b27-c463-41b5-94cc-0f938ee89afc", "value": "64d34242_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1699e4ab-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715363, "uuid": "868f89f4-e796-4dd4-820e-79ecb633a6db", "comment": "Malware payload (Formbook)", "value": "0d66dea4dc9ed5759392da9d64ee47fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715363, "uuid": "6a8f4838-5642-445c-a0b8-ce4bd3cf8a82", "comment": "Malware payload (Formbook)", "value": "276d33f672db408f43ce953f0c1c42a46af0b50d8c24cac95d86fef7787246bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715363, "uuid": "92b27170-cc90-47ab-acba-96d468235ab0", "comment": "Malware payload (Formbook)", "value": "d9c73c6da9490fa54ff144778cbc564fbb8ca989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715363, "uuid": "507f4055-75dc-4868-9fd1-cadf7731dab4", "comment": "Malware payload (Formbook)", "value": "6e301cc921963e4a8e029815e3ede923e44b33895ca86f669ffa87519f733778bd357ab511d3506937ea8d3fdb24c49e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715363, "uuid": "a746003e-d1b8-4c87-baeb-0e936089b5e5", "value": "A3157DE87144A8EDE2471C7367CF4C11412426B9A53B9A0F2752273E59ABF133D3AACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715363, "uuid": "c68b09b8-d770-43a3-8524-b1cf8edde721", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715363, "uuid": "7fd81ecf-9e73-49ee-b6f3-ce30888ab7db", "value": "12288:/yoLLoS60/K7yh0wV4kOh5ugD3TSuefryPodFEW4TPaFjqWSseHXGSityjK:/yoLAschxD2vTyPod4TgGWRdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715363, "uuid": "a5135787-9d1e-4961-be86-b4f816d15d52", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715363, "uuid": "9516e50e-44d9-47aa-a068-72d7c2b0a4cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715363, "uuid": "cdfcb65d-854d-43e9-9d97-44a7341b81a5", "value": "New RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6acd24-b22c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620719184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719184, "uuid": "c991b00e-a1c5-4046-9bef-29228d99dd97", "comment": "Malware payload (AgentTesla)", "value": "ecd2ca9a3bb12f5536705b7e4fe2fcda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719184, "uuid": "2eec8b0d-2cfa-4f7f-a0a9-8911dcd3684d", "comment": "Malware payload (AgentTesla)", "value": "27985ef546ffd6c9239b45bce432f59593c54591d3c2c306ffc5b485d02cf03c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719184, "uuid": "2a023b16-e7a0-498a-af7a-420af37bf3d3", "comment": "Malware payload (AgentTesla)", "value": "6e7baeaf9376e111c49cd0eb4b9b77ed32a41ed7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719184, "uuid": "767a0cf1-c082-4265-bcbe-3a44eff74001", "comment": "Malware payload (AgentTesla)", "value": "86eafec60502e540d53bc1e8e6c3156811aaf1491eeb45a8ecc80aa0c6a60b97142442277a2bff015c01300e8870cf3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719184, "uuid": "a11810cb-856f-48b5-8a42-21e1ad9dd6e3", "value": "A1B42358197339D1981BFF082D7CA60B0539A3C697CBB2CFE1A519A9223E717D3C6724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719184, "uuid": "1f3370d3-f7f1-4c95-bf7a-9225503b2287", "value": "12288:xHSVtT447jXgDYYADWlBd/kfwcs8VwOlzjMol3rAxC6wB:dSP047UD0Snd/gDzjMol3rB6wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719184, "uuid": "2ef2b02f-69f3-49eb-8fc4-aea57cd52894", "value": 533554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719184, "uuid": "d26d97c0-1a3e-47aa-b0fd-bf4e6184c3d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719184, "uuid": "874d8d36-faba-4b41-aead-cd6cc854b4e1", "value": "COPY OF N-N.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31acc4a2-b230-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620720562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720562, "uuid": "d532ee8e-58c3-46b0-b5d7-f40b2996212d", "comment": "Malware payload", "value": "7bf8da9ae283c60e226852fee7ad3d94", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720562, "uuid": "09df2ab4-9f2a-4619-8db1-ddb1fa3f83d5", "comment": "Malware payload", "value": "27ba35dbeb5324bd780ae6a95c5aae93fcb47c5aa8f48b1c21f83000a55de2da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720562, "uuid": "559cd107-8482-4c61-828a-37a428b2da43", "comment": "Malware payload", "value": "ec0e3c599aa82455814f0a24b75853e13210f495", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720562, "uuid": "9e627e21-9700-454a-a00e-b3cc5b858c9d", "comment": "Malware payload", "value": "a9a8beeee7a40821c4e8b9508625a7d8787b646f38e905089d29fed7d7eecb2b53a3b290b1eceb69eb46f942f65c0480", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720562, "uuid": "951f4ff8-6c0f-4a85-ba6d-f8610abb4f81", "value": "C993A104E7FADAE7C38B8AB69C6D1364863075D72738D7F61C8329C416196CD420ADEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720562, "uuid": "1b9a0bd0-18d4-47db-b477-f465267b7df6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720562, "uuid": "980033fb-89c4-4240-89c2-f5db36216193", "value": "1536:16xb7zXiyZKQp5FlUeOFeFamwcjAb5JAn807SEzHa9CImZKaIa:16V7zXiyZKigT0lw5bu+19CImZvIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720562, "uuid": "96f83866-0f0a-4445-a02b-b764fcb1a9cf", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720562, "uuid": "c3ef9032-7956-4ea1-b86a-69d7d1b22f28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720562, "uuid": "dc6f5f6f-a24a-4f30-922d-24b8ff6608ea", "value": "client1122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeab7c66-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691244, "uuid": "b40b4d44-f018-418b-a301-33ff76ac50c6", "comment": "Malware payload (Dridex)", "value": "dd99b278fdfc9e86e882ac76c2318178", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691244, "uuid": "24f54af0-fd7c-4c32-8cf2-d4d4c2253500", "comment": "Malware payload (Dridex)", "value": "27db32b160bf0a7244605af136e7faf83057b0fd63976054844df38881ff1478", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691244, "uuid": "07e734f7-a64c-40ef-b107-c3a91b16d928", "comment": "Malware payload (Dridex)", "value": "8d27d52b7bc14e10528f62e8c849f96eb14bc1ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691244, "uuid": "53611433-ab0a-4a35-8766-1a32ea3220d8", "comment": "Malware payload (Dridex)", "value": "b741d15feda656cf759193091cb15cdbafcf738791cda82b9017880a9d9f9b969d437cbb29a29b7b8b0b1404c1838df9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691244, "uuid": "40e1a5b1-e88a-4c22-a95c-6f9ac8b1ce34", "value": "D1F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691244, "uuid": "3d0fceed-c702-4b99-9872-55420f6aa07d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691244, "uuid": "f083b117-62ee-41df-a7b1-45516d2dcda0", "value": "3072:iWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:i42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691244, "uuid": "ccbcc18f-099e-4e7c-86a2-857e9b094b35", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691244, "uuid": "02ba9bf9-947d-4baa-aa3e-0a35170e3779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691244, "uuid": "f6bc9ee2-cac3-42ab-8c67-b3f507ef1aef", "value": "dd99b278_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d104117-b299-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620765813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765813, "uuid": "8aa88cab-3179-425d-9030-16b5029b08c7", "comment": "Malware payload (AgentTesla)", "value": "e997628c9a564e871b85c85014a22228", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765813, "uuid": "5dec0b86-c37d-40bb-93dc-a8b5edd109da", "comment": "Malware payload (AgentTesla)", "value": "28dc4c4d2a9844f137573ba7f110608201f6860b966186d7e38e4e42b484c145", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765813, "uuid": "10afadbe-1e17-4d0f-abb8-b084735fa5b8", "comment": "Malware payload (AgentTesla)", "value": "d8a62eadd5bafda3b736204871a2782e3e5af3f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765813, "uuid": "4bb90547-5cd2-4b58-92a0-8feb73f6e52b", "comment": "Malware payload (AgentTesla)", "value": "7b0b7ede4d3788ba8595a9e719af32e1dfee23ccfa756db191642f0b3224f8725568e18a325f956487c5bd536eb9cb2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765813, "uuid": "29354cae-a8ae-443e-ba22-65cc58f0ba0e", "value": "44F5D331379F555D3273A9CD4A08B7ED4B87FBB262BEB6529404401B0FA0E458F71B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765813, "uuid": "2ee42b97-79a1-43b9-979a-fe61a00e2ed2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765813, "uuid": "dac3cda5-08a5-4e28-bbdf-741a7cb5b2cb", "value": "1536:Ibnvs58xCWI3kRbKCamv0lmtcBnjm+0+7Im2eti/q6S1yu3m+7jxCo11mjozm/mi:I7Oqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620765813, "uuid": "ff0f9202-0679-449f-a02f-592fe51441bc", "value": 3471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620765813, "uuid": "d32b48fd-188c-4c0d-a3c2-df92c49b8331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765813, "uuid": "65f98131-0e28-480f-84e3-96aa84de70d8", "value": "SecuriteInfo.com.ArtemisE997628C9A56.30254.23301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc50151-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620694920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694920, "uuid": "4b3707eb-2f8f-4f43-b705-bb3f27db1b26", "comment": "Malware payload (DarkSide)", "value": "223431c08d2c6777f1c322b83c549169", "object_relation": "md5", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694920, "uuid": "3f04f107-3fa8-49d1-a485-9237756eab62", "comment": "Malware payload (DarkSide)", "value": "292957f5f4838bf6e9fd7fbdb3b66019a22e0c9ed87d83f53c80abe4354d3333", "object_relation": "sha256", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694920, "uuid": "808b8f1d-dfbc-40dd-aeb8-ffde8c050902", "comment": "Malware payload (DarkSide)", "value": "0e53ae6d6f1cb02ecc8f18b1ed3f6cb25ea6e093", "object_relation": "sha1", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694920, "uuid": "8e82d40b-255a-4966-9474-6d779cdf4bfd", "comment": "Malware payload (DarkSide)", "value": "2edffb3bf9028104e5b91bd5dadc2e888ba9971ff81f37312f85248cda9bf97e5373686bab26646abd326494cd4b514a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694920, "uuid": "b1296f81-01f8-4b8c-9ae2-e1ec65527424", "value": "79E2E1815DECB3087ED68881959A82F46639FD260F8510A89B1EBB2DF74F54CF1C7C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694920, "uuid": "e00c66f8-c31f-411e-bf05-f779871e9a67", "value": "768:9u8I31b2W3Xfgn44WM2pF3JZ//zo97XG6Z+uQnw3VKn:oZBdfgn4vM2ptw7Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694920, "uuid": "49e2d4ca-15b6-426c-ab2a-832ad5d9a632", "value": 32772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694920, "uuid": "c94e9e52-9568-4557-ba8a-e75cf9a9da8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694920, "uuid": "a8c83e63-a3b2-4f8c-9e1d-9e2036fdbb5e", "value": "223431c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84814396-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Avaddon)", "timestamp": 1620715977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715977, "uuid": "5bf94786-27f7-49cf-8a95-22e8ec593b5a", "comment": "Malware payload (Avaddon)", "value": "350521f299692dbee4591f85f19143c4", "object_relation": "md5", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715977, "uuid": "da2ee7f3-cbe1-4a3e-b1e0-1b0b55707080", "comment": "Malware payload (Avaddon)", "value": "2946ef53c8fec94dcdf9d3a1afc077ee9a3869eacb0879cb082ee0ce3de6a2e7", "object_relation": "sha256", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715977, "uuid": "999be72e-9fd6-4e8d-b29a-415d5365599d", "comment": "Malware payload (Avaddon)", "value": "f540a1f2fdc0670e1a7a3d55e335e70ebe3089f7", "object_relation": "sha1", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715977, "uuid": "6bf7f844-e4ab-4d09-a27a-10fe632790f6", "comment": "Malware payload (Avaddon)", "value": "ad3645c11b70b12b16e1969110b55e7171d8b90a8fcb3e9a8ac135785a3035675297333492b7eb2136661a24c350b9a9", "object_relation": "sha3-384", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715977, "uuid": "22b5653b-5e7f-4de5-a1fc-7a91d8caaf3c", "value": "FFD48C323882C07AD5B211704D6DFBA592BFB8254F3305DB67D42B2F4B256E26E31972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715977, "uuid": "9cf78d0b-adb2-4b64-be6d-b38add0e6006", "value": "e15c2daaccfe6a7ca2dfd830c9d93c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715977, "uuid": "fd19bf04-b4a3-4055-8d5d-933ebc8a7d53", "value": "12288:q+G6OUghWxfwd3LRjxU/9EyoQcQwDYttYtjPCvw3uVAjAKtTus6lur8T5:fMwxSllU/9EyCQwDYttYNadVAj/ttrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715977, "uuid": "d618057e-7790-4794-a0c8-c50a47d371b0", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715977, "uuid": "8b1000f7-9216-495b-bad9-cb8acb51b847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715977, "uuid": "2a16f089-5883-45dc-b241-d771140392c0", "value": "2946ef53c8fec94dcdf9d3a1afc077ee9a3869eacb0879cb082ee0ce3de6a2e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbdeb28-b236-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723290, "uuid": "6856cfe7-0c91-4988-9404-453c9ed617ec", "comment": "Malware payload (Dridex)", "value": "a585986dfd2fc4822937a0a195190128", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723290, "uuid": "73911f12-e0be-4048-95ab-9d2c9fbd7c8e", "comment": "Malware payload (Dridex)", "value": "29adea22e2a8a404d44cb32836b9ffabf5ea3bd67c94e7ed0a377675a42271d9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723290, "uuid": "cc026bbf-6132-498b-a65e-71a587a2de02", "comment": "Malware payload (Dridex)", "value": "f619933e2c437aa6851ec6d3eaa3c3476e4176c5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723290, "uuid": "7ce6b857-6520-443c-90b7-44258e869389", "comment": "Malware payload (Dridex)", "value": "d73bc86ea47a5692eaf708da7ae80d042c221deb7cd12e1141e643bb6f85541d23993af624d3c2e25ef113602cd9eed8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723290, "uuid": "178e2c38-d8c1-409d-8c0b-467f3f3e2b1d", "value": "EDF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723290, "uuid": "2f7b4082-7cf2-4f3f-804c-d02b98bbb86a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723290, "uuid": "e1e302b2-b08a-4b37-a27e-b18b23e642c1", "value": "3072:lsmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723290, "uuid": "3f9a3c48-03d1-47b4-85d5-3bc92d49b492", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723290, "uuid": "2efd17ed-88ed-4430-b593-44e2334831d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723290, "uuid": "7f67a575-f65f-4573-afed-379f6d69d52f", "value": "29adea22e2a8a404d44cb32836b9ffabf5ea3bd67c94e7ed0a377675a42271d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f646ec70-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691257, "uuid": "3e9118f6-fe91-435f-a9e2-33a92ad59917", "comment": "Malware payload (Dridex)", "value": "67a471f4cf5a9b7c697ad3710115a113", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691257, "uuid": "f512ad7f-d062-4c8c-a8ef-bb02aa66749c", "comment": "Malware payload (Dridex)", "value": "2a417e2bd57a06b41b423addc584acf96641dbf06b98c8813878b33fc1d2427d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691257, "uuid": "6a99c24b-7c41-4c7d-92ba-bf35a9704997", "comment": "Malware payload (Dridex)", "value": "3a4ca8fb4e0282a06d23220d90c267c0d80c0960", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691257, "uuid": "4102736d-45a1-4220-9894-417560eedb8c", "comment": "Malware payload (Dridex)", "value": "9e1f52c119530812bf5524ae928eedb9e69ea683db46e50c61b43784b0926fe3b6fc0d18ced0cd578076f365f17236e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691257, "uuid": "845c896d-af1c-4f49-b750-d4e53d73a96e", "value": "DEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691257, "uuid": "bf58cd2c-1af5-4667-b3b0-9a24829a97b3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691257, "uuid": "a9722c68-f12e-4e4b-9534-90aefb764d1a", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691257, "uuid": "09274fae-4de7-4609-8eb1-2c3e32588b0a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691257, "uuid": "d178f874-489d-4dfd-974f-42d6870a573c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691257, "uuid": "7d242a6f-1e28-4555-ac97-2e8cc18da391", "value": "67a471f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef54af3-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717175, "uuid": "da0f496c-f6fa-487c-a644-c1729f915ca3", "comment": "Malware payload", "value": "b84fafbb835c20e62de5a658cf6dc0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717175, "uuid": "ff83f011-caaa-4cdd-b296-e18980927103", "comment": "Malware payload", "value": "2a479e0b285c52427f3c318b26ff02e82b205d85c6567956fa6eeae1ab8be235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717175, "uuid": "c3ae0e5e-8506-4e6f-9eec-9c1f53aa3425", "comment": "Malware payload", "value": "1570268457f671e088ef0fc3d590f8c16605b83f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717175, "uuid": "47adbb4b-d384-4a90-bb24-cd6ca63b6fa3", "comment": "Malware payload", "value": "551f7c93ccbcccbefc8e79a81706e966a947ce2af5439435b7f9de8825e969628f7c2113f340648e8e70b1e61825ddc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717175, "uuid": "f61c4f66-222c-40be-ac0a-2bb61e4e3f4a", "value": "96F208D0BEE440B9FBE1123864EFA45EE3BC67195C23CE3F1D85144F26622A905A1B7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717175, "uuid": "1075bc01-381a-4c75-82ed-a6c6c7caa2a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717175, "uuid": "6c035645-12ca-47ff-ac29-331485d0ce0b", "value": "384:wviqseb+7lVKFLEF7HgcGH3gVQT1H6LP3lBYp7JI8Ed+4lBxSXDSX6SXhgSXSSXd:yF+WLNXQWZHoVeNEYehFJaH4x0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717175, "uuid": "91273672-a54b-42ca-88b5-e0fa633081b4", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717175, "uuid": "65a2bcf0-573e-43f1-9e60-681ccf747c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717175, "uuid": "5f224801-2afd-4815-951c-1e58128454a3", "value": "b84fafbb835c20e62de5a658cf6dc0c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fae74b-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705701, "uuid": "00f2dc8a-5389-486e-b9c8-1af751cc2e15", "comment": "Malware payload (Dridex)", "value": "aa0d6b3ed3aafe055a821b7fdbf7682b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705701, "uuid": "24cc07ff-4c10-44e2-ac05-4438b5e75fb3", "comment": "Malware payload (Dridex)", "value": "2a62ea762104527bf90971d9dd3b2017d6399529a678a7e805c4b7e593bd9d0b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705701, "uuid": "acc6ebc2-e93a-4731-ae02-7b9064543162", "comment": "Malware payload (Dridex)", "value": "8d09b2a96a883f698409eb434d7853d09b635af1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705701, "uuid": "9d0e33c6-ed73-4486-b65c-95e4a106cfd4", "comment": "Malware payload (Dridex)", "value": "576091c27d27f502a68c19b849097d1e0aabd8b5ef8121c3f2e19ab66909a5019dac70c1575dd78e97aa743c954ee9ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705701, "uuid": "20b1fa98-67c7-4621-9b27-65cbbce96ad5", "value": "94F3D0906A9BDF0ED9C13CF96A96A879B173458C821FD5B4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705701, "uuid": "1be147d0-78d6-4bff-8765-2c5d84664ef7", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705701, "uuid": "add1fb9a-4110-46ce-b8a5-bd969cacf857", "value": "3072:Fesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLUO:h4+VZQpt5hyPsa1ekiEnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705701, "uuid": "e9bc9450-0092-46b5-943c-7401336e7c4a", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705701, "uuid": "db846066-6fe4-4d7b-a0e1-cb3d491af31a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705701, "uuid": "99c31fcc-2f90-469a-b69c-54829c8c2430", "value": "aa0d6b3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3288685f-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715410, "uuid": "860d64d0-eae4-4e00-aa95-538eb61094f0", "comment": "Malware payload", "value": "737f8cb6d8c545c791e2874a951b3029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715410, "uuid": "0d0caf0c-67c0-4d1b-bc7b-9acf9b1e69b5", "comment": "Malware payload", "value": "2a73b4f5841deafcc6de9fe21de10a7af87cebfc3e54a2c2e64107a9e3585bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715410, "uuid": "f994c003-8fca-46b3-948c-968c3a1dc070", "comment": "Malware payload", "value": "658fa5dba0e4b42fca1d357d8fb9ebfc69870c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715410, "uuid": "468f78eb-2049-420b-92d1-c4e942834be8", "comment": "Malware payload", "value": "daa0a34ef5d49f81ea9a6c6240c3b52bd873c5de1f701e0d7ec6527a1c65745d6175fcf2f8aa4b64f5e9adc48e343441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715410, "uuid": "c3ad28e4-5f47-43ff-87d6-ef513fe46c1a", "value": "2DD5F111B501803ED8A180F19EBEA5AA263C6D24034969D777CC3F695F315E32B3EE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715410, "uuid": "455db019-bec1-4331-a067-a9d13f989634", "value": "eceefafed12e603ad76214db57e488a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715410, "uuid": "a16fec49-18a1-4383-af6a-83b60c059eae", "value": "49152:z7iM89KmMKjo7MtNiqJYDjnyc7izPDHPHtwYJugX:zefhjo7MqqY/nb7izrv2YJnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715410, "uuid": "22e58825-3f6d-4e75-a43a-180282bb8bae", "value": 2797568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715410, "uuid": "80594e69-53bb-4ff1-85a9-693537ef8b66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715410, "uuid": "dda9953b-3e45-46a0-a118-8834f7de1652", "value": "\u6bdb\u5229\u6838\u5b9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb36ce42-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709277, "uuid": "8f391d62-e256-428a-a7f3-cec23defc43b", "comment": "Malware payload (Dridex)", "value": "1b4aec5a2041d3ec2d87880eb2514689", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709277, "uuid": "67ce85aa-1cc2-487b-b590-e33130b0379f", "comment": "Malware payload (Dridex)", "value": "2aede5e1ec0af1ecc6f6a4b977cf17d6471b668b96b87f2ea3c0dc10cb02f49d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709277, "uuid": "480b63c7-4972-42fb-9f6f-7d55a061efdf", "comment": "Malware payload (Dridex)", "value": "6618f37d17d1ad492aee70892103af5ad9807eac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709277, "uuid": "8adcb293-5472-473b-8111-adc7e02dff1b", "comment": "Malware payload (Dridex)", "value": "63d90f53bb13b433ebe1cc101c69e610a3d5a5d55a85ed43566186842525ca013b8fddceaba58dd86bc0162093ac435a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709277, "uuid": "f0a24663-1309-4f63-843e-5660f2c862e5", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709277, "uuid": "bcbece5c-3cad-4ecd-9d81-28039e5d3af0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709277, "uuid": "db7fdbd0-d187-434f-86d3-cb649b77eeb7", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709277, "uuid": "33822b71-6486-443f-acb4-d438f6f258cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709277, "uuid": "5331d78c-fea7-4c2e-b416-a26df7f0d60b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709277, "uuid": "7efddc0a-f8e3-4424-b802-d3b6e12ec6cf", "value": "1b4aec5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f84741a-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716398, "uuid": "2b545a1a-3191-4b4d-8e78-b410503dd5f5", "comment": "Malware payload (AgentTesla)", "value": "bb58b387028ba35ce479b0b55c25b153", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716398, "uuid": "9784b744-eb55-4728-8101-03fb7fd1a263", "comment": "Malware payload (AgentTesla)", "value": "2bb4af3228822a7626e5bdecf1e29bfe80c99a3e55a851b19197490d13df4cd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716398, "uuid": "30f73c3f-1b1c-4056-bce2-255cde8b52af", "comment": "Malware payload (AgentTesla)", "value": "08f5824295d39f26376a5bf85b546e6c6c92abe5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716398, "uuid": "e2443aa1-ee39-409b-a3d1-864ac7057994", "comment": "Malware payload (AgentTesla)", "value": "e707ed2d654acc459ee6bf4fb34b06db410f257ae64fe18fe5afff543ef3c5c9aa9b1223c2aabed2b676a1a9dcd74edf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716398, "uuid": "85ebca2a-d9b7-460f-ad8f-e53c0a432f31", "value": "B505237792CD5D4BCABD08F94092644405F29297B653F39A3AA493F444C73EE8B823F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716398, "uuid": "6385cc40-1967-49d6-8419-a2df67b59acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716398, "uuid": "1b41cf3b-9ac5-4ef2-8e8a-6269aaca2ea9", "value": "12288:tXkCkhDEMFWMOH3n0XWMUxbfc4D2cKkD+1G8bCTLx3eJUbxlN6nRKLZH/PcAKSz:MAM8D0XXUpf5D2czhVOmNmRGZHncAKSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716398, "uuid": "2727d6b6-0936-4cdb-93bb-edcd1f17c339", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716398, "uuid": "cb39b685-d1ec-4bc0-8f5e-8a7ce587a557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716398, "uuid": "44aa7006-3bf0-4ddc-971c-27dd5eeeff4a", "value": "no. ETC-20-3049-R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d356dc9-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620712126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712126, "uuid": "6414fa05-f7b7-4651-9056-9d2f48dd7b0b", "comment": "Malware payload (SnakeKeylogger)", "value": "184efe933dea393f4e31cbba9341dfc5", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712126, "uuid": "a7afb72d-c6d1-4937-bd1e-79d189f3f845", "comment": "Malware payload (SnakeKeylogger)", "value": "2bc19785389e21344ac423c5b34fea5c13bf9f29027e427087f019c7e596ff83", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712126, "uuid": "32851cde-4d1f-4253-a4e6-5a7d08c40be1", "comment": "Malware payload (SnakeKeylogger)", "value": "adf5f68e1aef9930a73bf6050cad02b8fa8e570d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712126, "uuid": "e8c5d76a-0f91-4461-949f-84aa3833f4e7", "comment": "Malware payload (SnakeKeylogger)", "value": "8778294f6105dc53ab48aa61bdd9a15cf82389835d8bdf9860c680b7084b4e6d6d4f97cbafa33d3a59ce53146bbcbd4c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712126, "uuid": "ba6a6c25-4dd4-4d64-8d07-ce9c6de16c81", "value": "E9E5788674B8F03EA1BBCD6A827076CB1FEDF311753959CC61D0B306D5A06826D8B726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712126, "uuid": "ad3540bb-f7d8-4f17-b9e2-42374b62582d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712126, "uuid": "beb88f6a-43ce-4a76-88be-05fccd3019c2", "value": "3072:eQkEUO7H2sJeNStVaE4w2m3gzfe0EdKgdmjFVSS6FyiEltF+U5nZzLmbEXDbORDE:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712126, "uuid": "04de7e82-6ef0-477a-8779-531cbed13604", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712126, "uuid": "a3165fd6-0c09-49ea-aa0b-0f15a5aa4ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712126, "uuid": "77b892d0-fb78-4438-8b0d-fd4dd7b6cda6", "value": "Original Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c81a294-b200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620699911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699911, "uuid": "518a75d1-a04d-4738-b46c-b98d9c5a88b9", "comment": "Malware payload (Loki)", "value": "5b54051b8bd7aee49a72d7f94ef1aa0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699911, "uuid": "fc682792-7cf6-4901-a772-e0e5541ff33d", "comment": "Malware payload (Loki)", "value": "2bc34cf2725ceb0a4b515b050e12ac17fdc20e8605fcd602f766397a4ead7f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699911, "uuid": "24ce2d09-0ec6-43c8-8a27-7460087a665a", "comment": "Malware payload (Loki)", "value": "37d8609cf0c39a08d66c3cf783d09a47bf1a6a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699911, "uuid": "a19ee72a-0a37-4a59-aa99-ed7f186e1dd8", "comment": "Malware payload (Loki)", "value": "1c56bde3b4f421e5bf85cc32fb385b84b62863ed169ac053240f815ddd2aac4041a4063e8350fb67146329fc231d76a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699911, "uuid": "7f33873e-5eb5-4e7b-a147-2c8c170778c2", "value": "9BF4230333C9A728D4FE67B2D5522C151BFEE5426241EBD97FC1A0A99593EC0DAD12C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699911, "uuid": "abeabf20-0d87-4a27-b0b8-b40633a1c6b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699911, "uuid": "52f572ce-e0e2-4f96-804a-7935c204e76c", "value": "12288:HE2yibQiCB7owwv3ZJrPsWfabA3a+UaThN797OXeIU6oVoIAA9mCi/lC+KsBXfuo:274v3DbV3a5aX70GVoIA//lC+9JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620699911, "uuid": "99e01839-f16e-4970-8493-9141809d0e41", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620699911, "uuid": "3d90e666-4313-41c1-975a-66935898096d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699911, "uuid": "d3cc5ee5-142d-400b-bc66-147e6085ae75", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94a1bab-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723769, "uuid": "07090843-39d2-49a4-b6e8-757d1cfed523", "comment": "Malware payload (Dridex)", "value": "eabe2a90cc051d2ae720852711867a44", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723769, "uuid": "62c72a66-3c60-4f3c-87f9-30e40356636e", "comment": "Malware payload (Dridex)", "value": "2bd679228ca2b0ccff785ccb0fc9488debc0802e0380705b073d6d9b7888cfdd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723769, "uuid": "0ca011aa-6b49-4ef9-a5fc-f60eecbf4236", "comment": "Malware payload (Dridex)", "value": "787378d000a233bf0b581221ace8783cfcdebf34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723769, "uuid": "97768936-700c-412d-8e78-0f2459f2cc00", "comment": "Malware payload (Dridex)", "value": "e8ef9e3dc64d5ddd0d0f0be071daaaf2371866edacd4fc7b45cb720d581b6ff1f72308128f2eadc88eb0a219ec90d24f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723769, "uuid": "6cca69dc-eb6a-4432-a0b9-9f5e2b2177cf", "value": "D1F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723769, "uuid": "b84902ec-0ce2-4c37-8cd4-2e5f71a2a077", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723769, "uuid": "b24f7480-a32e-4e2a-81d6-a727c1190869", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723769, "uuid": "b1e4612c-78f4-4dd4-8e19-a2a00e66445c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723769, "uuid": "a6a02774-70ba-4c0c-99f6-89ef074e4764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723769, "uuid": "0f4932d0-b1a9-4118-8648-07bc03d8fedc", "value": "eabe2a90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e60351-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770575, "uuid": "7567e4e3-5ac9-4f9a-b1a9-72b708125ef0", "comment": "Malware payload", "value": "96552fa6049c2b417960d93074fd1498", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770575, "uuid": "b0400f5b-df8b-455a-bf8a-dcb096b85219", "comment": "Malware payload", "value": "2bdac531f1041beb1f17310583cd055023e39318389fdedeaf53a59d71925c90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770575, "uuid": "f88b6ce0-391d-4d5b-84b1-68a168594bfd", "comment": "Malware payload", "value": "9beb5aabc8e2e995ac0bcd121f3e4aca2a7e7be0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770575, "uuid": "c17d4c3a-62d7-4d4f-92bf-21fbf3b7ef46", "comment": "Malware payload", "value": "a8f5592a409bde5c43665881d22cf085f9d1c7691b2c19a2ae251a52d38a0537c8966b51ca4afd8225c3d1c0f4d8a3ae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770575, "uuid": "4de35b03-1ec5-417f-9d54-95d0223a8e6a", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770575, "uuid": "aa284ef6-d589-4ebd-b095-2561cd4858ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770575, "uuid": "36c91bee-e2a3-4d74-8991-39fbf429a0cb", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770575, "uuid": "766f85dd-e0a7-44ff-87e6-fcf807304c9a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770575, "uuid": "5cccc075-a465-4505-b615-da9b9b194905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770575, "uuid": "47f5258d-e05a-4056-8e9f-819a5cd76332", "value": "96552fa6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099190af-b239-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620724360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724360, "uuid": "313417ed-e75f-422f-8599-5eb6fe95c753", "comment": "Malware payload (Dridex)", "value": "0c30f94980c9527a4aa7ba5ca529b23a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724360, "uuid": "34c15b18-b0c8-4cba-bdff-a51ef7c030cd", "comment": "Malware payload (Dridex)", "value": "2c1900ee8867084e1d0088422b58ac6d8ef7a6dc79634bf834657dbd67b66e5d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724360, "uuid": "e53e72e3-a719-4f01-bc4a-2e13f31f5667", "comment": "Malware payload (Dridex)", "value": "6535ebff182c184b19188ab4d467ea8166bc4580", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724360, "uuid": "71e5252b-20fc-4a55-a267-ce985362b31f", "comment": "Malware payload (Dridex)", "value": "88c0b363005047a8ac0879d4e043ffda0b9ec617f7ff39f2e3826c144346896a65eedaa3aea0a84af589155aa590dc8c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724360, "uuid": "871d23e5-b375-43e3-a37b-d05c7cd7d8a9", "value": "3AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724360, "uuid": "a8ddf0f0-3fda-469b-8962-1344ae0884f5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724360, "uuid": "56aaf61d-1c9f-4588-b196-a7cef24c6daa", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724360, "uuid": "284a439f-9eb0-442d-881b-734e3b12e6c0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724360, "uuid": "d7b50ffc-6cee-4981-b1cf-ba30cdf8e27b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724360, "uuid": "5e73f0a7-fbcf-4b78-aa28-628b2e72237e", "value": "2c1900ee8867084e1d0088422b58ac6d8ef7a6dc79634bf834657dbd67b66e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f090a35c-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770704, "uuid": "e5040c90-f061-4ba4-b00b-cef9c9c4614b", "comment": "Malware payload", "value": "954601f2181181a4df352dcbc4735fda", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770704, "uuid": "c28eda20-4287-4552-9c55-30778e33ff39", "comment": "Malware payload", "value": "2c2788349dd0f9344a91c60b616d472020798325a83cc1d1087b24f2f1cc5364", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770704, "uuid": "12437a99-ba55-4aee-a468-b6f79b0aa2fb", "comment": "Malware payload", "value": "d4e0db3c364c095f7bc6e0b2fd21557e26259627", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770704, "uuid": "298a460a-fc2f-4101-961f-c482823bc621", "comment": "Malware payload", "value": "748fc6792b8906db126d1d0bc77ed7088a3132e2f4fe33853952b2edb3f690308fe5cbd3f4ab2c5bbc016a4b45314f4d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770704, "uuid": "4416da8c-d0a6-4972-ade0-66ffd84d2980", "value": "99F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770704, "uuid": "cd60b4b2-02a3-4b90-9e9b-dde7ed08f3cb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770704, "uuid": "0a8f7578-bf44-46b6-a918-4c0e638044aa", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770704, "uuid": "0ec491f2-209d-4e06-a7b8-5ed4486993bd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770704, "uuid": "57f04e7e-a702-42be-8482-5a7dbfd02f50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770704, "uuid": "b5dc3b6a-aec1-46ff-832f-a03d3908dd8e", "value": "954601f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4f470c-b257-11eb-abe1-42010a9c0039", "comment": "Malware payload (MountLocker)", "timestamp": 1620737550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737550, "uuid": "766083df-d302-41e3-94cb-125c243ddc49", "comment": "Malware payload (MountLocker)", "value": "1473cd276e116f53bd88e51405e4afaf", "object_relation": "md5", "Tag": [ { "name": "MountLocker", "colour": "#FF0384", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737550, "uuid": "232f47d0-60ad-47c0-a2a1-eebf09a10e32", "comment": "Malware payload (MountLocker)", "value": "2c44444d207a78da7477ae1af195d4265134e895bebb476f7b2c003f1467a033", "object_relation": "sha256", "Tag": [ { "name": "MountLocker", "colour": "#FF0384", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737550, "uuid": "3185d78c-54d7-4d6d-b355-597a39e313ad", "comment": "Malware payload (MountLocker)", "value": "f84102dfe51af18c31bc8b314e8619fe11ad82f4", "object_relation": "sha1", "Tag": [ { "name": "MountLocker", "colour": "#FF0384", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737550, "uuid": "92e6d077-aefd-4143-9913-345428befb94", "comment": "Malware payload (MountLocker)", "value": "afda3e0439a3d215ff0c51d3b2bf83fd151693b089a82d8dccef61819275012afe6aedd834195bf5a34cdf1b80ec32b3", "object_relation": "sha3-384", "Tag": [ { "name": "MountLocker", "colour": "#FF0384", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737550, "uuid": "024b730f-527e-45d8-adf9-26c69788141a", "value": "7023190666F10150E6A24974D9B70DB3A7B7F06460B8C21F329CD1EA5FE33416A9BF63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737550, "uuid": "02da9f3d-8b7d-45f6-aaaf-a41691ee5482", "value": "217f6aa318b654cdee8c94855f889d56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737550, "uuid": "46433087-0162-422c-b6b1-3080c27e34eb", "value": "384:0DHzktyOIPXsQBeM8w6ArVETHToCxVGsq+udKhu4IY4GBZnrJe05VGsYhxlAA/:4zkUtPXsQBqwVreTHTocFudKY3mhav/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737550, "uuid": "bad1fdf6-01bc-49cc-a564-18dbc53c5fc9", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737550, "uuid": "b045e968-10a1-4f17-9625-c6a42876872d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737550, "uuid": "e4d60aa3-0fd6-492c-82ad-fe1e0b82c743", "value": "2c44444d207a78da7477ae1af195d4265134e895bebb476f7b2c003f1467a033.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ae5da-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620714708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714708, "uuid": "840a10f3-16d8-4d06-ad43-0af7797bbfc5", "comment": "Malware payload (SnakeKeylogger)", "value": "9bcbf05e6cb3e2493c515ef212683196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714708, "uuid": "87e68f25-12bd-4fbc-8fdc-fa45fb367677", "comment": "Malware payload (SnakeKeylogger)", "value": "2c4de68aa8963d3b6167000b7624e66de277d60421d101fa1942d0db6a399c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714708, "uuid": "e829cd42-38c7-4b08-a497-c12a7dd603c7", "comment": "Malware payload (SnakeKeylogger)", "value": "222e4bfc473227c5affea1d02a3ae926561903e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714708, "uuid": "5da31441-1ea4-4755-9713-20572b888800", "comment": "Malware payload (SnakeKeylogger)", "value": "7cb13c27d07b66301b664c6c0c40a1bf3461eb57d0dc429f98ddcbf9ba238466f765a5514c17211bfa9389d0bb06c1a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714708, "uuid": "54e9d957-5fab-4fa1-b494-248bba4aad82", "value": "D6056CE87144A8E5E3071C7367CF8C12412426B9A53BDA0E2761673E59E7F133D3AA8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714708, "uuid": "4854878d-5c26-4d9b-be05-12b0497e6130", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714708, "uuid": "7e451a13-b820-43fb-b8dd-f054521dc25a", "value": "12288:8JJjoLLoS60/K7yh07mrwoHBmfwt/Y3PsSh+tEjJp1MBSiyyjK:yoLA6rtLCh9p1MBd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714708, "uuid": "acb4fc2f-3ab3-4412-bed9-7d0dccb09c3f", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714708, "uuid": "a554b4f1-1311-4b3c-8e49-1c9e3366470a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714708, "uuid": "98248419-9736-4230-a95c-4faff8eb8486", "value": "Quotation 68094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df8407c-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694840, "uuid": "47cd31e7-4e38-4432-8c11-88b8412bb750", "comment": "Malware payload (Dridex)", "value": "11964b0307d7f800efd933597394c944", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694840, "uuid": "612cb439-6413-40b5-8f49-efb3b1655d4f", "comment": "Malware payload (Dridex)", "value": "2cf64bd4d6d0b7bcad76fc5ba862c6dd1e627883420d52ba44ccd309c030876d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694840, "uuid": "59881e7d-8db0-4ada-92c2-7870efd51146", "comment": "Malware payload (Dridex)", "value": "02a70bcd948643d9233189fa59a4c7632b45d1e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694840, "uuid": "8befe2e7-88cc-4279-9b47-4842d1945b9c", "comment": "Malware payload (Dridex)", "value": "9aa1bb0042735758bd08a4374b6403e3324780c370cb76ba3be320b37d34bc6a656d0a6aad32dac9b264b6e3c5419c5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694840, "uuid": "9a6d888a-48e1-43b7-8453-6fd8511271a3", "value": "1EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694840, "uuid": "ed328272-7040-460e-a405-35054b5c5943", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694840, "uuid": "e4e3fb44-b661-4546-a0d9-59f816a0ab1f", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694840, "uuid": "79882217-d419-4b74-a469-1603c4ca3d3b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694840, "uuid": "b81e3c13-c232-4724-b3f9-919fc28eaa38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694840, "uuid": "3c6ff04a-c1a4-4b02-805f-37809712adbd", "value": "11964b03_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b906f1-b233-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620721807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721807, "uuid": "31bd1a5d-5a38-47d4-b4e1-0a3460afda1e", "comment": "Malware payload (RedLineStealer)", "value": "fe094c383de5bd04ec7a4f7ad3b6c989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721807, "uuid": "5b3fb86f-bb62-4de1-aeeb-37da275fc4ca", "comment": "Malware payload (RedLineStealer)", "value": "2d48c5a2fca8c8f8dd72b8f646e68d55765b66da68f35d86aeb37216cbef8707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721807, "uuid": "fbcf7bbb-ccc8-4195-ab43-52ce0ad5f4fb", "comment": "Malware payload (RedLineStealer)", "value": "953ac70c2b5698461e4b72db100647fe122dad6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721807, "uuid": "0054e697-59f0-4c97-995f-f95b30e2779e", "comment": "Malware payload (RedLineStealer)", "value": "76b2107d5241f6de701f72d7e7d19ce585af60c636992ae7284eb0783bf0af80cf9caa0a86fd43b06c69010786921e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721807, "uuid": "95e7bea5-03c8-4bea-901e-32507c1e7793", "value": "3094C0117290D072CC669D354465CB785EABB8326B218ECBA6CD2B79EF303D1BB2534D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721807, "uuid": "9e07fda6-80fd-4f6d-bc4a-8e1f66486b7b", "value": "0eb744574666f2607e9c304d58194156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721807, "uuid": "5aefb156-db30-4b2a-949e-3b84f27b4da1", "value": "6144:JY034bCdAQXFHcLvkkO+f/PxVOkgy+AXvtlgTPVJjw3M1MXmIUeDI:JYS4bCuKitf/ikg3MtWTPVJemW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620721807, "uuid": "cc9c2a7b-0ec8-408a-af78-9cc7ada5febd", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620721807, "uuid": "c7ffc42f-63b7-4d6b-822e-76a4ebcddb3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721807, "uuid": "eb85bae3-f8aa-42d2-b7fb-d15fce90406b", "value": "FE094C383DE5BD04EC7A4F7AD3B6C989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e62b05f-b25e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620740421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740421, "uuid": "c7ae33a4-8c30-4948-951f-4b44ff318995", "comment": "Malware payload (AgentTesla)", "value": "083f72de97161b1dc01c92ed217174ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740421, "uuid": "4febca6f-7f84-4d0d-9ab7-7d9d296dd555", "comment": "Malware payload (AgentTesla)", "value": "2dcdb2a2cebe7d4ed621cfcddec17fd8489ed9d67514419d567ecad0d7e1ed7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740421, "uuid": "b8091c1f-a4c5-4a7c-8fe4-517128bf31c0", "comment": "Malware payload (AgentTesla)", "value": "8ca26fd4f7b4b174ed0ec2f628a82b2f50589642", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740421, "uuid": "09c78ea3-2185-4b3e-986d-f070ffdd4b74", "comment": "Malware payload (AgentTesla)", "value": "9b286df65e650b3bb6b0a836e1435ba7c9d919bfca80e7b24de0ffa542b1a0d9055f73ca3efee0292b1c375b70f3ad01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740421, "uuid": "d0c5c5b1-65fc-4d13-8a2d-aa549c42d9e3", "value": "3405234333FC6214D0FC17F664E2A96103F4A54AF1A6E7AD3F8841AD24E7AE18745BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740421, "uuid": "0230eef6-befd-412b-b4b6-a74c61072a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740421, "uuid": "990feed7-55c7-4d3d-a5a7-63f52286de08", "value": "24576:Xk9dNTCUMKHNiXN/5/2MpvNRVS0+Z+Sygp:099MpXNJ1VNRo3MSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740421, "uuid": "11086f75-7e24-4cd4-9371-2aebbd08654e", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740421, "uuid": "0d6d1cc4-45db-44c5-8bba-7483afa4b56f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740421, "uuid": "cebc95a8-2f32-4546-8993-a2478894a41b", "value": "specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fd34f5-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620711976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711976, "uuid": "5a7c7963-9a8e-4329-9a1c-1769c939b140", "comment": "Malware payload (SnakeKeylogger)", "value": "585f0a084f204838af334fd8d68e719b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711976, "uuid": "2af7cfa9-b190-4ef8-8169-1677ed46b7db", "comment": "Malware payload (SnakeKeylogger)", "value": "2e12db81b88607cff205464998d3aa4a9cf28b6cc3c1454489f2308c4bcecaa1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711976, "uuid": "3ca04c26-61c9-4ca4-8ab6-f23e3b60c386", "comment": "Malware payload (SnakeKeylogger)", "value": "07f6917890c8959036e8f63c18b0925e34f9bda1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711976, "uuid": "4abaf0ba-0047-46c1-ba5c-293f8998cfec", "comment": "Malware payload (SnakeKeylogger)", "value": "75a9a6fb811e046f719d9949437776060d7018ba11071e835c21568d9c54af7d38a1682118b7e3dd342f92fd8787987a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711976, "uuid": "f1b5cbbc-0a25-4130-a440-4ee29055efaa", "value": "5BA423642FE3A1342B19C0E7B2D2CC1E5599F18458C89E60D4D7EB493F49CFB325A17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711976, "uuid": "3be5dda9-7017-4e56-b6b3-40907bb8713f", "value": "12288:qw2cktiLUxRaziiiJsqwPto8+3M1nHmtGhL9Ir9nU4:giLWYOifqwO806nWyUy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620711976, "uuid": "6e746b38-ddab-46a9-8361-d6f2be301217", "value": 479262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620711976, "uuid": "2592ba9f-f647-467b-9d8a-2ae35ec2c57a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711976, "uuid": "4b8ce5b7-5542-4ae3-8003-1d57afd11c51", "value": "order 39305.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f5aa08-b23c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620725811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725811, "uuid": "c05e6435-3399-4440-a3e4-6b867c2186bd", "comment": "Malware payload (SnakeKeylogger)", "value": "81cfc0f83d022074a814463307dd2e4a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725811, "uuid": "8606b89b-0427-4df2-a417-44c0547d452e", "comment": "Malware payload (SnakeKeylogger)", "value": "2ea93ad5515d5f6d256ae46732e60615b3bdff51c11f1da006fc78f7d423b951", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725811, "uuid": "695b9d67-56a9-45df-a391-4a2bfdda3530", "comment": "Malware payload (SnakeKeylogger)", "value": "5ad94a4b322c553e40c88c7c07242b15c49fa822", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725811, "uuid": "25b479de-a26b-4135-860f-2ccb9e087d35", "comment": "Malware payload (SnakeKeylogger)", "value": "ad3df9296e3d682a651e6f08555edbcd26cf80925cc06a76f16654481fe4f64f10131f5f302cc211231296583561007f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725811, "uuid": "6a96bdfc-d86f-4d86-81db-a0f3c208961e", "value": "3D056CAC719455F1E32B1D7263DF0C0643692534A43FE90A8FA023FA5967F172E39D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725811, "uuid": "b9b09627-10cd-49c7-9d41-e3f1d2b89774", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725811, "uuid": "492a7a63-5827-4adc-af4e-1d6bec7f668d", "value": "12288:6F5ltWcfLkooLLoS60/K7yh0P5oDzbpwAzwUyquOceV2FJiZA88gGAyONE:sltWcfLkooLA6DzVMtS7VyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620725811, "uuid": "4cf0d8dd-6c79-4837-93f2-b28cc5404818", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620725811, "uuid": "995928b5-3832-42ce-a0bd-02aa3f9bbf86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725811, "uuid": "56749163-44fa-4df1-91ab-2011eec1b651", "value": "0000195221990024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefcfc53-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691271, "uuid": "daac3f80-d484-4487-8624-20e39d492df1", "comment": "Malware payload (Dridex)", "value": "8455ccc0c164dddb8d397af29810305e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691271, "uuid": "57bba657-fd21-4ab3-8f41-04bdc4ee254d", "comment": "Malware payload (Dridex)", "value": "2f3e82ba909504144a3603e9a05710d44540960f4c841f72a8b164c6d8a2faa9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691271, "uuid": "8d35c707-072e-4af0-9c58-eef35db160cb", "comment": "Malware payload (Dridex)", "value": "91dfadfdc707d28092ab93ca6a135907fef9d634", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691271, "uuid": "f98508f9-fbef-4c75-ba31-a755876e6436", "comment": "Malware payload (Dridex)", "value": "80c31635ed69585e2bfa022e460fb9eefbe14c174e53af4fef06a732f056338b27b04c693d3450034b9b40a3cc77ef76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691271, "uuid": "d5182667-20ec-4ab7-ba0c-7aefb3f205e4", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691271, "uuid": "5d926943-4c71-4a1b-bd92-0c5ebffc9007", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691271, "uuid": "8f2065e1-1f09-4542-8a92-670c782fe889", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691271, "uuid": "0a422ea6-b3a0-438d-84d8-2a0d687f7250", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691271, "uuid": "931fcd6b-e92b-4363-a842-ab9425aefafc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691271, "uuid": "1fa59def-ee4f-44c4-ad88-d220d5033b24", "value": "8455ccc0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9a8865-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691267, "uuid": "aece10a2-9bd1-4c30-a320-e8cb081ffe28", "comment": "Malware payload (Dridex)", "value": "7c7cfe90c2d2616152e8c2c77f78623c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691267, "uuid": "d65f895c-e119-4add-942e-c94fe95148f6", "comment": "Malware payload (Dridex)", "value": "2f6683eac3bdfff49d2d7c6a9df281d7e6dcf57ca9097649e3b8bccd1ec0c925", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691267, "uuid": "b4e439a5-6007-43d9-8a5a-7d0f16525ec7", "comment": "Malware payload (Dridex)", "value": "9b83a013193fc328bdd6c1115ff46f8c7c3dbfb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691267, "uuid": "eb8be04d-3da9-45ae-806d-a53e22195f98", "comment": "Malware payload (Dridex)", "value": "7c6d58934569c796160d4a893414ec3e6e4c8f315807409dca012a44f803fb4c281829eb8d7e2962a16ad88b15418e11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691267, "uuid": "5bca5850-3011-470e-a6c4-0e8f52bb4d4a", "value": "51F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691267, "uuid": "07f01b7d-b058-4256-9c7c-07aaeb728be7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691267, "uuid": "bdb0035d-71f8-4a35-85d4-71e8e6bd9304", "value": "3072:HiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ceAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691267, "uuid": "fffa2443-7679-46dd-ba18-4e6e4e93e79e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691267, "uuid": "44948921-6b45-426a-b147-9fd23822593b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691267, "uuid": "a6792363-7638-4fad-ba48-795981bc2992", "value": "7c7cfe90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8913279-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729405, "uuid": "396cff6c-50f8-484e-b159-ecb536b37ccc", "comment": "Malware payload (AgentTesla)", "value": "fa030b63047912ff016c5b258cb90324", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729405, "uuid": "2f2a1e35-21c6-46b7-98cb-ba9e99a60e5a", "comment": "Malware payload (AgentTesla)", "value": "2fec5a8a55f441415b81b02e233a959d766aa32929cf5d92ff7068c867d01f23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729405, "uuid": "35fb1ea7-b05f-4767-8619-0eba26db9906", "comment": "Malware payload (AgentTesla)", "value": "375aa0ee7144ee0abde8c0d6cbf32e6fd41aebbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729405, "uuid": "c73eff4f-b64f-465e-8b12-d623b7bb8d6a", "comment": "Malware payload (AgentTesla)", "value": "7b5f8991a2005153152d70ba5d2020b6db2af658da4bed6c3b4814d5a38ab32a4d7e0c707c88a185e9eef8c7e260dbaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729405, "uuid": "dd2e023f-1a09-4a7a-9d2f-c5483f2e52d8", "value": "5C150231335CAFA2E27EEB3D5860914863F9B446E322E14E7E9905ED5859F40C7A2F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729405, "uuid": "bab7155c-9a42-4e49-80a5-e43231c017ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729405, "uuid": "89ffd54a-a8da-4811-9dfc-11818323549e", "value": "24576:9/12ggyTjw0ORmlzbGSPWY19oX98xEG41/w:9PZKmzCSPZ1K+xB4Bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729405, "uuid": "4bdf2fcb-f74e-411a-8706-57a8aec318bd", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729405, "uuid": "9007510c-a315-4801-ae74-5ac5a3daf258", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729405, "uuid": "2844b56d-c0fb-453b-865f-e5795a982168", "value": "New Price List pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a624774-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705679, "uuid": "0cb6e4d2-c94f-47ff-85b8-bd6269e1ae82", "comment": "Malware payload (Dridex)", "value": "ee775a0aca0b12b9fdbfa9b51bc79994", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705679, "uuid": "31dcf910-a14d-4764-a19f-e51bb4b1e9ff", "comment": "Malware payload (Dridex)", "value": "3035020bc872298fbb2a38d1b19c6f5ab0ace17a0dc7d2c251134b07aa309e79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705679, "uuid": "8a6f7092-bdb6-464e-aa98-02c2643ebe91", "comment": "Malware payload (Dridex)", "value": "3ae5c357300ade368f65a7fcb3e3e6c7d2acfbd4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705679, "uuid": "5c2cc83c-8a06-4364-9d18-6fda1a9195b4", "comment": "Malware payload (Dridex)", "value": "b8b6d6067ec9ffbe7c60da941c4baff1d8ba5f4c1dd3291ec6cbee267dff7b94d522385a0c28aea5df6684267a0f90c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705679, "uuid": "c7835cbd-061c-4b78-9a58-1d6711ced353", "value": "95F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705679, "uuid": "86910a26-db21-4bee-9ce7-b58ba144fe7e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705679, "uuid": "04bdf81b-e04c-409a-9413-c5c1e9545f2d", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705679, "uuid": "b67acbe0-2c8b-4af2-99ce-55e56b82c3b0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705679, "uuid": "696b4165-155b-45ee-9214-0581d84f8dce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705679, "uuid": "dc1682c4-9884-4d58-a70c-cc797fc95573", "value": "ee775a0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee779174-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709282, "uuid": "19e8004c-425b-4669-99cb-6eab161233a9", "comment": "Malware payload (Dridex)", "value": "d354bd065e43c76099e0778647727925", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709282, "uuid": "602b8db3-9055-43af-960a-c17fc616812b", "comment": "Malware payload (Dridex)", "value": "30670ba2b78fa35d3c6adcd89127dc1300c5448b4430d5247c5c85d5210e7573", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709282, "uuid": "ce597a82-258d-432b-b878-6558ad6b8122", "comment": "Malware payload (Dridex)", "value": "aecc907953c919f2c62fdaa28b474b527937aaa0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709282, "uuid": "05d633ae-45df-4121-97af-586b0a4908c5", "comment": "Malware payload (Dridex)", "value": "49cc22266bfa439d5f8f22fc0ca92c57c30f93c974838f11b79dee927aeb35601d3cc7af79e8b978a6a15e85d7fafb71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709282, "uuid": "0bbc3236-6213-4d7a-99b4-1e32f9bece14", "value": "0AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709282, "uuid": "64f5c736-5a6e-475f-aafe-2602af27f955", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709282, "uuid": "e83d0dc7-9a07-4725-aad9-600be0df3974", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709282, "uuid": "086834f9-286c-45c2-bcdd-23e402f49f52", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709282, "uuid": "be8f1a62-b76c-4f32-bd52-a6ab3d8f993a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709282, "uuid": "f79232a8-1149-4ae0-9013-3a8baaa510e1", "value": "d354bd06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bf8a30-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705730, "uuid": "8678997a-2719-43d0-8f2a-f13f8a435ae0", "comment": "Malware payload (Dridex)", "value": "98c34e7ffccf7ebb93e955e4a6becd2f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705730, "uuid": "65d5648e-333d-43f4-9e2f-696dc511c4ce", "comment": "Malware payload (Dridex)", "value": "31cfce287dd7cbb0560562bd930e818a3f4d7cef6cdf51ecb43f4cfe8a99c35f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705730, "uuid": "3992a6e6-3354-4ba0-94a0-1dad1a7bafd6", "comment": "Malware payload (Dridex)", "value": "e2989716599250f40488dbe900887a6c31e28577", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705730, "uuid": "85267433-126f-4074-a16f-5b742c88bd05", "comment": "Malware payload (Dridex)", "value": "bbadbb7acc10aa8d2161de1df7ee6a62ab4311f85c6c7001f1b4fe416291ad5404fd7a978b0ea6aab0c9446d1b6ba249", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705730, "uuid": "4dde29e4-e595-4c1b-9c35-5e2526322c7a", "value": "2EF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705730, "uuid": "57799342-d82d-4291-b701-6754405caecb", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705730, "uuid": "4e97626c-e9f1-4883-ada5-03d5b518742b", "value": "3072:Desl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLM0:34+VZQpt5hyPsa1ekiEf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705730, "uuid": "e7d8d94d-4414-465b-9aa8-108ac04d4e99", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705730, "uuid": "e1d865a8-645b-44e2-913a-cfa5ad20a565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705730, "uuid": "cdff15d5-d679-4c4d-99bc-2b643d9f55cf", "value": "98c34e7f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4265937-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728915, "uuid": "d13fc160-1a27-414e-8bb7-a2f350056e13", "comment": "Malware payload (AgentTesla)", "value": "f64f75a76ab15e02ef0b9af4a5c829a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728915, "uuid": "8d678cf3-eedf-4cf6-beab-bd96640d057e", "comment": "Malware payload (AgentTesla)", "value": "32b40946b375a87fbcffd5dd1c8da2b375b2f976fca535e06cb36c9d8f40e866", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728915, "uuid": "7539cce2-78a6-4e86-9b04-26158ba00d7b", "comment": "Malware payload (AgentTesla)", "value": "572cd977d029ce977cd2c4fade38ea882c64e57a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728915, "uuid": "8e50fe37-285d-4ac4-9402-a8b2f4ff611b", "comment": "Malware payload (AgentTesla)", "value": "fb7dc0a4b67d51e8ed2568e2076a597553de76ae0d0c45b1c07d3fc37c530aa2feb842b3a8ddb892a4f9b5050cc17c5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728915, "uuid": "65accb97-82ce-4722-a93e-682efb402c48", "value": "C91502313358AFE2E2BE9B7E5910118493F9B94AE721E24D7EE504DE0462F8147B3F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728915, "uuid": "0340ecce-129a-4eef-b5a3-ba00092223bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728915, "uuid": "a44ce84b-3a7b-44bb-bd2f-068a089c7ef6", "value": "12288:IKDSngHwfyo03uNsdwXHIbxcOk2zfUe9lOCIeOidysk071jiJJG6eP0yDdA3u2Ho:IAlHIe75V1jiJY6eMyGeArsOt5+8nkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728915, "uuid": "61bbe6ba-d011-40dd-8976-80929cbd3cb7", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728915, "uuid": "5bc29f88-997e-48e5-b62e-d0dd48ebb91b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728915, "uuid": "c6cb7330-c812-4e64-b35c-8414ea22af7e", "value": "Request Sample products.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89095f3-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715205, "uuid": "e7128a8f-0a22-4bb0-a21f-381744681c19", "comment": "Malware payload (AgentTesla)", "value": "06aa3e525dae9c7ce7c7921e0bd646ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715205, "uuid": "fd898f94-348f-4772-bd5b-759aba38925a", "comment": "Malware payload (AgentTesla)", "value": "32ee58ca9a5ac19a064974541e4d3c27191a4367016c1640118c6f735799a6f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715205, "uuid": "27eaf534-213c-4ef9-8cde-10df72e752c3", "comment": "Malware payload (AgentTesla)", "value": "fa48aa2203fa3abfbf6e1f274c2f51105490dcb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715205, "uuid": "9c08bf2d-05cd-467b-8488-0bbe20dd1462", "comment": "Malware payload (AgentTesla)", "value": "35e6a76de1a837dc7779a99a062145b98d2b2b15a872dd16cf26cc6c3c782702d867199494b3c0bd8e78f419cac4e2a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715205, "uuid": "86feef8e-876e-4365-bcc9-7897e5e64714", "value": "2135AE123294AB58F47ACF3565189504E3F5BD16F721DF8ABDA4328F48F3B8087513AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715205, "uuid": "4a1823b0-a323-4787-a04a-e29ca0e15459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715205, "uuid": "155c98b7-92a6-4dee-b497-e3fe046481db", "value": "12288:ZvgV0Em3rKMSorJB90fJPwokq5jdRFs2bAoCnfrNVAe4H444h:lgVurK2ufJMCdr/AoKzNr4H444h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715205, "uuid": "ee78d015-dabc-4084-aa3f-048db1d7a2da", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715205, "uuid": "b19c6f9d-97b0-4060-a3c5-50d791f907e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715205, "uuid": "b2a7fc5e-8308-4676-b26c-ae6f71098873", "value": "Ricevuta di spedizione.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb10493-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620752447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752447, "uuid": "e632d68f-3376-4f6e-9a3a-65606b3d965e", "comment": "Malware payload (AgentTesla)", "value": "167efbca43f4e314c7d6b4afb6129342", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752447, "uuid": "fcd6fcc5-43ac-49fc-b9d3-34a06bd7d7a2", "comment": "Malware payload (AgentTesla)", "value": "32f77b5b7f1ef4be93849b3565d1001ecda0bdfec3c20f75cbd5d86ec79f2129", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752447, "uuid": "fcbc51a7-00e4-4fd5-a826-c157adb5002e", "comment": "Malware payload (AgentTesla)", "value": "6d5307b934ce71f30aa720f1d3bdd0effc6ce212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752447, "uuid": "b8273240-f62b-45c1-a154-7b7fe7047b10", "comment": "Malware payload (AgentTesla)", "value": "088416ef1117aa3293675f02fb98407493c6c4ad0a03d46997cd7b9e250af32d78c5961d963937cbe17be70c8f191af4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752447, "uuid": "08807d57-21e1-4f28-abd4-5208928c6c1d", "value": "DEF4AEB875047DD6E62F526BD996BCDC03B5B623DACBA4CC4068F7E30963365EE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752447, "uuid": "ff3cc0b2-ba78-47dc-b0f1-7cd8501072ae", "value": "12288:BOawr0u1NzFbecELFeEOqGlfbtIcngUdp8RDM1ntMbMlfql0MItiR3bY1zggRNiR:BOhf74UCGlfZIcngUdp8RIvMbMQl0MOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752447, "uuid": "8d61825b-2ab9-491f-ad3d-fc9545eb6169", "value": 763402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752447, "uuid": "6c90848b-2806-4ef0-9398-f2e8a2ad9e57", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752447, "uuid": "e83189e0-a67f-466d-893f-dd2b55089fd9", "value": "latvia-order-051121_.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c988dde1-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715233, "uuid": "dbf84692-c8fe-4580-8964-a08ef0f2a900", "comment": "Malware payload (AgentTesla)", "value": "9a5914bad2705315c12f6b4740e1b84e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715233, "uuid": "e3af7d12-856b-442d-959a-abb6b8b638cf", "comment": "Malware payload (AgentTesla)", "value": "3309b8cc64c1829ea415343dceff82184eebe0fae9108ec3c9f26a415127de52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715233, "uuid": "07b601f3-5c10-43dc-8279-9a1f1b972922", "comment": "Malware payload (AgentTesla)", "value": "59fcd6cf92e3aec8119f74632781ab9d68065908", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715233, "uuid": "e223079b-3ad8-422b-85f4-6444087119a4", "comment": "Malware payload (AgentTesla)", "value": "85fb1fe5dbb20ef158c9e928edb34e13106d7d497427e5870d327724293740c41226620d9f58580a884f0b05d30ac774", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715233, "uuid": "c6a22a65-5f2a-43ba-b37b-1325e3fbc401", "value": "B905230A33ED5A28D5BD97F90070268023F06129DA3ADF497D59A4EB54D77D88F822F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715233, "uuid": "0ea0907d-c9da-485f-b0af-b74130e5f4b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715233, "uuid": "fc3d6d6e-3c1b-442a-89ce-7996d7a8ca7c", "value": "12288:VEMyi/QmsJP13In7I6G83UdN819q6zUrpmPOlbreggl7bjKoRpGYA:rsJt3qH3UdyM6zUNmPOpregEjKOpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715233, "uuid": "93904c51-080b-441e-987f-346ea2ea86f9", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715233, "uuid": "bf563d50-78bc-4078-acae-e43c4b9e8ca6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715233, "uuid": "c7a93f1b-1dd9-4e15-b8a2-2692f9d54338", "value": "Quotation..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a3529f-b257-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737267, "uuid": "a02483cf-ff04-4cf9-a78f-2603e7e38f58", "comment": "Malware payload (AgentTesla)", "value": "5fe3af8698d46cb668b36cda32381df9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737267, "uuid": "b81a77e1-50ec-46b7-a5ce-40954b5d06cc", "comment": "Malware payload (AgentTesla)", "value": "33a72fddfb31f23f71b11ac223b87c62e1dcc371c6f238804220e0d969f09504", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737267, "uuid": "5162b50e-fe60-45d7-bf6d-af86e91bdd42", "comment": "Malware payload (AgentTesla)", "value": "08f42bff933e193f76119e59e8c8d7df52271332", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737267, "uuid": "8f8dcc43-191c-4eb1-9943-c747501d54d5", "comment": "Malware payload (AgentTesla)", "value": "9c40f6c58708a965199677b2c3cd9863874ce746d23e6206969ae0ef5a8fa829584fcd85d2344d68ce8953146f086f5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737267, "uuid": "9e0be8f2-30f3-44c1-9037-2bc4863ef862", "value": "2615022237685FE1F6BE977D5860114853F8B40AE722E68DBDE909DE0421F4243B3F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737267, "uuid": "9525797e-fc66-466a-8d55-90cde7649c91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737267, "uuid": "d1fde795-05eb-4073-853f-988fefc15bd2", "value": "24576:krkipPdUjQrPGzQn1nw1xMDDG5p0FwVL:kbPdUjA1wYDa4FwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737267, "uuid": "29f10e50-fef4-4045-8763-fef5193c8ddf", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737267, "uuid": "88f7de13-d595-492b-90d3-94f51e57766f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737267, "uuid": "3047f441-952b-4c46-877b-0f10fcd564f8", "value": "invoice and packing list.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d440d9-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620712347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712347, "uuid": "ec0dc047-c328-4a05-80b2-5509fa483556", "comment": "Malware payload (SnakeKeylogger)", "value": "c375afeba1fbadc9b54145536fd1ff6f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712347, "uuid": "946a8faf-676c-41bb-abc5-d43bc28a8bb5", "comment": "Malware payload (SnakeKeylogger)", "value": "3483a489915bf24b064467605560f37a58c7ad19f215b3dc349e1f2d74411838", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712347, "uuid": "7da6d0ad-47d7-466e-99d4-0c1f9d46d7bd", "comment": "Malware payload (SnakeKeylogger)", "value": "a86dc26ceb42a221e6637b64560d1e0e7252a8be", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712347, "uuid": "604b5ca7-aedb-4137-b5a3-8cb15dffcdc9", "comment": "Malware payload (SnakeKeylogger)", "value": "43853da5c9c1edf62e2222b5e94e40494e2b0c08becc94d1a09af301a43b3c5b28bd8028492043747ae03f0fa6f8ceac", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712347, "uuid": "97f9695e-0235-43d8-a3f6-449f886fe8bb", "value": "3A153AD8F54454E0DA0B5E3263EBCC3642222DB4683A681E57E43F7B3BB7E532935489", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712347, "uuid": "a1435b1b-9be3-4cb3-8382-dd0faa47eb83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712347, "uuid": "71e19002-9fbc-457b-9934-e021e681db12", "value": "12288:H+WzjoLLoS60/K7yh0ecHX8zv0BP/LVkCKzSJieVS5R4P7r9r/+pppppppppppp9:1oLA58o3BRK+Jib41q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712347, "uuid": "c3e5e7ac-e9a1-441e-a32e-c904e1bee107", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712347, "uuid": "1df08c53-aa1a-40fa-95a1-b52a6d4cdb93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712347, "uuid": "4d63e4af-9eb8-4225-a943-4daf26bc75f8", "value": "S.O.A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eef4fac-b283-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620756286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756286, "uuid": "43010b8c-6e97-4767-8f69-aa474450015d", "comment": "Malware payload", "value": "8dffa828e74af3de66d1c7173b4f72f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756286, "uuid": "a2650b9d-94b9-4fce-8277-f76354fee4b2", "comment": "Malware payload", "value": "348ec0fe2c83cd7c0f927753333b3877a176a0732499eba4d59b734cccad2454", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756286, "uuid": "8ec0f01f-1a02-4671-86ca-bbfcfadcb72f", "comment": "Malware payload", "value": "79ab8a6f3b13701ce3b4ab5944dcd23a801fe157", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756286, "uuid": "305abcaf-ab81-44ef-a351-d4c8b11cea58", "comment": "Malware payload", "value": "012a76ecb0f5da1b3d8f0430455bf0f0794daa2a23d2414f0ef9761bef042aaa68cd3414df833906f490582e6f6de271", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756286, "uuid": "0593512c-7b0b-477b-b7c8-10010ddcc0b3", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756286, "uuid": "ab74db2b-5e36-45da-a322-4277ccfe1eda", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756286, "uuid": "5f00c09d-040a-44d5-87ef-c1c81f0bf067", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756286, "uuid": "70d98b4f-daa9-46ad-8212-61ec3c96c696", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756286, "uuid": "ae78a35d-7837-4e19-8af3-5598e1e97019", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756286, "uuid": "bab7c78a-1400-49c2-84ee-e44b3c875a28", "value": "8dffa828_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aefb698-b254-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620736120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736120, "uuid": "ae611de1-bc28-405d-8132-de9181def488", "comment": "Malware payload (AgentTesla)", "value": "4ef48db6bd9e56a4ca8145eeb63e3487", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736120, "uuid": "f289f8e6-4c90-4e20-ad35-d686cf3855b9", "comment": "Malware payload (AgentTesla)", "value": "34a8e4ae7107286f0b77c6fd8606a9a7646951d653807af30a73342de87580d3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736120, "uuid": "0c726d55-359a-4d1e-b0aa-202d2e7f81e5", "comment": "Malware payload (AgentTesla)", "value": "bb0f2c1b3de142501d6a66ff514f4facb351305d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736120, "uuid": "170fdf61-fcbb-406b-a196-9ed242117a70", "comment": "Malware payload (AgentTesla)", "value": "bb7c8da62c9c50283022713172d2277a855af6d929c7c2bb08d030968f7d33bced147d871722f862e65a6057911fe9c6", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736120, "uuid": "b2519a30-664c-4cf2-8073-70ddc2339eef", "value": "431533680ECB7C09C78163E475B572AEB2DC43C1FBB994D46A4819A0F165E23FBB41C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736120, "uuid": "7e118e97-9d50-4ecb-bee9-c25d24b8b9ed", "value": "12288:HKwuUwHLTPKFpk7RjSPS5XrljrCL/6bUMwJIrdR04Npuo9eAZjmQthAEqCkXxZTZ:qGwHPKF+jdRq/4SIRR0EpTJZjp67bkod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620736120, "uuid": "965c23eb-ea65-4424-8fee-722a1cc6cf81", "value": 875770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620736120, "uuid": "6723613b-9411-4eed-b991-418738d544ae", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736120, "uuid": "88c07b1d-c0bc-4253-9105-dd2f157b9c7d", "value": "HSBC payment advice EGHKEB0C01725410-T02-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4b8fab-b22e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620719934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719934, "uuid": "58c819f8-85ef-4df3-9de5-94450ace1bf0", "comment": "Malware payload (Dridex)", "value": "7b809915a16466d7fb996a6f49e02c2c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719934, "uuid": "bfc03094-9642-4509-800f-d4db39b8c3f0", "comment": "Malware payload (Dridex)", "value": "3502c67adc15a9d45e9177b6667d68a25a925cd1f454d60bc423c089b708535e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719934, "uuid": "251e91c5-c511-4ac1-bf8a-f5bb39875135", "comment": "Malware payload (Dridex)", "value": "98b3d0ce3e741977d144cbc063e0a7d516d13540", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719934, "uuid": "66257e88-ac5e-4c79-8e3b-2cd8200ca90d", "comment": "Malware payload (Dridex)", "value": "318cb3725910582dd75bc2b978db997028d4e6529daeb8205f6ee689efd53bc0aa9b18ef1b2e21424d1ff31cd3a658dd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719934, "uuid": "6c5b7268-b243-49b6-9fbb-b51111fc495e", "value": "E9F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719934, "uuid": "1420da04-04ce-40e7-baab-b7a34c33207c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719934, "uuid": "d0dd9dae-cae0-4731-a112-e1b941094ad9", "value": "3072:HA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:H3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719934, "uuid": "a0797112-a8e6-4cfc-8c6d-279d2c13ce5a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719934, "uuid": "5df9f6bd-63aa-4ede-b612-39c0fd636565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719934, "uuid": "7646b512-d90f-47be-8ddf-5caf4162044c", "value": "3502c67adc15a9d45e9177b6667d68a25a925cd1f454d60bc423c089b708535e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd33ff1-b26a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620745597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745597, "uuid": "c6a721ee-cd76-46b8-8bbc-f7ddb728b2e0", "comment": "Malware payload (SnakeKeylogger)", "value": "f2b03f7e2fae43ab49f32c11a27a9a09", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745597, "uuid": "73b8ca87-6f34-4c6b-80ba-27a89aa6efcc", "comment": "Malware payload (SnakeKeylogger)", "value": "351a22384f08b259c0ced2f6507d4129dd8e0a606a560799fdf0bab3ec112b3d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745597, "uuid": "74ee147c-34a6-49ae-9948-8bf0016c731d", "comment": "Malware payload (SnakeKeylogger)", "value": "082bc5a1f52a64e2dfdee6703340665dcf86c847", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745597, "uuid": "5c119bd7-a88c-41d9-ac68-01b047103312", "comment": "Malware payload (SnakeKeylogger)", "value": "46dd5367b6d724cb6fb61c498a6f130be22f8ff84a10267d18343dd6a6389e943fcad749e410b87cbd4b3f21faac37ee", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745597, "uuid": "6961acec-6120-4b0a-ba7c-dace652d1e32", "value": "6AE5C768E21F9A628B50F93D775C97A29C1B807B52BE7D65C2604E273E01F94EC007DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745597, "uuid": "8f9f35ab-25f9-49c0-90ec-eecc0a0e673c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745597, "uuid": "d8d37ea6-621b-4a5a-86b0-a005f30a0e47", "value": "1536:8t99cVc9XFCMOoTaczKp5R3oltZTz7XJoRLXOyBM88jd9DPok0ktJktZM0u3n7v6:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745597, "uuid": "665bff54-d6ae-4f4e-b480-055a5da7bc0e", "value": 3294208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745597, "uuid": "573d5e44-40bb-4073-bcc6-9d3500a289d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745597, "uuid": "8bea13df-aa63-4083-ae3f-d87dc3506fe5", "value": "f2b03f7e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7bfcac-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716527, "uuid": "37ac0eff-ccb6-4fb2-bb97-b59884d6944f", "comment": "Malware payload (Dridex)", "value": "bbeb839620a99cdaac38516841fbe86a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716527, "uuid": "d64166f0-8f55-4ff8-997b-c327d4be3e81", "comment": "Malware payload (Dridex)", "value": "3539de41885917911eebc21060889172d30fe30c3e114a59b6d379455a28383a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716527, "uuid": "5bf7a5ee-66e8-4c0d-bf97-aa7476e70490", "comment": "Malware payload (Dridex)", "value": "d78c0b607a8a6ab0271c1cd2e0ef7358906ff153", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716527, "uuid": "b073cefc-6ddd-4b2a-8414-964ba327bac3", "comment": "Malware payload (Dridex)", "value": "de44047517250f642be1f1d404454515852935c62a1c87499b696fc404a09e62de7128bfbd6062ccb98b587c770327c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716527, "uuid": "1896a243-fab9-4f01-87fc-2cf079206aae", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716527, "uuid": "d4c27a4a-a4c7-474e-8420-b4c2253466de", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716527, "uuid": "d24d3dce-e649-4803-a8d0-3b0e3a2340d7", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716527, "uuid": "f225d8d3-38cc-4bab-9144-aa75989dd390", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716527, "uuid": "2b6df46c-f957-4f86-902e-6640c4fff91f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716527, "uuid": "94abd8eb-901c-44dc-89c6-27dc5d907441", "value": "bbeb8396_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f59a2a-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709243, "uuid": "e17210b9-3f78-46d2-9a4a-b99f9c16a585", "comment": "Malware payload (Dridex)", "value": "4181f76a4e66cb693ceb96318e8eb98f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709243, "uuid": "b2cc09d8-dcfa-4b1d-9a8e-53bb7bc2ecc6", "comment": "Malware payload (Dridex)", "value": "35bdacbc070478e2c5c135e4d507496d6f9e67f9ed625dbe2e7ad7b59ccecacb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709243, "uuid": "4434add7-93b4-443e-b0d5-aea2b23f34ba", "comment": "Malware payload (Dridex)", "value": "c85997a51c4c96de344f5f7d182dc031f84323b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709243, "uuid": "dfd9ddd2-cdff-4c73-96c0-fb6d0e3a0164", "comment": "Malware payload (Dridex)", "value": "c4190b2817e9580dd96d34129f34a356c57b5d62c64181ea3cf010b07c4cc8e652d3ef7326529cee466ec1f57c67b52b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709243, "uuid": "3291089c-6d82-459c-9b2f-9490f399dff7", "value": "A4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709243, "uuid": "fb9b4667-9560-411b-bce2-fe9b48eef898", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709243, "uuid": "d1530a65-f883-4716-8c97-92f6355ed192", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709243, "uuid": "522cd674-e1aa-4f75-b4d5-1412b6cee10d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709243, "uuid": "43c875d3-3bcd-4db1-acab-7f404dd50e93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709243, "uuid": "aa609d67-8332-443f-a700-dc72df1d1920", "value": "4181f76a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14c38a9-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712616, "uuid": "a14e97f4-e557-46d6-8cf1-179b764e2b0e", "comment": "Malware payload (AgentTesla)", "value": "5e7580459cac445a3a184eb8142d10a4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712616, "uuid": "247a480a-6fb2-4b6b-b116-c198e6e518bf", "comment": "Malware payload (AgentTesla)", "value": "35cd71e7d1458450929f9791a5293374a52feb45a2c5b2a6c00c5acaca05e4e3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712616, "uuid": "5511889a-a8fd-4b6d-bc54-52b9bc16432b", "comment": "Malware payload (AgentTesla)", "value": "4cb0569d347124c5086e28d3b331645e14e064f5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712616, "uuid": "b6edfd36-a780-4a3b-ae93-bb7c7bdbf205", "comment": "Malware payload (AgentTesla)", "value": "8fcd420e706ec3b04e48fa1117331b075ca7b37e8269c6bd6329eaa6dfd867e41ab4fbddfa899cde5fb5bb5614fe6200", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712616, "uuid": "62a4eb56-cfd8-45f9-8064-9225b61a5eb5", "value": "05F423AFCCF61EC5F051E4D178919C974AD36D0B7A11218E72BCE114ABE8BE0704D9AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712616, "uuid": "388cd4a4-8006-48c4-a208-6a87a2f31f57", "value": "12288:fDL3t9JXHfONTUIvi+xv+wTCAeJdhsjpf1PkZJNyS6LzEiXmZdUiVB:7Dt3fiTyEdTCdHhsjpfBkzNyLQiXmZdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712616, "uuid": "94ae2649-091e-41b3-832f-4fcb82fabc4e", "value": 741668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712616, "uuid": "e8acf9f0-ead9-4909-b7d3-fbe4ff66addd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712616, "uuid": "fcbba304-aa2e-47c2-af54-b40a456a316f", "value": "SOA.exe.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d04d9a4-b251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620734728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734728, "uuid": "e4b2a3c9-978c-40c4-b93d-91d19fb9e064", "comment": "Malware payload (Dridex)", "value": "7d39a7ce835155cbb44962f61cc6f0a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734728, "uuid": "d3471c4f-76b4-4064-bede-5a6bba60f5f1", "comment": "Malware payload (Dridex)", "value": "35d3042cbc98cd0911aa0305b2e0db25dabff7485122b774d97b7436f5f6c769", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734728, "uuid": "61b97bac-be3c-43d7-a678-f6ea607818bf", "comment": "Malware payload (Dridex)", "value": "36ddbcbebf1e16e57059fa47c4bb02b15e62e29a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734728, "uuid": "fc592942-5b95-4288-8ced-4602c3d677c2", "comment": "Malware payload (Dridex)", "value": "d49c2d29f90e3acd44bc8442963186f6b2970ef8611035ccdba4477913d544981e0d14c455616acd597393c57ceaae09", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734728, "uuid": "cd6f49e4-4c39-4402-a32a-cd20e22c774b", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734728, "uuid": "a6669300-82c9-49f3-bf13-e47f891c1803", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734728, "uuid": "368e7050-2b9b-4459-9826-5586a89ac3bc", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734728, "uuid": "bb7c905c-b9b7-4f37-908b-e92ca2a167d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734728, "uuid": "a51d0217-0245-4a9e-bb5b-ff7e2cf89de0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734728, "uuid": "ade09d78-e87f-4d9f-bd7f-1fb80e1057bc", "value": "7d39a7ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64caedf-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620720382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720382, "uuid": "0dfd82e1-87ec-4037-be07-c2603d934a2e", "comment": "Malware payload (AgentTesla)", "value": "ceed8d513e143b89d08c7338b210e0e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720382, "uuid": "d7f3489e-1073-4981-90f9-361e77a3e1a0", "comment": "Malware payload (AgentTesla)", "value": "35e085a4c493e20455a4ab8387f79d2ceaba67d4428e8952c0ff84e5e2f16a71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720382, "uuid": "03552c74-403f-445f-b210-056252ca5673", "comment": "Malware payload (AgentTesla)", "value": "3f3766258a0b077eff5217b5aab2091566458d60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720382, "uuid": "23efda59-8b36-4ec6-9a63-407b2566bf58", "comment": "Malware payload (AgentTesla)", "value": "d9bcc016ee2926b8de22e376ba20fa5ccd38b127ab80de5cda3ba2b72981bbf8754a51049fa80a8d19155f5b19018a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720382, "uuid": "4399582e-7b30-4f0c-a95d-d549c69ba311", "value": "431523C5EDC427A3CC76B3366647D5B4649BED71C21AB1A71AFBF0AC2831D3908C6249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720382, "uuid": "29082e3a-654c-4b9e-8ebb-2d300f23127c", "value": "24576:a27tOMyiSD4RT3HxTDsqa/N3uF7BBvTvHmG:f5OrdDE7RTDDa13uFvLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720382, "uuid": "b7ab6e9a-5240-436e-af96-82a6e343eddf", "value": 950552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720382, "uuid": "feda0327-fd67-453c-aae8-92cbae85b003", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720382, "uuid": "a49b1bf1-77b1-4b9f-ab57-b2543be93d51", "value": "M2.Tr.23.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa045d9-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715665, "uuid": "445c4db9-ef46-49fa-b8f1-7511ac8f4824", "comment": "Malware payload (AgentTesla)", "value": "ad88103783c461ec223230fd9787a5bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715665, "uuid": "4c013432-c939-4f7c-bb28-db424f232288", "comment": "Malware payload (AgentTesla)", "value": "361320ad2d37de462f8c093f38551830678aca5cf4950979df3d96610c0f2a72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715665, "uuid": "8c1c9492-ddcd-4da0-a064-8a76b16d5572", "comment": "Malware payload (AgentTesla)", "value": "8b3048c25f1028e4068191fe9e76cfe6cc934556", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715665, "uuid": "66d7061d-bbb8-4d15-8eef-784149a07506", "comment": "Malware payload (AgentTesla)", "value": "976a60ff8e5457ca2bad70f23d6853e8b0fae56155b62759939b51f5b09c01374b8e654d3b5f0c56f5691080727cfcf4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715665, "uuid": "9749196f-2eaf-4e67-8d99-31c33b5de064", "value": "1AF47CFCB51464F9E35B5C27A3CF0C1682251270A93B690B9B2103BE5A5BE173E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715665, "uuid": "6db00697-7d1c-4334-949c-988876a96a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715665, "uuid": "9b8fd20c-8985-40ef-acf9-dad829eba10e", "value": "12288:XoLLoS60/K7yh0I6VUkOWPsFRu90A6xwopqE/ljsJy3L:XoLAIFkbPsFgPOpqE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715665, "uuid": "93334ee5-eac4-4b04-bc68-107ea8dec780", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715665, "uuid": "a2f5fe76-7080-45de-8634-b37047ff2239", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715665, "uuid": "23001986-58b6-43cd-9d1d-168b64175479", "value": "DHL RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83310a6-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620712198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712198, "uuid": "352c19e2-dcc8-4b1d-af24-e3d0ba880bfd", "comment": "Malware payload (Formbook)", "value": "88e07d255b86f16c9e457e832638c7a6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712198, "uuid": "83c9591b-3453-4614-8206-ba341b538edb", "comment": "Malware payload (Formbook)", "value": "3638ac885ef63f3b5bfadd95b0f43c34c3854e2483adde873b3d5fca7a831632", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712198, "uuid": "e022a753-c87f-40c5-8697-98ee0b6192d1", "comment": "Malware payload (Formbook)", "value": "cf58a34fe69fd11825ce93160bce12d4db1112f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712198, "uuid": "fd5b46e5-57a6-4e9e-b61a-3ab9e1e410f5", "comment": "Malware payload (Formbook)", "value": "0c68f72ad5f15ec386682b3ba62f10d03849a759754dd768e278c3a241ff29bed0d4b00332fff9036bf16a95b87003f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712198, "uuid": "a01a382c-ff22-4a2c-904d-c0acb4efc63f", "value": "9CF49D997E1488E1D0578538C9638676D6B27C055E2C934FE390FBBE9F33251AD2A323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712198, "uuid": "04bbd42a-f300-4d28-ac69-50743aace0cb", "value": "146e24575086448ba589e1755a927ce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712198, "uuid": "b2f65942-fea6-4b3b-90f6-bec0a8d17fac", "value": "6144:74K/u6D9ugCDprCUPoqDTIEyARtrhr+Ds0NXi6+TMSnnJvkCx2XYH0yNv93LJ9wz:74B6D9XcPJ0EnENIJV3HVNRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712198, "uuid": "fc50ce72-9554-4db6-8b33-601b77c5a865", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712198, "uuid": "c9be53f4-a09c-452a-9ffc-0dfeb1c6be83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712198, "uuid": "1087fa07-bc2b-4d4a-b668-0281b1eed4e6", "value": "SWIFT001411983HNK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45b20a6-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620714742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714742, "uuid": "59d698f7-7105-40a5-9a4a-66feed2b61bf", "comment": "Malware payload (Formbook)", "value": "901c55b3131ab4eb413d260253598826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714742, "uuid": "d08bd887-650a-4bd1-bb4a-96feb886924d", "comment": "Malware payload (Formbook)", "value": "368d310c0ed3d7bdcf493ea9bdd818d36c28a165cef65b73c89deb2c10905f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714742, "uuid": "252b80c8-95e9-46ed-9e3d-cecfaba9c5f2", "comment": "Malware payload (Formbook)", "value": "f1dde6f3ed9a08db6870299a72f366f882efcfb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714742, "uuid": "fecfa1bb-17b0-4390-9990-d74e387ab7cc", "comment": "Malware payload (Formbook)", "value": "ccfd024171d0657bc6eb9dbb5f241d5436554133b374b60d182fed3780ec0c69a385591c3a68b64b6ac2e036f55f6292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714742, "uuid": "2d4af2a0-d4ba-4b51-813c-3c09504586ec", "value": "AC2412927312C8F7DB7607B21E7317AFFBA86124705C6B0757401F6A29528CA5B2D1E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714742, "uuid": "83467df1-70cf-4c64-a1a9-ee371d30dc29", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714742, "uuid": "c122f8ab-f9f4-4028-bef0-46d72b27080f", "value": "6144:L9X0GgVrGtp0DCSrm3Q//xCg8U2irNYlB8JmesI:l0V5Gtp4CmLxcirNfgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714742, "uuid": "b876aad4-896b-45ec-b9e9-4081ddc69d5d", "value": 210618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714742, "uuid": "3fcb9fd1-5e95-41ff-bb09-67a9a1e4495b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714742, "uuid": "9154bacf-c28b-42c1-a1aa-5c66d8ce4bf1", "value": "ProForma Invoice 20210510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b194a10e-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620728937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728937, "uuid": "c8f8434a-303b-4feb-a1b3-459f76d5d683", "comment": "Malware payload (SnakeKeylogger)", "value": "06b47a4bc32b50a53e51ed01036f60aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728937, "uuid": "9271c9e9-4d59-410a-9e39-2252c6a115ec", "comment": "Malware payload (SnakeKeylogger)", "value": "3757c869c9c4e311a526cce16364a47e2a286006f863ff19f5fe3cc1ae289cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728937, "uuid": "126c9484-ba85-4b60-a896-e12225732475", "comment": "Malware payload (SnakeKeylogger)", "value": "7c999525e123af1373e3db8e297550e220ae0a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728937, "uuid": "02d78217-8913-4360-8e1a-2d8878c2b935", "comment": "Malware payload (SnakeKeylogger)", "value": "d9707b96b77eee6efd6e56beb6a7b0d2b4f76d6da73973b03f19379a75e24ba9edfda87bd8e69dfb51ccd7e46918e50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728937, "uuid": "89527feb-a4dc-4d70-a9ce-9259f7fd226b", "value": "E325DF25A644DF10DC3E5BB5E46858F043EABC06DA31E45F3EE83DAC35B3AE21572606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728937, "uuid": "333dafce-0236-4600-811c-3d744fc35318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728937, "uuid": "edef0ad8-4b28-4d69-a447-56c20a76cab4", "value": "24576:m3ZHidfsymaJyZ5xGvIjd7Fjp7Mvh4Bpo8lnqufH:mZidsL5xGQj/jlMZ43ognn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728937, "uuid": "031070fa-dd2e-4533-b951-cecca3122e6b", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728937, "uuid": "b41ee8d2-054d-4745-8ca6-513db2ab09d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728937, "uuid": "ff44f5be-8609-4efa-a5d1-44b107c8a326", "value": "ORDER PO-168-05102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485d9446-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620727472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727472, "uuid": "bff3770c-acd1-45ed-9ae5-e7ba22229b25", "comment": "Malware payload (Dridex)", "value": "fbd5e02e3bc0bacb0fd26384b348719b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727472, "uuid": "fb9c76aa-83e2-4090-9543-f73975d90263", "comment": "Malware payload (Dridex)", "value": "37b3dea4c6f9972e89e7816255802419a7d4c5752a2f1f3501a0c61d07f80736", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727472, "uuid": "f61d2829-a79e-455b-b1b3-3663383be9eb", "comment": "Malware payload (Dridex)", "value": "afa325ea0ab63f2265c14ed4cd6834dbcf30208f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727472, "uuid": "b79ea9a7-fe79-4c33-8e52-84476bb01617", "comment": "Malware payload (Dridex)", "value": "f6edbf7de6726dd3e7f218d9f4942dd1c962ccc1829272d5686d6fd2c07c5c7d565e04634a362093451879ff1104b5f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727472, "uuid": "639daca4-ae6d-4705-8aff-d1189b51071a", "value": "0DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727472, "uuid": "735613f6-cb32-4e3b-b3a8-1b559db1f972", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727472, "uuid": "af01cb8b-40d8-463d-9cb9-ecd06dbc7593", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727472, "uuid": "2021904e-af94-4147-85dd-be349da34e2a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727472, "uuid": "11df6e0c-60ac-49ba-a2c5-5d72a19dc08e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727472, "uuid": "aed4d239-ae7d-4d77-a694-84c1b6d7c301", "value": "fbd5e02e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c67259-b248-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731016, "uuid": "3484ba36-e179-45d9-a994-61c102152676", "comment": "Malware payload (Dridex)", "value": "9f194fec24218f1f796c6957ba4d256c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731016, "uuid": "e8bfb00f-b50e-4172-bdee-bcda68ad78b6", "comment": "Malware payload (Dridex)", "value": "37ba7eb8a1c633bb8fdc60009332d38f1db7adf73b1e2672454542adb7a3bea0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731016, "uuid": "ac64ba94-f107-4c59-80a5-22910c39f636", "comment": "Malware payload (Dridex)", "value": "a00c0b9e5403b987f5d1b8d7de2ba9d12be20c14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731016, "uuid": "7d24d219-08a7-4781-88cf-47d1928d2511", "comment": "Malware payload (Dridex)", "value": "1ee4fbd4dcf7f1d74aea67b28605f02d67a86d2c28872def89222db8073f98921374d0954e8b38d5401d080fb689485a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731016, "uuid": "b3ed7ea0-11f6-49b3-a930-354f30e98388", "value": "E0F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731016, "uuid": "a174c41f-e261-4e30-ac6e-5b3794d5241b", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731016, "uuid": "5aaf1b85-cb22-4e29-9272-022928357369", "value": "3072:rWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:r42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731016, "uuid": "850f378e-5c3c-444a-898b-8e162e219550", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731016, "uuid": "b6e44c27-f98e-4383-9377-74cf1851a374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731016, "uuid": "bb749531-e8dd-4e74-b0eb-bbbf59840601", "value": "9f194fec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6045248b-b230-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1620720640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720640, "uuid": "e3e6197b-d4d4-447a-b7ea-aa4124b2b887", "comment": "Malware payload (RemoteManipulator)", "value": "661c88e07591a8919e5004cc936ea3ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720640, "uuid": "be0242f3-5583-4697-b81f-aee68f4ae920", "comment": "Malware payload (RemoteManipulator)", "value": "38602e2e2f729e174440339fd1551e133ae03d93e16bbcef8f0b9c8aa1da9b1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720640, "uuid": "fc23eb58-e489-448b-a161-81636d4f6cc7", "comment": "Malware payload (RemoteManipulator)", "value": "5bea1ae34cbee1c09d10c7f4f7001daeb18d607c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720640, "uuid": "fe87548b-0674-45b7-b7d7-589b567f0fa6", "comment": "Malware payload (RemoteManipulator)", "value": "65a8a0ca671b82a0c0c3b4958f54a4cd693ce083307c122a935ee0e405b6c23cec425d66fe17896eab4d4620dc639303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720640, "uuid": "a86160b0-bbe7-4f77-bcf3-e70dadeb3eca", "value": "0AB63352E7E64829D4BB4BFE0ABD5B14177ABC995A1397CD0364F12C4C3338198A63CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720640, "uuid": "4b3c3de7-953c-4c38-98e2-83591ad825d8", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720640, "uuid": "cdeccb34-7042-48c8-be11-f43726bc4769", "value": "196608:zp9fLX9eVylQS1OnBXUc1Q4NUBD2LQVWuuFYcKXJgjaZdeCY:zH9ZlQS1Odx2WQ82cKej09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720640, "uuid": "af792893-9de9-4990-b83a-0dbcc4ef842f", "value": 11404528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720640, "uuid": "d73a8362-7f6d-41d5-b54f-7cf30757e8e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720640, "uuid": "50aef09d-b3a3-4760-85d4-d4a95194ed59", "value": "661c88e07591a8919e5004cc936ea3ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16e9eb7-b212-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620707892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707892, "uuid": "edfc8bf0-0baa-4e29-b95c-497b079b3e67", "comment": "Malware payload", "value": "0f95ad208afee32bfaf13056a9ecbf11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707892, "uuid": "94b1d517-93e1-4e44-a005-205ee27a1834", "comment": "Malware payload", "value": "38b0ecd4444b55f8fb394758ce1a5ef044ea08200277e1b1e2f1d1a07bf24a31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707892, "uuid": "0f021efe-8eb0-4772-9c8d-fe9022e3816e", "comment": "Malware payload", "value": "1353067b08034143f5719c07346bc9c576febe47", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707892, "uuid": "c621812c-9929-405c-8294-e81f8686bced", "comment": "Malware payload", "value": "fbc2897b154e753f9d4b1c75987202ef99246bc94822348d49e30fe964d964f83410ad33df406c6d17c062129733840e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707892, "uuid": "c978f492-4e45-4e1c-9db8-cbdbe9f840e6", "value": "5D2402678FC186F8C3256630C0119E34FBA994701DA5CF2BDB69E98B583633544E37AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707892, "uuid": "e6335d26-155b-4393-95a5-788ce0bda998", "value": "746ec38225ae36e5957f63ee797c0cd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707892, "uuid": "7d6f7d6a-b064-410f-aeb6-88e3c4528c53", "value": "6144:gep6Q9TR8VIU2PDLYjmbsMu0ZRc8T91Fbw:v9QqPDLJbsMlj/THFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707892, "uuid": "76c01eec-4993-415f-baa2-f821b1479850", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707892, "uuid": "29e1fc15-83a3-4ab1-8706-97e27660dea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707892, "uuid": "56dd654e-799b-4bcf-8714-a69c19a2cfc6", "value": "SecuriteInfo.com.Trojan.Heur.nO0braM5yHlb.11218.7103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc481195-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620770724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770724, "uuid": "16f6e6dd-20fb-4dbc-8b1d-003e9ea7cb15", "comment": "Malware payload (Dridex)", "value": "2bf7d4f791eff78f53000f1867126f75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770724, "uuid": "fe20b641-198d-475a-8c3f-de0a33dbc4f0", "comment": "Malware payload (Dridex)", "value": "38b236353af9be8aee8d256c9e3e499b4462d528b4c7b8934e8724ce3ded4f52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770724, "uuid": "87cfdc0d-fef3-41cc-9682-5d50bdecd399", "comment": "Malware payload (Dridex)", "value": "2bed9d0eff737044bbeadfd4f5db988aa9e6323b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770724, "uuid": "facea8c3-6fc9-4d03-8b3a-c8f5379bc3a1", "comment": "Malware payload (Dridex)", "value": "49be82e29fb174daccc1d1681094de4a3d6e556b4f1d376c906896d30a8cccef8bc61648d2ce6f55fdbff13e9bc6eea9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770724, "uuid": "90594359-fabd-4e6f-878b-5145fbc4b2f1", "value": "81F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770724, "uuid": "a6330304-1f2c-40c2-81c9-35b586ea4d97", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770724, "uuid": "e9779487-df81-479b-9fb7-5e35b20176b4", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770724, "uuid": "ee8c132e-eee8-4658-a90e-d08c812cc5de", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770724, "uuid": "d4507fce-4c6d-46e6-947d-1242c9ef34fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770724, "uuid": "5ce58a08-44e0-4bfd-978d-029b9a74af79", "value": "2bf7d4f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197c3ff7-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620691316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691316, "uuid": "48785e8c-2687-43d3-86d6-a4e01b027280", "comment": "Malware payload (RedLineStealer)", "value": "02c83f5255f43a2fae36ceb88223599e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691316, "uuid": "6f79f472-f2d5-41c3-895a-c3a4c05d3d40", "comment": "Malware payload (RedLineStealer)", "value": "3905f32293f0f6bb16fae72b8e80e124408079824fc9b2c76c03068947f07f46", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691316, "uuid": "2f7920a1-07d9-4152-ae09-345bcb84456d", "comment": "Malware payload (RedLineStealer)", "value": "81d3a39a081d3e8d590cf911635b38fca967901a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691316, "uuid": "96dc91cd-d72c-4ad8-85d1-70cbfdf28725", "comment": "Malware payload (RedLineStealer)", "value": "3f99a6087d4b04f7565ebfd553668d26065711ac440ecd21a147792cd649c34a81766c83b10e8d1da9da44e7fd8e4b93", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691316, "uuid": "ead4519c-893b-4554-9b7f-2dd7efffed1b", "value": "A933D03CADD3A485E6EA43BA710B12D37E4407DB27092E8B5506AA141437D33EB64FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691316, "uuid": "5d2d74e8-c8a6-4ab7-9010-d88ce88dc3dc", "value": "1536:cveMzTrIzC4EH3bUpPcxb+W2oDYS/oyjO861H6L0r:FkTr0C4EXbUpPsF2bOoy6t1aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691316, "uuid": "7f389218-a1a0-408d-beb3-85db80a9498a", "value": 51597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691316, "uuid": "35862053-eb6c-4137-80c1-9351f30723a1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691316, "uuid": "600df8ea-586f-4cf2-bf5f-ca8d9c00f303", "value": "02c83f52_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367bfe62-b249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731308, "uuid": "a46a7dd8-33e7-42db-bd66-bcfbd3584d14", "comment": "Malware payload (Dridex)", "value": "1f6900cf5529c273d9ec7c4cf4bc4f37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731308, "uuid": "a4a39538-0a29-499b-9022-864bed805e07", "comment": "Malware payload (Dridex)", "value": "3b2e2bb0852d0a073bfeef66b5096b37a201d981005334578fbec15d8224d846", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731308, "uuid": "f786ecd4-3185-471f-92f3-54a4a0148ac2", "comment": "Malware payload (Dridex)", "value": "05eec96c67baaf31578dc036acb40ea2a21387c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731308, "uuid": "a7e1d6e7-9975-4b94-aa9a-48383e347961", "comment": "Malware payload (Dridex)", "value": "815aa78babced46af1ced9207c4c9b5b248477dbcd0a42a7455db4128aa4ef3e9b621b0f60fee58ba8f4e3df42f6195f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731308, "uuid": "50152518-9529-4cfd-9e9d-1f0f8f220d07", "value": "5AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731308, "uuid": "43244a35-e2fc-4d92-af19-c5ae28674e50", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731308, "uuid": "d15f1c4d-dd5e-4173-9603-f1befc0b8a29", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731308, "uuid": "d15dff6b-fd90-478f-88a7-2177434e1ec0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731308, "uuid": "20a67b2d-afed-40c0-940f-a13e7c35fde4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731308, "uuid": "421dc1a2-1457-4fe9-ac7b-79ed0c038a03", "value": "1f6900cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8016457d-b236-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620723271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723271, "uuid": "55525999-7569-48f0-8451-b698a6255083", "comment": "Malware payload (Gozi)", "value": "50a299d1e92d9205e123404c8e05904d", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723271, "uuid": "39625ffd-39d8-4b9e-887d-9565b8d29888", "comment": "Malware payload (Gozi)", "value": "3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723271, "uuid": "75e92475-590b-4f75-b007-04ba909e9a05", "comment": "Malware payload (Gozi)", "value": "c188272ab757dbbf14e74781fc90fcefe4aeb615", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723271, "uuid": "eba3fc79-2fe2-495c-a88f-13638b71d1a0", "comment": "Malware payload (Gozi)", "value": "d6a460e6d51fac71adae37a68a4f33d8c58f1af2f71ea93a085135757a41969812a5d24d34c1014815439fe3f6ca4e3a", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723271, "uuid": "752811f4-a5e2-4c44-8259-41798af31a78", "value": "A5055D01B7908038F5B759F585BEA1A8693DBEE15B24D0C763C42AEE5635EE0BC30727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723271, "uuid": "78efa0fe-6ee8-42de-b7fc-6d7dc6b03013", "value": "dc55991f7b8a912c780d10d352635290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723271, "uuid": "19d4cc09-b8e9-4b91-b645-8dd29aadea58", "value": "12288:mzCoYRvNZrA8Res/TPUOjUUGcqcoWEx9kMGUS6vOV5y4gnuD5wtqqB7ol:VdNZr5RLL1AZ/clUnHvk5hgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723271, "uuid": "7750b246-54c7-4512-a9eb-82e69a7237b1", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723271, "uuid": "0c5bfb01-c68a-4beb-ba49-2fd5c53a5788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723271, "uuid": "2e33f45d-8737-44c2-a2b0-14c69c6b32ea", "value": "609a460e94791.tiff.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d4ddbd-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620752545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752545, "uuid": "8c78dc38-2a00-4b85-9621-14cb3b17362f", "comment": "Malware payload (Dridex)", "value": "68f8446b460ecf33e7222eeea4c5e721", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752545, "uuid": "cbe57e6d-e218-459e-a4a2-9948b38d1ab6", "comment": "Malware payload (Dridex)", "value": "3b5e979706bf2c96e096070b256b8ec3d7186ec48c31202fa776de533289281a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752545, "uuid": "95b1ed09-91d1-4d76-b53d-0e17d26515d2", "comment": "Malware payload (Dridex)", "value": "06c9f6faee6675a3d0c52b92a2500f32fed3c139", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752545, "uuid": "cbcfbc4e-2121-4d8f-9d04-dfc07476eb78", "comment": "Malware payload (Dridex)", "value": "8868fbd0af4a0e4f8560ef3f1dc6b3b6b6a19eb3958b7a69e650ead529cf94fc4e6071dd4949740fc0636481e24aee8c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752545, "uuid": "88f68b8a-c48d-4f39-b62c-eacd6893ae2d", "value": "30F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752545, "uuid": "ff28dcd4-4e45-4b32-9939-ae47d356ab07", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752545, "uuid": "38c4ac41-918f-48c4-b8ea-cf6ac145a6ad", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752545, "uuid": "c5e23b24-86b8-483e-aae7-60d4b9a89004", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752545, "uuid": "879adf62-445a-4ac9-8b56-08befce8b97a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752545, "uuid": "fc5fb5db-c65b-4357-bf51-443d15cdf4cd", "value": "68f8446b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be76edb-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712875, "uuid": "a67eaecc-205f-4ca0-99d9-e6e3304c3c39", "comment": "Malware payload (Dridex)", "value": "4f0e2f3ecfc2a25c90391671b9a6c060", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712875, "uuid": "0bfa1fd8-2bab-4279-8e3d-f60effc28509", "comment": "Malware payload (Dridex)", "value": "3b707749350ea8c4eb6c16a6da18dea2bcb54fbb03bb8ef828f2541119dbf5e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712875, "uuid": "9c70cbee-53ae-460b-89c4-3f292966b3c1", "comment": "Malware payload (Dridex)", "value": "ec90b4735103b7bb3159e84f833d06ca32e5338a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712875, "uuid": "d9c2cda4-9398-4964-9152-e167d878863b", "comment": "Malware payload (Dridex)", "value": "0cb32cbf7910131175e64bc24502fe02b568ebca988a6d2d31ae2872dd2bf0ccd5a9ef944ea24691402d8aaf9dad92ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712875, "uuid": "b29f8cf6-9d32-4ead-903d-c16af7f462b7", "value": "02F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712875, "uuid": "3f4842e9-5290-46af-a06b-b2388976ef62", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712875, "uuid": "59346bef-27d0-423b-bc3b-6c545775ce2b", "value": "3072:hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712875, "uuid": "ae999afa-c56b-4208-80e8-4560d7ac5a1f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712875, "uuid": "fce43c34-9e9f-4b5e-98e7-e12e0abe364f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712875, "uuid": "036d0e44-bd27-40e1-8e38-9f3e97bc724d", "value": "4f0e2f3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e3f7e9-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729448, "uuid": "ccd3a5d1-2bb8-4651-bf05-961cdba93108", "comment": "Malware payload (AgentTesla)", "value": "6d438ecb10ecfbe8f9ad910aeea5a2ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729448, "uuid": "3fc73839-49c4-4348-8e29-ec1d7b962bf2", "comment": "Malware payload (AgentTesla)", "value": "3b7316582c9b3d382e1050a88b6a07640c45de22be0f547c6bb04866e394e2b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729448, "uuid": "e26170b3-9406-442e-82ac-0cbde889a0ff", "comment": "Malware payload (AgentTesla)", "value": "7d6b73844c2bc14c1b1a88b43922d605e3d5c8f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729448, "uuid": "047641a4-9adb-4132-9d2f-81f456987bbf", "comment": "Malware payload (AgentTesla)", "value": "16291450c477c1ca3557202b4ac1d4ae071136b28766b2e9332c413d833a2591964c9263441e900f02cf38c568254e8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729448, "uuid": "aaa0043b-4560-4e83-b20a-f2ca0be041ee", "value": "49A4125222A8D461E68E883E6FC06ABC06976D808771854738FC3D96BFB7FC15167B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729448, "uuid": "46c192db-3b02-439a-a48e-639a8d532f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729448, "uuid": "4b3d8198-5573-4864-82f9-f12c3359f1e2", "value": "12288:sRrRE272MKkwOuK/hYwkNztBMnyG+neYKCN:sHEw2OlZVwzDJG6eYKCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729448, "uuid": "d352b392-f2e1-4ad7-b376-e7c5b8f7332d", "value": 486824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729448, "uuid": "b1e7523c-98cd-41c2-a262-ff2f711b7f4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729448, "uuid": "88365b67-4a25-4fad-acd4-903e9899819e", "value": "IMG_056_102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30c1449-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620770601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770601, "uuid": "a7aa01a6-1731-456b-86ae-390f269c1ac8", "comment": "Malware payload (Dridex)", "value": "2452e107cd94aced65e3b511e49cea41", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770601, "uuid": "543b6e52-22fb-46b2-a4c3-a6c8899260f1", "comment": "Malware payload (Dridex)", "value": "3be7fe11c22ebdd6b0de0ab4331542e48431238e13a3da66ce25685ec5205777", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770601, "uuid": "84c0aae1-014f-4f0f-b255-3ad1b8e9c8ff", "comment": "Malware payload (Dridex)", "value": "eb428a99d33b795bf96eb487a34f4b892a364043", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770601, "uuid": "3cb51457-9ad8-4598-9ced-8679d424adcc", "comment": "Malware payload (Dridex)", "value": "907f4974dba262d687ad3d1a74a5a5afa22122509208932ffaba4f22b621fcce7395387a93a3feb82f57786c99ea2346", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770601, "uuid": "6f92af9e-8f55-4574-8532-74aa70cde567", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770601, "uuid": "21a3f405-c9d7-4e1a-a451-dbeb3abc46b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770601, "uuid": "d6a8dda6-eeca-4f4c-a393-dba043f34276", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770601, "uuid": "41749fca-c428-4a51-bdfc-c42a0c4f758c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770601, "uuid": "057762ac-7bb3-4caf-99f8-7909e0a61e0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770601, "uuid": "cf66f597-46d6-4097-8231-9f736befb253", "value": "2452e107_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dad684-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691254, "uuid": "b2950acf-55b9-4210-a757-5ff0b8039b56", "comment": "Malware payload (Dridex)", "value": "ac2743bfd6b0824b040db153f278362a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691254, "uuid": "6ca6d6bd-5720-4908-89da-c200d8c1a48e", "comment": "Malware payload (Dridex)", "value": "3c84ba62fa92b510912221f591f9fa78f367823e28dafe987482d7beeb4a4cf6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691254, "uuid": "5de8df28-df24-4d4c-8569-6add4b11930b", "comment": "Malware payload (Dridex)", "value": "07091f5b0a6071755461bb35a50e7855d647fc65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691254, "uuid": "0dc17f7d-e5cd-4560-a810-ea6c7d9003d9", "comment": "Malware payload (Dridex)", "value": "7b6e3b362e3925985b48925b808636b83c2cf72daa1592dd3e5cfcb85b3ac33aac9066ff49adcbcbdf8cf99defb7af22", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691254, "uuid": "1a945ca9-9f0b-4e35-9437-4f6aa59a77ea", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691254, "uuid": "6f6136aa-60a6-4198-8316-aad9a52d0411", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691254, "uuid": "774d61ec-cdb3-4c38-b69e-2c7af5529e30", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691254, "uuid": "afe35b2d-9ace-401e-a192-b5a276a876b1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691254, "uuid": "a876e122-fb30-4136-aa11-491d53c9fc32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691254, "uuid": "2d431725-a157-4a59-9995-e4892fb6ccb1", "value": "ac2743bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea3952c-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716396, "uuid": "c43f4104-77cd-4472-aea2-6b892f5bddb0", "comment": "Malware payload (AgentTesla)", "value": "fa069a5acb37d830f61664ba53b32624", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716396, "uuid": "0fe2b089-59fb-4a1a-a0fc-539ecc6bf983", "comment": "Malware payload (AgentTesla)", "value": "3c85931bf1af4ee5cf40178294c13819e25ed2d795380fa8366557b26e7d0be4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716396, "uuid": "de619a2a-877e-48f7-adf9-e986ee1eb3bc", "comment": "Malware payload (AgentTesla)", "value": "3c0f2acd240b5750711692fd1bbf69129e00c577", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716396, "uuid": "11f91933-2002-4526-9908-0aac6623b824", "comment": "Malware payload (AgentTesla)", "value": "1c02b4f48fc2780dc44433406f4c439fb0452168af40b0c511700e6a4a0df8256427dd2ffb5051bfa25b284fc5e5c82e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716396, "uuid": "09116fcd-a3c8-497b-b2a7-149e3573d5ae", "value": "F105230372F06B25D0BE17B62C91295543B4E125E07AEB8C7D4850E96DF33C48BE9BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716396, "uuid": "00dcacd2-fc78-4d4f-ba98-10b93fac1f09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716396, "uuid": "898e758e-81fe-4061-bdae-4cc4140f2f89", "value": "24576:8T85HJdLQl/dxkOOOjRjGpGxrkQD3RSyyKYJ:c85YZVlGoxQQDjyKYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716396, "uuid": "6c981a95-b36b-40c5-90f3-7f305d4e9a35", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716396, "uuid": "9807376e-bc27-4e75-a82a-6309af8d7bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716396, "uuid": "34c857ac-421d-458a-9fac-e87a5223e395", "value": "Quotation RFQ8116300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2f37cf-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715483, "uuid": "fd4049b1-1327-4eb3-b6b3-a0a75492f36c", "comment": "Malware payload (Formbook)", "value": "d369d860af5c562514c3094e9f97d532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715483, "uuid": "4093c6b8-dcda-402e-8fb4-f69e0e713772", "comment": "Malware payload (Formbook)", "value": "3c8992a1fa966b9838653d1276934114b1e3536d2d0d47172ef4c67af1ef3b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715483, "uuid": "9dd99563-796f-41cb-8141-7f49f8d0f6b0", "comment": "Malware payload (Formbook)", "value": "9438d9e64851ae3fb08ce9a644f31874470f52de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715483, "uuid": "14890ddd-faa5-4f79-9d80-8c0ddaa51e40", "comment": "Malware payload (Formbook)", "value": "0a1426f2115a4c870555188ab8759d50045b69719b659485eed9304aa9f95507c94cd106cdf97f3991d6b636a01e5f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715483, "uuid": "5bd7c6e4-9d88-4775-9df8-bc49e01dc277", "value": "EE44D159F792DCE5EE27027518761D262F62B85E60A8090F239DBB163D13363412F9F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715483, "uuid": "79e38182-ee55-4607-bf68-81d544718c70", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715483, "uuid": "95009102-968e-4159-8270-63c5e9778f7f", "value": "6144:a9X0G6+kwcc9de9JTSxYdHVo2PtqCAetk1P:s0K9E9IxYdLqCAeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715483, "uuid": "4323c4d3-a9fa-4366-b292-c6f5399cea41", "value": 259771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715483, "uuid": "ad1aa529-63a2-4fd9-9aaf-4afb1dd64010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715483, "uuid": "1b336d7f-17c2-482e-aafa-24ac12a14483", "value": "PO09641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee976872-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715296, "uuid": "ae853229-3666-4f7b-84ba-30e24ae87e41", "comment": "Malware payload (AgentTesla)", "value": "263e47d35e99ebac6c25b6c90b2368d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715296, "uuid": "47fb7e75-0cd0-4dfe-8a6d-e8fa26933a48", "comment": "Malware payload (AgentTesla)", "value": "3ca4534bca4c747c5cd29a1810733cdbaaaf85d8a6e03e23396faa9934b3ffad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715296, "uuid": "53c45f86-9ff7-47a1-b719-f412bcf86b71", "comment": "Malware payload (AgentTesla)", "value": "715ad07328507cc94f96ce5e4a5447664e9d6781", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715296, "uuid": "a0f3d3c7-e45a-4334-a87c-1c6848f7f7db", "comment": "Malware payload (AgentTesla)", "value": "900e19b67143b22501c25a486cce8a2996047901818adc6e7496d64a996a7a8a4a2d8fdb5121157f6f8a21c067cf32cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715296, "uuid": "4b88e346-f638-4b07-b2c5-e7a113e12705", "value": "EB05230B33D19858C6FE4B75646125052AF4B2526720F74D6C8CB2FA0AE7FD4CB627E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715296, "uuid": "8b40c812-a96f-42f8-9897-27b50ed75dad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715296, "uuid": "ea4c37a8-4375-4418-933b-f1893dfe9982", "value": "24576:Nbt8xtRJq/VyzlWbDT5C8Yitn3XTq1hr:j8x7Id575aQ3XTq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715296, "uuid": "5dfe1484-d717-4128-b3af-bffcf6e4a41b", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715296, "uuid": "5ff4813d-8fcd-47bb-8f7a-aef64d424dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715296, "uuid": "fbcc51c2-9657-4d19-998c-120d95613bda", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef730f3-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723645, "uuid": "718cf724-afc0-4dbe-8bd3-73fee845ad5e", "comment": "Malware payload (Dridex)", "value": "0d535b6fbc18622f12a12a3522e03c4b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723645, "uuid": "2ef9f559-9c6d-4d37-a06e-e227f80e2775", "comment": "Malware payload (Dridex)", "value": "3cdee080319f7306f79c841335d306332f2656a2746d907d07399a0fb1f09801", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723645, "uuid": "a0a67f83-3bf1-4d74-b20b-65745ba9cbc3", "comment": "Malware payload (Dridex)", "value": "de2ec325b1c561c1d4529af50e3f58739d2d938c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723645, "uuid": "84880d21-57b0-4923-bb33-c5cb47a5a449", "comment": "Malware payload (Dridex)", "value": "3a53da5729d28bd1cba8be5500897828761e7eee7193809981546a3fffb841684cb2a0c6a1883371d3ac291346fd6108", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723645, "uuid": "0b64fdda-03ff-4a3c-9c3e-b9bba8ae6cd3", "value": "18F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723645, "uuid": "8e029b85-11f5-4bc2-b4e7-f744c0d0c9c5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723645, "uuid": "0b199945-ab70-45bc-a4c5-70b25ae1127f", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723645, "uuid": "82144b6b-f195-45d0-9c2c-714c609d4c63", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723645, "uuid": "f07dedfc-66ce-4030-b539-03d178e67fa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723645, "uuid": "5285e8d7-9339-402e-988d-6addfd09a627", "value": "3cdee080319f7306f79c841335d306332f2656a2746d907d07399a0fb1f09801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd81cb17-b282-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620756069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756069, "uuid": "8219010e-aa99-4b91-b143-9d9541933687", "comment": "Malware payload (AgentTesla)", "value": "e42be4c2bef28b787415d24784cea4dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756069, "uuid": "cb7e5ffb-3d26-458d-bbbe-a63ebd158f94", "comment": "Malware payload (AgentTesla)", "value": "3cf09e3ead82fa06d88c5a2752ba881adbf76cc2ebaaf490533e1fa8ad788060", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756069, "uuid": "8796887f-472a-4444-93e7-3180e4b054cd", "comment": "Malware payload (AgentTesla)", "value": "0bb2b61e5418a1335b01fef8f0bb7f5166e4273f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756069, "uuid": "a24c1b0e-88e4-4a77-a712-7ba426508490", "comment": "Malware payload (AgentTesla)", "value": "24ede374fe8e6aabc788876076aab816578d4d4ce3b122326c76366124bbae959f5029eb740a0d293ac061c43d09de4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756069, "uuid": "4475ebe9-f0b6-471f-a736-82d76d8cf5fe", "value": "1015023233685FA6F6BEE73D5850004463FAB806D725EA8E7EE805CE4865F814772F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756069, "uuid": "23f62fa3-8ac6-4736-b4a3-572e4f0b182e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756069, "uuid": "c90237bf-46b8-4e38-a87f-97b698d667c3", "value": "24576:EXrDIMm7wJbCjUjacMhveVb9mIQ7RU5d:Ew1Ibx+cMhg5QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756069, "uuid": "7ca066f8-e7fc-4321-ab29-bfc472fb8ade", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756069, "uuid": "c09be8b4-dde5-4e04-8086-a3e760268eca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756069, "uuid": "a5c8cfae-cfe2-474c-9176-48c8afe024ff", "value": "Urgent Attention Required.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfd5a1b-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720204, "uuid": "68a39d19-839d-4da2-b210-5c29d9831e65", "comment": "Malware payload (Dridex)", "value": "6790bc616d4f741287a010a7e756b973", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720204, "uuid": "ccfea924-6da3-4b6d-92af-000ccc94a7a8", "comment": "Malware payload (Dridex)", "value": "3e0eb092f36cbc5cac24ebbd221aac6924cd9406f1f0a583069550b8edd5863d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720204, "uuid": "ab5f035c-0776-4ccd-ae6e-71894a563434", "comment": "Malware payload (Dridex)", "value": "89ce379a70df07d28430cb67c82486722fbdf534", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720204, "uuid": "25c0fcf0-8d64-4e83-b412-f9e59811ed23", "comment": "Malware payload (Dridex)", "value": "691b7fa88952de977fe40ec909b196d22a39cf2b5f7e96765e6e4a66482d3884d7099eafab0d97f17d67c07eec7a9969", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720204, "uuid": "cd47c6a4-7bf7-4c66-a2b9-d373ea5cbf2d", "value": "6CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720204, "uuid": "c2a48608-3679-40d3-b579-014ecabd3f41", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720204, "uuid": "b27366f6-bd8c-4378-8d6c-ac8b5d9d97df", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720204, "uuid": "3a70f33d-3479-4826-80c2-1ecb3928ded9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720204, "uuid": "573f266c-22a2-4ca1-9162-78c55738020b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720204, "uuid": "8710772e-90f9-4851-a9c4-e1531ebdfd80", "value": "6790bc61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd2d226-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716422, "uuid": "88a35d7e-a289-4e8d-8eb2-9fe75d54e5d7", "comment": "Malware payload (AgentTesla)", "value": "ad623a158d7f37f547dee2ba01646c0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716422, "uuid": "fbe7aae9-7b51-48d6-b560-9a09e9968717", "comment": "Malware payload (AgentTesla)", "value": "3e144aa347f286c75f9ffe827f6239652065f468794bf567e47d87e29c3ea53b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716422, "uuid": "0fa9b65c-b57e-41b9-ae14-4d593fcd7177", "comment": "Malware payload (AgentTesla)", "value": "3d55829677ffb85e1be6feded9bec255163fe250", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716422, "uuid": "d3204c0f-cb7f-4580-96ba-bba8123246d8", "comment": "Malware payload (AgentTesla)", "value": "e00e448be8c8109cc45e8f4a18e61820fce75496efa53d7c88c4bedd0f1f37b46dd06bced1631f7bbbc54d59531700da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716422, "uuid": "fd63a3eb-7dc9-4a75-a27b-2d27288fe381", "value": "DC05222322F85B9DC27E17B560A86A1047F4F8857352E71C2AC446BDC4E77EA1EC97E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716422, "uuid": "ad18288b-326c-49c4-a2e4-5fcbb5f5dd0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716422, "uuid": "ac855a1b-e0ee-42f1-95fa-7aa3fa128570", "value": "24576:kcwetWWi2yVVblaGZMKQxzcE5msjeUXpoygwH6v4Ajo:khetWW7yd/SZtcE5msxpozwavC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716422, "uuid": "c37145a1-e2fe-42f8-8b98-74fb205e0132", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716422, "uuid": "0908fbbb-9f03-4df2-a940-67c64cf024c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716422, "uuid": "5aa617fa-3df7-4e56-909f-c8062a335106", "value": "INVOICE34 56730015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bed390c-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712956, "uuid": "71ed9ae7-2cba-46c5-b2f9-a2b7f36a6fbb", "comment": "Malware payload (Dridex)", "value": "b210a65811cc9ce79934f37339cbe4c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712956, "uuid": "07eaba2f-c890-41c0-883b-676f2fac0b0c", "comment": "Malware payload (Dridex)", "value": "3efda7f649065265b444048bf851461ec45bf1dab03827c98c7467d99f3c36a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712956, "uuid": "2cecb48d-b449-44f9-9b23-d4b11f5bad27", "comment": "Malware payload (Dridex)", "value": "c14352e1aac604edb11e093e417f2976489fce61", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712956, "uuid": "30806f97-f173-4d8e-937a-d91fda0c8518", "comment": "Malware payload (Dridex)", "value": "545d4bac80cde7f9585cd101067954f2b0494c596351c3519c24d3fa19f3481c2afd9f3dad5b8433931347dca0d55acd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712956, "uuid": "67fb5cfe-caa5-4560-a3c4-90d670fea0c3", "value": "10F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712956, "uuid": "177ff321-4102-44c1-bc2a-801fa8759f36", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712956, "uuid": "c2f235f1-231a-4db0-a2aa-550dd4994175", "value": "3072:9A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:93J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712956, "uuid": "c3a9c950-7840-4e62-a17a-cf38e9d9cf6e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712956, "uuid": "cc6e8689-8571-4288-82ab-efcd82c85640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712956, "uuid": "601a0db3-76fa-4cb7-866c-8c322fe4c66e", "value": "b210a658_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8669ebae-b23e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620726717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726717, "uuid": "038f3f92-ceec-44c7-9959-5215c48ebcd0", "comment": "Malware payload (RedLineStealer)", "value": "539867f83a45da02f488abafdaa91625", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726717, "uuid": "cfff9d9e-fa35-4809-88ca-31c24759db79", "comment": "Malware payload (RedLineStealer)", "value": "3f37a828886e9d898ead8ee9ad7b6fc2fc4280dab76f3a3242ef2a853bbfde92", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726717, "uuid": "d82e2c02-e8a4-49e4-af7f-b2763aa2cea0", "comment": "Malware payload (RedLineStealer)", "value": "3aaf007cc080d74ec57aeebae16904eb5943d74e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726717, "uuid": "07553eb5-594a-4aa7-8b86-c8967e62b3fc", "comment": "Malware payload (RedLineStealer)", "value": "1f2488ba769f0a52e0a984e5ce511d40583cda4652aaad843cf770f4ecdbf84bd67675e7dcbdcad0b65be7316e09955d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726717, "uuid": "ad1ffed9-4894-49bc-9aca-9b1c4fa29f73", "value": "FA254B8D3240B6DFC457CC7289AC5C20F6A078BB831BD20B61532AADEA8D657DF151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726717, "uuid": "dd5fd50f-cb71-4c85-8b77-fbcd67dc9f18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726717, "uuid": "548a629c-d962-4fa6-a81c-9c5ec5584721", "value": "12288:J09wg0Db0ycb9KIcLJ9J/DOZjWTiz02rxpLcAafIB77zYhBPkj1lKy+29EGJY2TC:JWwPDbSBpcLJDwV0eFafLdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620726717, "uuid": "08d9a603-3a58-4499-a761-fc322c634d38", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620726717, "uuid": "a5eb41ae-e463-4114-aa0d-6c809eb845a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726717, "uuid": "dda53618-df98-4f5c-82a3-5f345ef47db8", "value": "QUOTE_GMC990223399484002PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7120c457-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694899, "uuid": "78e03536-2dd1-485f-8ac8-875a338e0505", "comment": "Malware payload (Dridex)", "value": "c900639c510b1e2365607b855c08ac6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694899, "uuid": "ee9637dc-8e4c-49a4-9db8-6ae019abf507", "comment": "Malware payload (Dridex)", "value": "3f3dca65987c9d23c6b793ebc301c59bda841c84cf04ee927e401f99e9be73a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694899, "uuid": "9a48fca1-93c0-4ffc-ab30-ea58a26b6e8c", "comment": "Malware payload (Dridex)", "value": "1f4c8dbb0e3eda6b2250d7353a995db7059d9497", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694899, "uuid": "8a0fc0cc-b6da-4008-8a0c-5871a0d3e1f9", "comment": "Malware payload (Dridex)", "value": "aa437d94a03c8c17f900dc9621b8d5578aa6cd407a5bacad7d7e37dbd51cff5392c77615d98c88c4cc518119cbea2b7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694899, "uuid": "f29f4861-a459-4d24-adb8-d7144d3e4785", "value": "27F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694899, "uuid": "e0b52bff-fe74-455b-8934-01eeaa180adf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694899, "uuid": "1f5e3f0f-b8c0-4c14-a6cc-fc604c9818ff", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694899, "uuid": "15527489-63d5-4088-b7e1-7d182baf414c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694899, "uuid": "2360d57d-0850-4864-9c34-8439bb55a653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694899, "uuid": "065f6588-0cd8-4b27-91e7-8432980d45b5", "value": "c900639c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87936d34-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705674, "uuid": "2ba0b251-3a7e-4df5-8d69-24a1c29a7f4d", "comment": "Malware payload (Dridex)", "value": "0898ada96a99ff620989f7086851d13b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705674, "uuid": "5d332f3e-c946-4ff9-a889-66d8da57653b", "comment": "Malware payload (Dridex)", "value": "3f71e329e7d3781adb70671eb50f8f8c1e8a54e5a954f98d45f7c41587573d76", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705674, "uuid": "fc4807b2-cf67-4997-96d9-3c9bad389f81", "comment": "Malware payload (Dridex)", "value": "964e2bbc8166d7d3dbd94ab4843d678a995d2b00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705674, "uuid": "3c5bb1df-448b-42f6-8cb5-0353d7642b06", "comment": "Malware payload (Dridex)", "value": "35651f9e2d10b69bdaea04b2d4e2afe9f6945ccefc93b713e8f84220074e817f1c974118d7e7dd5026a58f2e0fe31060", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705674, "uuid": "c51035b9-bdc9-46c2-b069-a74b24e18c89", "value": "98F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705674, "uuid": "f701c7b2-8b37-4282-81f0-36168aa5302d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705674, "uuid": "482a25bb-1dac-4519-aa02-e6481ccc6ed9", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705674, "uuid": "0466b48f-1a6c-40ec-b515-c1ba10535bed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705674, "uuid": "fb6765b7-6643-4b98-a2a0-3d42cc8c1298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705674, "uuid": "101fc5d5-0686-42fa-85f6-217152bb457b", "value": "0898ada9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd15b3f-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620728795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728795, "uuid": "cf5aaaa4-c880-456d-998a-e1e56c19b687", "comment": "Malware payload (STRRAT)", "value": "397104fac578a0ef2984ccd0483595b9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728795, "uuid": "e6556fa4-11a3-40fd-9baf-c13cb9c3f443", "comment": "Malware payload (STRRAT)", "value": "3f8975af51c5028a28097bd0fecc58a92f083abaa347c1f3565fe0309f0286c3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728795, "uuid": "4751b841-a5b1-43de-a2f7-8cf416197602", "comment": "Malware payload (STRRAT)", "value": "f691f3345cfe94c9e0cbc115ea60d4374e1bdd9d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728795, "uuid": "abff13b1-0be2-4d18-8041-49b81238c9ff", "comment": "Malware payload (STRRAT)", "value": "fdcf981fc0925275555f188217c3f760a3c335193f31fca6263f735dcdd96da991d4bdd03b3e555641eec3c4f3722deb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728795, "uuid": "ca0692f5-de36-4f6a-a186-384f52679a32", "value": "1BA3CE1B7DEEC6B5C05B983215468232FA6C02D8C20DA51F6BFC446A8E74D5D4B62ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728795, "uuid": "4fc68a0e-fbac-4d5a-a835-99ac6b70b4d8", "value": "1536:GZeX/6zp1yXUdC77nADXxQpsgO1KJmbGPxKtleZ3YiVRVRE8th4cR:L6zpkUqADXxDFbleZIiVZxh4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728795, "uuid": "8c514b8b-cb20-4285-a099-11c1aed294e9", "value": 104360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728795, "uuid": "f4f6eb17-6e8c-4768-a37f-62426267b1df", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728795, "uuid": "0df27a5d-69b8-407a-8be0-ef877238711b", "value": "shipment documents.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a406e5-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "d5ec2295-434e-4e49-bb4f-677bd1fe458c", "comment": "Malware payload (AgentTesla)", "value": "e52a26006e43f78e359780c106d0f320", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "c0384ef5-732d-4ece-8fa7-c29c797c2085", "comment": "Malware payload (AgentTesla)", "value": "3f90d147e92d4f831d295174b8c280854a110a40224b09630a252d6795cf3efa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "b2995775-1391-426e-930c-69946883c0e1", "comment": "Malware payload (AgentTesla)", "value": "04d6b4ea7102bf81e02fb81747dd44b1bb79bb2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "47067dad-a5a5-437a-8333-748c02eb336b", "comment": "Malware payload (AgentTesla)", "value": "9a9b9003c3333e379900e9bafccb577a92bc6188cae0a45f511ed2849a44a63dea0feb6aa94b48c6168b4d801c5b83f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "bfcebff9-4a56-4973-9e98-39e075580844", "value": "FCC5E05543B78E5EB2E00B18BD5EC08E5D463CD8467EF0152E018B7BDA766028BD9B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "dc06d860-5185-4be2-aefd-3696e45ffe5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "4e864cd7-bd6a-4975-8940-0b7b9afb5a7e", "value": "384:kTCvYfqCI2avpCLJP2vp8igw7/UnzeyutGGCeZL/s0oLrps7s/ZYRqVOOWhlD0cL:0HI/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712898, "uuid": "837d7467-1bee-4be1-a8c3-b64ee767a91f", "value": 2562560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712898, "uuid": "57dca6b2-11e9-4225-a50d-40280a26db79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "2468995b-1356-48c6-a278-1fdedd57f674", "value": "TJ190001-P-IW-DP-GA-2047-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a113fe8a-b262-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620742224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742224, "uuid": "0999f131-d05d-4c70-8021-a402c1cbb9b6", "comment": "Malware payload", "value": "5ae1db8832adecff1fd76b0fa2a4e03f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742224, "uuid": "ea32871a-bbe1-41fe-950d-9f8c297ba6e8", "comment": "Malware payload", "value": "3ffba4f273f76b14cefd4230125a44407d73255549723cc0843d75a42070cced", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742224, "uuid": "3c625ee8-49e7-4c18-843d-4e0ea883773f", "comment": "Malware payload", "value": "a69cf29cb02410b0abfe4222e9abf96faf1bc2bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742224, "uuid": "2ce30f06-0a9f-4c6d-bab4-fcb2f0c21c62", "comment": "Malware payload", "value": "ea56eed36a831f34ec34833f25d73ae97968ba4e36bbbeb5706c29b168cf2aa8bfa8512b485d15da214b1b1900cde0b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620742224, "uuid": "dfafc2bd-7249-4ceb-8c14-74893ec9e355", "value": "614423F63FCA05A462D6562CDB8F033CE8FB22A265014AD519DB399A941376C09CFD4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620742224, "uuid": "c6a3ec2f-57f5-4dbf-a5f0-70ea97e48e9f", "value": "6144:QJv3oIUdIJlte3b2J6MgmpgLwazrSviysbYw6zzoRTuXldxy5:ggIUdIJ/oCJ6MBgL3e9DoRYdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620742224, "uuid": "9588c654-2e3f-41f4-a6b7-3051c007c92d", "value": 269507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620742224, "uuid": "dc9a17a2-c9ef-4da7-ae61-b6b531019e88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620742224, "uuid": "0cb31310-47fb-47ef-8f9b-d9a87032a2c0", "value": "TT09090000.UUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f4bb35-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620717113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717113, "uuid": "5c123203-6e8f-41b1-84eb-eff590490776", "comment": "Malware payload (NanoCore)", "value": "858f1b8a674c27585699974f7d6a471e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717113, "uuid": "1f91f566-828b-427b-a402-94204f311592", "comment": "Malware payload (NanoCore)", "value": "40b5ac8fcefc98a9feb178542659bc830beeae78e6bd813a3c1cb5d75d4b8801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717113, "uuid": "9980eb37-f902-4a0e-9304-dd9d6f737c92", "comment": "Malware payload (NanoCore)", "value": "87e0520b23807e3f7e3e79e977e51d00f2e3a789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717113, "uuid": "afe28e32-c079-4748-9536-985eaf3c7a67", "comment": "Malware payload (NanoCore)", "value": "893a44f426d9dc8d76ce400fc78c87a6fe2d89660773ed0823ab29746fcc42a82207ff2330d6542168f10c0ffac0442f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717113, "uuid": "f5449dbb-949d-4f3d-a5db-7f5b5272e2b1", "value": "34559E69B742C084F96E14B5CDA0FBF0052ABD2BCE0B6E1702563ED1347B6679B3A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717113, "uuid": "05b9f129-d5d1-40d4-ae68-8aaeeb53b944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717113, "uuid": "06c00301-56f7-45c9-8dfa-4409a7446b79", "value": "24576:znjeGVfiCia9MswPQvtHFIOQKgjO7KQJe6RV1qiK:znjbVyaez4vVFIOQKgQJe6RKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717113, "uuid": "b05a61ab-78df-4bbc-bd60-4811260b70b5", "value": 1374208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717113, "uuid": "0c8db0c7-649f-4d6b-92d0-82c1cc3cfb0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717113, "uuid": "a44c46b9-d6f9-4407-b1a2-fe71ef7117c3", "value": "858f1b8a674c27585699974f7d6a471e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db3319a-b24a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620731749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731749, "uuid": "eb22fe85-7884-4267-81b9-20165c4f919c", "comment": "Malware payload (Loki)", "value": "534e325601d10023ace9461ad5051f74", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731749, "uuid": "60412e60-8c91-4d07-9437-9c32fde97457", "comment": "Malware payload (Loki)", "value": "417a33c2d1b075159eb78934740620abac3e12b838b7d5c035fef9306f5a598f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731749, "uuid": "ec36ec63-9da6-4b9d-b2bb-aff636d23d55", "comment": "Malware payload (Loki)", "value": "45510f38a9ea49b6723b84084bb8aeccf5cd7bee", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731749, "uuid": "e0b076d2-a767-41fa-853d-9e2193d0dc34", "comment": "Malware payload (Loki)", "value": "1a3a86eed9565839c82c226111ef34a997ea706e25f402783f362d66f05edf05cb1532ee5b2ff5e3a0267a2497331d47", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731749, "uuid": "d4a4db19-5219-4c33-933b-e745bbda0abb", "value": "7AD44ABC754465F0E35B5E2263CF0C0643651274A93BEA0A8F6013FA5A57F273E39D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731749, "uuid": "f3d557fd-7b11-4554-82a5-f92e9d2c14c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731749, "uuid": "0e6b1b8f-6640-4ace-8d44-cff5f7ad0d0b", "value": "12288:yooLLoS60/K7yh0U8aWWVF8UJTrtWB1dCMd7WjI0v:yooLAU8a37nKCLck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731749, "uuid": "4054e346-4658-4e4a-9d9b-5b67de0fbcf0", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731749, "uuid": "c3bf07dd-d517-4bd4-9df2-26273cfb4c2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731749, "uuid": "f73d9a29-3f15-4c9c-a0f6-afec85295120", "value": "KAi3qCkCrMADbj2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee92e84-b2ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620774352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774352, "uuid": "b21180ec-8ac3-401e-8615-8b922710eea2", "comment": "Malware payload", "value": "dda923e1cdc1952f39b4af81e256c9c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774352, "uuid": "c158cb07-0f23-4a5e-9e3f-45f9a6c6ef60", "comment": "Malware payload", "value": "41974086896977fe0ff73a83a63a8051247f2e9af6a3f4175e891a643b461118", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774352, "uuid": "4723dc6b-7f71-4710-bf6b-0b9c20a18835", "comment": "Malware payload", "value": "3fe42a7a1af951cfe92ca8d0d0d3ee142bf7a8cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774352, "uuid": "22d12040-5770-4301-8a1b-57f19cb6b21d", "comment": "Malware payload", "value": "950893441c8dac9332efb6118a9cb9202b7338662996f9d0d823f5b647d70c06fdb5cb22ac4d3d8234f0f5b04136f4e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774352, "uuid": "dbbd69df-0ac4-4c4e-9750-c7a7cff6a956", "value": "B8F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774352, "uuid": "3903194e-fc47-4aac-94fd-0e874328e086", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774352, "uuid": "02745685-8237-42f1-93ae-15c72d20b427", "value": "3072:PIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Qc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620774352, "uuid": "ccc0820e-8c10-4221-b5e9-98e1900f7596", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620774352, "uuid": "e7bde4b7-c118-45a9-ac6d-f1543a1d279b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774352, "uuid": "758349ac-207a-4ee8-a891-7ea5f2391736", "value": "dda923e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa7f20d-b25a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620738911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738911, "uuid": "32da5628-7f01-4a93-8efe-bc984e2d9d7e", "comment": "Malware payload (AgentTesla)", "value": "d517eb65115f485beda9c19bfa225ebd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738911, "uuid": "75235ecd-96c4-4e92-add7-347265bc4df1", "comment": "Malware payload (AgentTesla)", "value": "41bdf7cafe409a70106aa34f3e8dd6c991d0663269d0f2bd157c518f0a701315", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738911, "uuid": "7b76cb4f-bc9f-4cae-8bcd-c37fb014dcf6", "comment": "Malware payload (AgentTesla)", "value": "41d829362ad03ae986d5b6f135c4cc4eb88491df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738911, "uuid": "465ca97c-a4c0-4dfe-a83b-5986af27c432", "comment": "Malware payload (AgentTesla)", "value": "0f6b5264735166526c64aaf7a820e6e8167ee556b04cfc32ff5b8aa96bf3fcab93143a1b39a16be13dd7debc45f84bd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738911, "uuid": "746897f1-5830-45f5-a826-69166768bf65", "value": "003539AC7504E4E9D2075C32E3CBCCF642142D70692A690B97213FBB7A77D172E39989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738911, "uuid": "792cdfa7-4280-42e9-8fc4-c1d59c593188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738911, "uuid": "86835c51-c640-4da4-ac31-bfb7901464cc", "value": "24576:soLARj8v8F1pVh6JFRl9XoL0fkwJZJlbdc:6j8v8XpVMBYL7w/Jlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738911, "uuid": "b456f3ca-4fbb-46e8-90c5-60a322d198c8", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738911, "uuid": "f72a7f46-4921-47b8-b427-7734fc448675", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738911, "uuid": "9ff672c6-6a78-4ade-81e2-70da218d4dfd", "value": "P1469985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11362616-b27c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620753149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753149, "uuid": "27eaf434-7968-4297-8d13-3a06c7f08327", "comment": "Malware payload (AgentTesla)", "value": "038ece8f6c92ccb2dd38133d85e80caf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753149, "uuid": "0c1af286-6bbe-4496-a220-25a4de30925e", "comment": "Malware payload (AgentTesla)", "value": "4207f7b13155e7caf8897d4d119f808699093d79e63037c79c0feec1cd7cf997", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753149, "uuid": "f18de248-c42b-4fee-b7b5-b30e6bc60d0b", "comment": "Malware payload (AgentTesla)", "value": "96a2e3466f10d59020501b076cfab07f237bb7c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753149, "uuid": "20ec3222-47df-4625-89a0-23149ba62606", "comment": "Malware payload (AgentTesla)", "value": "ced6a1bb9284acfc0e7a4b49291c28ca2c1a96c23b7e631d3b9945e5062018ffdbe46cf92f2db5ba42f57dfb59169099", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753149, "uuid": "ed2b435c-a38a-46b6-9a10-583d6d2f14be", "value": "4925E061F2405BA0EC7D9B3954312C5453FBBD1AFBB1E14D7E9830E95A73A820633E86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753149, "uuid": "17dde406-e235-431a-a44d-e2816392349b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753149, "uuid": "894c664a-5fef-4cf3-8c5a-9a555cbf1b2f", "value": "12288:Dp585KBuF0JGJAPqDSBKGdiqQ8c9hqQ5Er6q5fF3rBSTNMehIo+4RvG6MkKvre0u:DSEWIlBSRMe/+4F2rbcEqIDe0hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753149, "uuid": "c6124bc8-5ff7-485b-8e9b-4d3c187f60c4", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753149, "uuid": "18b93d30-3db0-4e24-adf5-93a716ea809c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753149, "uuid": "6b3a964c-72b3-49d4-bd62-4fca65f37277", "value": "RFQ INDIA HCU23143E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73900e2c-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1620740859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740859, "uuid": "ce7c1a68-6180-4b2c-b392-c3ff20c272f9", "comment": "Malware payload (GuLoader)", "value": "19072427ffe95a1ef76a96575f85c811", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740859, "uuid": "e0b29137-c571-4c2f-96e6-a56e6ce108d6", "comment": "Malware payload (GuLoader)", "value": "429a766fbf315ee6e6ec01e3a36cc39a66b14c3c71d2a5de94f5fbd2212367dd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740859, "uuid": "cb0e6d59-d25d-4d13-a9d0-02a38f64df2a", "comment": "Malware payload (GuLoader)", "value": "ff6d7be28101542d8ed17eaaa84332573950fbd1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740859, "uuid": "564c0135-dac4-4028-b419-c27344f622d9", "comment": "Malware payload (GuLoader)", "value": "0fec8ebb12b4be40d099f90659a474cd7cfeb812c7259f10b2b5ed4a7c8c8519136bd511377c67a629123b44533bf0d5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740859, "uuid": "1f94e1c7-960a-4cd4-9e0a-4344c02aadec", "value": "9583D7263F60E4B1E8C3A8F9371470B64FD23F364213605FF289732376B9615961AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740859, "uuid": "d90521b5-c680-45f9-9648-5ffb1579a100", "value": "ec8e962978786706cf0189109090c85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740859, "uuid": "b1a08db2-8222-44c0-b298-a42b9b6cefb9", "value": "1536:sD9t0p8I9KmzvZ5s5j/1p2M8Mr6fqNdviU9D:sIa2Wxd/881wU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740859, "uuid": "770bea1c-8553-47d7-840f-6f8c9d3f5b65", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740859, "uuid": "2061431a-6ad8-4628-9000-cd635fa81cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740859, "uuid": "1c3e52e5-bc0e-4512-ba98-a278d646f35a", "value": "Cotizacii\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68394143-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716788, "uuid": "d0772ee3-b377-432d-91d0-407783896a45", "comment": "Malware payload (Dridex)", "value": "851f353da7ea6b3fe4bcd738b552b423", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716788, "uuid": "03c37256-ea2c-456e-95e7-d4e8bc708dd5", "comment": "Malware payload (Dridex)", "value": "42a26bb130326e88c4e5924c01adf0f96953d35022cbc881b4023e2a5eb8b2f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716788, "uuid": "33831f91-d65f-432c-b1fc-0ebf2cde70f6", "comment": "Malware payload (Dridex)", "value": "3ced18abbaae8e702fc9c3ae2b19183dce595cbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716788, "uuid": "80f7fcdc-1365-491f-af3a-5341a8207b33", "comment": "Malware payload (Dridex)", "value": "6a3b6d4507abb0568d8270ac259356fde5908f0775e86f11c90a2fb0de8f99b0e2f55c5e3964551be81365b72d4146d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716788, "uuid": "17602f3e-ee50-4306-a306-99d09f846976", "value": "16F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716788, "uuid": "a781d804-9692-4d7c-b5b1-26144c3030d8", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716788, "uuid": "e9c2bd33-43b2-453c-95ba-3d829f87a22d", "value": "3072:YWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Y42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716788, "uuid": "9f811174-5060-4f1b-97ac-1eb79c205358", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716788, "uuid": "fbc442c1-e838-4db5-8b5e-a827a290c29f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716788, "uuid": "084d19c7-d1f3-48b8-b41f-5a23614d8e85", "value": "851f353d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb988752-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715317, "uuid": "8b0675c9-1624-4711-bf0b-e02575efafae", "comment": "Malware payload", "value": "d9ed7cc0b66e5d885fbe56d1c153b0df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715317, "uuid": "3d252965-c27a-4939-ab17-79d8af0c8d4e", "comment": "Malware payload", "value": "434be3d87d3b5252356a6c30f5ea5741ecc7f909bbd818c79a5e901e495aef2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715317, "uuid": "f9ec4439-df4e-4f9d-b900-71986b8eb6a3", "comment": "Malware payload", "value": "6b70a4b81ab6e6aa299e8917ae651b0fb672ad93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715317, "uuid": "3b20b6bb-6415-48ba-a0e0-9eb83f777657", "comment": "Malware payload", "value": "2f18504bc46262b4162730628919ee2a470a881c0fb151e4f33ae3463b1b27ff5f48e8d29e416573908a19aaab9b33de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715317, "uuid": "bda89fdf-0c79-4e40-81ad-33c0adee95af", "value": "52E49C86F9409572D64B9631A2BD7D294A19AFF5306DCB0448EC3D4B3C32B4D3A93DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715317, "uuid": "6b4e410e-5092-444f-afbe-79446c8f9f81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715317, "uuid": "9f324077-4722-4479-8728-4eab9ee8a262", "value": "12288:ItASR7z0HFMw7Y9MA59CyMAn00su19VECl+DECG4CDtmJmSAQdP:QOH+w09tVyu2QAGJhKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715317, "uuid": "f96cbfac-7b9d-4bad-9185-4783d51f946f", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715317, "uuid": "ce376244-e1fb-47f4-8981-def9692fdcd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715317, "uuid": "7190fcde-a841-4b52-b2a9-8db8e762537e", "value": "Sibco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb6fbd6-b264-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620743238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743238, "uuid": "df8b08b6-7a40-49b7-9a11-b881a1c2a331", "comment": "Malware payload (Quakbot)", "value": "ff792107f35479d553bb80c0281cda33", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743238, "uuid": "d15b1002-1786-402a-82e3-7270d537ddc1", "comment": "Malware payload (Quakbot)", "value": "437a5419d30efa4e091d13acccdbc0920321ea924c6f9f7f216616de25abd75b", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743238, "uuid": "aaf7706a-4120-4baa-bd1f-1d6c620a918c", "comment": "Malware payload (Quakbot)", "value": "e3455dc43ea621bfc34012115b2dcc6c55a14348", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620743238, "uuid": "56084ebe-9af8-4c60-b0c1-97dae52de000", "comment": "Malware payload (Quakbot)", "value": "4438573c879a1a08db30e9963894ce7fbf9859a91e2a1e409c5a8706c5dd55bd2afb1500b323d424c6d7624e9f340f37", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620743238, "uuid": "65f0d561-6fb2-469a-b851-e7d14dcbd4a8", "value": "50F4C033F6D28837C177263DAC6B52A89829BE813D346C472BE81F5C5F397813A25257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620743238, "uuid": "ed530fef-04e2-4255-bcc2-8243d5d66897", "value": "1761f4ca259e6e8bab28330e9fe4d28f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620743238, "uuid": "34e315e0-53bb-4078-aab5-ea22dd23ea29", "value": "12288:FgENArP7suendY2U/wwvFF4fajcrz3j8JzEz6d9EWXrj:+KKIuD7vFaXrzICEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620743238, "uuid": "5c94fdbe-e506-4b50-87d2-3eec8bb81428", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620743238, "uuid": "10c1eb9d-25a1-4549-be5f-d6129e70350e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620743238, "uuid": "dbd9f86b-1ce6-4f2c-944c-ddc178177547", "value": "jehamhcqwy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a7db34-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702072, "uuid": "f9c13651-c9a0-4ba2-895e-51ece19da296", "comment": "Malware payload (Dridex)", "value": "0722cafaf61eda0a59299fcd43b4737c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702072, "uuid": "afc93511-3712-4109-b609-95eff4b148b8", "comment": "Malware payload (Dridex)", "value": "4393496d276eacd938b8a01a8bec9b54360e336a1288df3444f8b1d2c5fde499", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702072, "uuid": "186439d9-a163-4fb3-a4a6-055fb5ce44af", "comment": "Malware payload (Dridex)", "value": "eb9148006b682046bf7fdee8a10f56b7c0567576", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702072, "uuid": "8427534d-1b03-42a6-9c5d-c85ad293c546", "comment": "Malware payload (Dridex)", "value": "db241caf9c0b841ab0201e4ab32e99fa32be4ac6b6c35491940186fa27ae6b846530f1e5de589fb8c251e78d850296fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702072, "uuid": "aa973672-ea1b-4b31-aa9b-369459bb7053", "value": "C4F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702072, "uuid": "8ea569b8-0162-4fa0-8cfd-6370afc46c0c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702072, "uuid": "6cdaa9c3-0438-45b5-98bc-a5508bbc1661", "value": "3072:XIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Yc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702072, "uuid": "4e16d369-fa62-49cb-9641-d5fb7315192e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702072, "uuid": "10da135e-c03e-4c50-8819-46d3bfbde88c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702072, "uuid": "d8a10429-5de0-46fa-b355-96280ba57f8a", "value": "0722cafa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d12746-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698534, "uuid": "8319190a-4545-4b0e-b3a9-29bb334815af", "comment": "Malware payload (Dridex)", "value": "55ca1ee672e63628714c959c3e5bf452", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698534, "uuid": "a9210506-2682-450f-b0b7-da09c144d5b6", "comment": "Malware payload (Dridex)", "value": "43ede757cd53337d5e03325a6ffa483cab4a0b59e7b2744561d70bc7336767d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698534, "uuid": "9e01cc22-6b83-498b-89bb-99be9844387d", "comment": "Malware payload (Dridex)", "value": "adedba8c679f4a37c7e93f6fe54675ab758d0142", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698534, "uuid": "46317261-da0a-4fed-bd72-387bdb5a8a3c", "comment": "Malware payload (Dridex)", "value": "dd4829574156bbf0fe00a6e95ecc3880e95fdde750f49364c43455c332dbae4cda040223dc2daa2b2325fb81d78d7248", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698534, "uuid": "4863ddf6-c487-4eb7-aa60-66f1e41988b9", "value": "A9F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698534, "uuid": "f3c0a510-1815-435a-a120-5e1a155b3b24", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698534, "uuid": "414054ff-25c7-4a72-a451-215e76e24b65", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698534, "uuid": "56e69da4-ad0a-4e5c-8c20-abac6c34f4cc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698534, "uuid": "4f59bd15-49b7-4997-96d9-d2730da341c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698534, "uuid": "e64f056b-c61f-47db-9dba-beb9f841a695", "value": "55ca1ee6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e1ab80-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715231, "uuid": "abb3003e-4d2f-4ca9-8181-6c1458ae4351", "comment": "Malware payload (AgentTesla)", "value": "39f84d6f2917fb78769b9a82d6a9a8eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715231, "uuid": "5e0d21e1-18f0-43bc-b3bc-ce5a587c96ab", "comment": "Malware payload (AgentTesla)", "value": "44209e4ea6d4ccb2714a15956f1c281c43278e5a54a6c8ff073b603575e80d93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715231, "uuid": "089a933f-307f-4a14-a763-8e6841e0fdf7", "comment": "Malware payload (AgentTesla)", "value": "121df9a0ecd36a51b77309e349787dec7c3d7985", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715231, "uuid": "32b2789c-73d9-4ada-9497-98e6eaaddcd5", "comment": "Malware payload (AgentTesla)", "value": "57b634aec50974d4208ffb3e04d1a4e72136cf942eee964d148c95d2af495a5b1f29a9d276650985ae30673b5173818e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715231, "uuid": "05e25907-b0a3-4e7b-94c9-6dc2122881cd", "value": "2F05230626D46765C6FD17B8D92325421331B30AEA97E7CC3E048ABA7CE77D182467E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715231, "uuid": "52930188-d221-44eb-9b58-8742c50d3b5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715231, "uuid": "9a25ee00-0ecc-4f44-a4da-b0431b9d5394", "value": "24576:nSfTDuxO2YXqqRJYSG8526Z57WB9EFPOJvbu4m:SmoT6qRtG8526r7WYF25u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715231, "uuid": "bcbf3d52-f7eb-488e-9cb3-b20c6a6024d7", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715231, "uuid": "e4b20493-759c-49c7-acb7-886999dd26ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715231, "uuid": "6a787ee7-cfa8-4a4d-b95e-0a6e3d11a29d", "value": "HL-88352588 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13804c46-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691306, "uuid": "7b51bd8d-687c-4270-85c1-cad1f877ee74", "comment": "Malware payload (Dridex)", "value": "5349465f97310382322881f16803ac5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691306, "uuid": "04803979-19ba-4d06-ae9c-91bf0d26a855", "comment": "Malware payload (Dridex)", "value": "4455b1862da45ab84979a31e7949769a3480ba74f975b5fe70f1e0b3411db213", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691306, "uuid": "8a3da696-ca81-4dff-9d9f-0c5aefd41acb", "comment": "Malware payload (Dridex)", "value": "4ffdd57f9eabd60a205b2cbeab29c7665fee01f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691306, "uuid": "a34ce70b-d388-4e20-8f55-bba7a2c6b5e5", "comment": "Malware payload (Dridex)", "value": "0ad883cdba7e17640f9054f1c8d75b3a50de4914bbb518504c06bfde9309a51f8f85f235dee7b36abe68fb4eab1a70f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691306, "uuid": "3c44e1fb-cb3f-4ce7-b1fa-fc628c0fd0e9", "value": "8FF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691306, "uuid": "0c49249c-b003-408c-87c7-671b703a6766", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691306, "uuid": "c1c913f8-94ce-4641-8bb9-dbb2329364a2", "value": "3072:2A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:23J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691306, "uuid": "32ddc1a6-f6f5-445f-a134-3b9bf9b4cf52", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691306, "uuid": "424e742f-862d-4fa4-95ed-80b21414b4d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691306, "uuid": "96d956be-1b1f-4379-b472-312838885469", "value": "5349465f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05e7df0-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698468, "uuid": "537ceb78-9f0a-4e63-9f50-0f439c94095f", "comment": "Malware payload (Dridex)", "value": "a70386b5dcc4a81a5fb5b98c3e55db3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698468, "uuid": "d5c7b4d0-e9ad-4e2c-a489-d4cc9de9864e", "comment": "Malware payload (Dridex)", "value": "454949a263c02a086d4dd5a26c7958a7a7c367408b97bb74edc12437a95b076d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698468, "uuid": "73091ca7-5d30-4e56-95fe-cf28869e20b0", "comment": "Malware payload (Dridex)", "value": "46ea30ef1c915c28ddd7509ab1ab209a9e03792b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698468, "uuid": "f8b2ac12-2d2d-416c-8a2c-b88da56694c0", "comment": "Malware payload (Dridex)", "value": "976881d27d1343745f780e8514af459dc15caee7a1cd4872ce3d5ff4e5b66beb1320ac1946c3df7c59949d41cc631e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698468, "uuid": "81ebb2c2-ceb4-4cd1-a4ce-2854f1a04ce7", "value": "50F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698468, "uuid": "9c972dc7-c58d-4092-a339-9f36ab18611e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698468, "uuid": "46aa14ca-72df-4ad4-83a5-4d78d1ed9fab", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698468, "uuid": "103054e0-8e71-43da-8536-0f1172fbdb85", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698468, "uuid": "63afc32d-991c-405c-bda1-b9f25b1365da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698468, "uuid": "e958a5c8-eb08-4447-9911-9cf1d01f19d3", "value": "a70386b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245b39dd-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620740726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740726, "uuid": "b1adea87-0d24-4c18-8324-93ff6808ab9f", "comment": "Malware payload (AgentTesla)", "value": "0462b587d0fbdfe7f17c0a69d5e67345", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740726, "uuid": "57d7181b-c8a7-45da-8aae-3ac455bc2fd1", "comment": "Malware payload (AgentTesla)", "value": "4580adf0123c71ce3520ce1ab393c59619540c58b227b426bb82d10cae1e57f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740726, "uuid": "9cb2e404-b773-4953-afa3-8216b2aa7b69", "comment": "Malware payload (AgentTesla)", "value": "613ef40224761f233001d8571e7c62099c0bda95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740726, "uuid": "54674555-4776-4707-bf83-f39e451faec6", "comment": "Malware payload (AgentTesla)", "value": "cfbc04968228dc49da41b652ae730682c6c251aa3883eca3ac09fc181973ed2c21a38146b3a55d9709c9310b735269aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740726, "uuid": "abe29b1a-9fdc-4e97-a363-8e452107fb80", "value": "F91508E8F10064ECDE3748B673EF0F064A141D70692B5E8E5711B7BA1A37D132A3E989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740726, "uuid": "ffdc8be1-20a5-4f0e-8b6a-dbe3505cce3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740726, "uuid": "2d9ff04c-a6f4-4279-8911-c0220281095d", "value": "12288:YoLLoS60/K7yh0vy/tjeHSsuuQZWe9WX58ryguzsue6mXf:YoLAvyVjeHSsf0IGyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740726, "uuid": "c9200944-cb1c-48b1-a2ba-a0dc0db1d8e3", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740726, "uuid": "b8caef2d-9cd2-405b-b774-25a5450ff23a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740726, "uuid": "dc44a526-ce74-4c4f-9184-3bc32cabc9b8", "value": "dPLQIR1xVRLnTAg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4cacb6-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715134, "uuid": "ff337744-2b97-4d67-bb2e-3a0a982d0c64", "comment": "Malware payload (AgentTesla)", "value": "5d1837e901f87a53726bc8871ac753ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715134, "uuid": "016981a6-5fab-420a-80e8-2ff4e007b0f3", "comment": "Malware payload (AgentTesla)", "value": "45cbd4c065d8a45711f6e91ce46c1dd014882c2fd2a9a9db6ee9dcec7a9fb06d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715134, "uuid": "1daa4944-d90f-4585-abc5-ede014778042", "comment": "Malware payload (AgentTesla)", "value": "f59453d9e856550dbb3254a01aacded9baf1fb32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715134, "uuid": "2b272b25-324e-49a0-8d59-bac4450bc739", "comment": "Malware payload (AgentTesla)", "value": "587454c06b57a5d2f97e4c10af15ce8eb481bb573f73cbe9e83a7283780c2cac9a40bf96ec35ea76cd1497eda5b8b85b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715134, "uuid": "46f0ff8d-d8ce-423d-8237-126e3616bf9b", "value": "4505230B33E87B64D1BC77F6246198501BF1B1089627FB08AF8454AE69F36C94781BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715134, "uuid": "6662a599-f85a-47d7-a393-4695166b3766", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715134, "uuid": "987fcaa4-f9c9-4996-95ec-b4cd98eec7e6", "value": "12288:HEegYyiiQ6f0KPSPQWZgdDQcUrKm4OM3of+HIPxSc+zO2D6qbyGoOng2CUFFV7ek:FLKPYzgdND4fqKxOzO/bUZRF9Apg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715134, "uuid": "cf7d6f1c-7543-471d-b566-4c96b0f95131", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715134, "uuid": "ecb0af3f-4032-4ea8-9ace-e1fa9537d42b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715134, "uuid": "ceb54b7c-3036-4d8f-9c02-86ad3fd918a1", "value": "Wire Payment Of $35,276.70.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931ab938-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620728886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728886, "uuid": "0fd875e5-51a4-4747-a8ea-2bc4fbbd8a1d", "comment": "Malware payload", "value": "ab918d40e337c5c556fa3060849ff02a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728886, "uuid": "f3cadcd5-4ad1-4987-bef4-d9c19add90f2", "comment": "Malware payload", "value": "45dcc5c36845b9117cca466e0874ccdd54e582435422456dddbee1afe37b75a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728886, "uuid": "305222ad-a2f5-497b-9fc4-efc3378f84b2", "comment": "Malware payload", "value": "fb450aaa4d6043dda4724a6d68833fd001ef2f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728886, "uuid": "f056493f-a394-474c-a11d-f2605964e7ba", "comment": "Malware payload", "value": "65f20eb12526d0ae4c4e63c0e3115002831bf0cb0dde6d0c8baa9ab5fdcc278a8291305be2f263e818f94ed5a6d46e95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728886, "uuid": "b500642a-6e83-4261-b44e-41c308d88abb", "value": "AD740255F5D1087FC1A5873058FB6BBA6A3AAC3005125EC3DBE46A4F6C345C13E2A39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728886, "uuid": "a6ecdb66-263f-4c1d-9b44-2c5121f28442", "value": "fb98b857a706c11e09afedb36de7d6be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728886, "uuid": "dd1b9e16-2ad6-47f3-94a2-95ad12ee5837", "value": "6144:/dzd2DWwWtf3XDHEuaXyS9suLtOs4bHJuKrmpf45CZ5omn8xZyRxyD:FBiWw8HmH+ktybpuK6pS8oi8xkR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728886, "uuid": "41d576df-9619-480a-8d61-f665b9d658e3", "value": 352291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728886, "uuid": "be3fac9c-6b7e-48f4-ad0e-e16ea05ae762", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728886, "uuid": "468581ea-f1f4-42ab-a404-bd893b7ccf95", "value": "Scan _\u0446\u0456\u043d\u0430_\u043f\u0440\u043e\u043c\u0438\u0441\u043b\u043e\u0432\u0438\u0441\u0442\u044c_01,05,2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2689fc69-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712383, "uuid": "1ae9e602-3eb7-4a1f-a55a-fb7d93345a6c", "comment": "Malware payload (AgentTesla)", "value": "8b0b2917269b11b28a76deda1ffe8c77", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712383, "uuid": "02c52ba4-8a42-4a2e-95fe-b70305e2303f", "comment": "Malware payload (AgentTesla)", "value": "4607259e46cab649a7524b5125c854f49c3455b6e9380ae7a4bda3396463dd06", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712383, "uuid": "52d5ab63-f0b4-466a-88db-9fa4dae56ce3", "comment": "Malware payload (AgentTesla)", "value": "eb9e9569eabe86b8c2d3791bf7f636f64cd4b88f", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712383, "uuid": "ea529bfb-f9b3-4c2f-b2c8-f9c315d1fc39", "comment": "Malware payload (AgentTesla)", "value": "e71353b81ceffd81b9b5ef27e92962351bbd14d5cff858215b79f5321c380e7ece8da340acd1b30725604e392d350486", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712383, "uuid": "667acc4b-5d6f-4b49-838a-a366e577f029", "value": "18358D68719065E1D32B5E726BCBDC3143122E746426E50E8BD03FFB3967F13293998A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712383, "uuid": "6e8b1f41-89f2-462a-9859-0be29609dc6e", "value": "24576:PlSBqooLAixa1RPI4o7yDmf3a7urMfT4zjA8++++4+++++++0+++++++:P9xa1OemyuM4Xh++++4+++++++0++++6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712383, "uuid": "7b9e386f-ea1e-47a4-b08e-8acf850789c3", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712383, "uuid": "7467a7df-042b-435b-86ad-dfe2fc7a6a6c", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712383, "uuid": "d96d6cc6-8693-404d-a7f0-6284e3f7221d", "value": "Ningbo_Overdue_Payments.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82621247-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Avaddon)", "timestamp": 1620715973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715973, "uuid": "70b13d45-8427-4bc1-a77f-2e73eb53cd90", "comment": "Malware payload (Avaddon)", "value": "c19084114c85192dacfed89a92da6837", "object_relation": "md5", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715973, "uuid": "ab813c4c-710d-45cf-8627-d218a8240b0e", "comment": "Malware payload (Avaddon)", "value": "46a8c1e768f632d69d06bfbd93932d102965c9e3f7c37d4a92e30aaeca905675", "object_relation": "sha256", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715973, "uuid": "ff48a834-dffc-44e8-8451-dad8a9a04169", "comment": "Malware payload (Avaddon)", "value": "a1d6461e833813ccfb77a6929de43ab5383dbb98", "object_relation": "sha1", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715973, "uuid": "21f2c3bb-2098-44c2-b040-cac015c9152e", "comment": "Malware payload (Avaddon)", "value": "9c166f7c4d01246896bfc0e9aac1cb21b1bcee719370aad2326121f6dc21b5010c2353ab7628416d6b67d11ca5af6219", "object_relation": "sha3-384", "Tag": [ { "name": "Avaddon", "colour": "#90D49F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715973, "uuid": "f6287341-4c0b-441f-a187-a27aedb65675", "value": "0DF48E223A43C43BD97501768E5CBBB544BFA8304B261ECBA7C87F5E4A205D25E31A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715973, "uuid": "44fde3b8-95c4-4a30-8047-5146cffe956d", "value": "b56503b8c4f46a3a086734c09c6bd0f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715973, "uuid": "c5979969-4753-43ba-9c3e-b346042e2a40", "value": "24576:+CsD9+OXLpMePfI8TgmBTCDqEbOpPtpFafxfq:YcOXLpMePfzVTCD7gPtLapfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715973, "uuid": "4c880146-913f-4a07-976d-4c0aa66cdee6", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715973, "uuid": "786585cb-2c94-4247-af29-2b608c71615a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715973, "uuid": "1f8e5da0-0fa7-4a01-a769-ea158f097ddf", "value": "46a8c1e768f632d69d06bfbd93932d102965c9e3f7c37d4a92e30aaeca905675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923b0704-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620741769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741769, "uuid": "bd908577-8838-4e1e-942c-08b8e7d47712", "comment": "Malware payload (Dridex)", "value": "43900bee872b9f288ed7c592bedc91a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741769, "uuid": "4c6a863c-9e8f-41d6-bfff-f557d1bba929", "comment": "Malware payload (Dridex)", "value": "46ff930fb68af910e7f9631414ee755ee6f4faf59a982d2616946629988f0bae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741769, "uuid": "37f7fa9b-11dc-420d-8bd8-7ea19008b008", "comment": "Malware payload (Dridex)", "value": "502a0aa37dfe099ecfd46c57bbab72bb134c4e38", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741769, "uuid": "36d93f54-004b-4839-be1f-0e26c377c7dc", "comment": "Malware payload (Dridex)", "value": "a1714c52bcd8fc8c64fb8d170b2d4b0a4b4db02333ce325bffdb0ca81fc5938ee5202043ebea164554c59c949cf314cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741769, "uuid": "0e0abd40-60e2-46a2-a9f1-285c74432bbe", "value": "BDF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741769, "uuid": "bac8850f-c270-4d84-b566-1c3ba50ab342", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741769, "uuid": "b7d670cc-b36c-470f-ae9e-76c71fbd955b", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741769, "uuid": "7df112a3-ef6a-4e21-9702-a714af00838b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741769, "uuid": "901ffbb9-11e8-4dcb-9359-0edf51c6f60d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741769, "uuid": "99cd5e77-aa26-49a8-bf36-d5f9a71022ff", "value": "43900bee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13d1ad4-b203-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620701422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620701422, "uuid": "dab8bfee-9db4-4439-8b89-c90bdb49a25c", "comment": "Malware payload (Formbook)", "value": "3865c28dc1c2be2176865bdbee3aef15", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620701422, "uuid": "55c1f8b2-c5e2-40cb-b39b-0d9b30181ad5", "comment": "Malware payload (Formbook)", "value": "47795e947ae1864d553396ae7b191c6c507f2e5e50ced435018906c43f2364e5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620701422, "uuid": "df0c8100-8276-40de-a77b-2ee2ef752c58", "comment": "Malware payload (Formbook)", "value": "cf47737b8783d2aea099151e9de4d7e99c8d97b8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620701422, "uuid": "30f61b38-a99c-4885-9d85-389820f9f5d3", "comment": "Malware payload (Formbook)", "value": "62fd8127d98811ab7b7d35d8008d7516fc211569dd0d4bce1c377e5a5378ea6417b55d8f0fb2357297fd7fa3f35045d3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620701422, "uuid": "bfcafe6c-b73c-482a-ba2b-c4deb8f5b516", "value": "723412A37B40E8ABC96A07B01E769797DFE2E1005A3947C723945F4C6E63B411D1F2E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620701422, "uuid": "b4eaec25-3a68-4e69-812d-a26f98eb5542", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620701422, "uuid": "f04931b3-bc29-4b56-8b7c-b8f708558391", "value": "6144:L9X0Ggv38quELaK2V+hieISYkrNs+04IFozG:l0VP8qRLahh4YSNs54I+zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620701422, "uuid": "2793a9f2-6301-4ef1-a8d0-b5fd439ee2c6", "value": 231609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620701422, "uuid": "730012fe-fdad-49ba-9ef7-54e5c7562705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620701422, "uuid": "fd378e39-6a64-4985-8c16-8726b67c4228", "value": "SecuriteInfo.com.Gen.Variant.Androm.29.12667.1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5e460a-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705741, "uuid": "15e4d962-c58c-4b46-bdd7-2b0b488a9b0c", "comment": "Malware payload (Dridex)", "value": "8f7dfef86eea2b2b426e157063b8a4ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705741, "uuid": "8216f468-9a57-45ac-9846-9c1db55a9689", "comment": "Malware payload (Dridex)", "value": "47a0bfb2583af2c7452fdc040bb577b9af34ed511f29f0e4d139f87f71ab8d34", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705741, "uuid": "bd57988a-4e68-4ac3-94b3-e8b65ce33b56", "comment": "Malware payload (Dridex)", "value": "986b55c0ac7478b241f8f4a24a44db0498e19511", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705741, "uuid": "41384726-cb42-4369-9f4b-12e6613d7a2d", "comment": "Malware payload (Dridex)", "value": "037957ccef55cc2152dd7bc5dd7c2d16261d3ebfdeb6a8458192e3a960fa46b1fe5bd2171fd56c69cae0a4f2d04b88f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705741, "uuid": "4dbd9710-3de2-4f28-ba08-b1ec4d154326", "value": "32F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705741, "uuid": "1105df26-e8f9-4efb-8979-e4664d96ef98", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705741, "uuid": "37fb687f-12ff-4a45-9c35-720a1f87064f", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705741, "uuid": "599f8337-bc06-4174-aecf-bd9597b16038", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705741, "uuid": "50cb617d-4387-40b4-8c06-3489691533f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705741, "uuid": "00f42696-c82c-4a2b-b718-f6f76977851f", "value": "8f7dfef8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4961db-b26a-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620745523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745523, "uuid": "72ea4ae9-8371-4a8c-bede-8adb63107655", "comment": "Malware payload (OskiStealer)", "value": "ed1b37aed728e905e85ac4082f55f7f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745523, "uuid": "052b542d-bfe5-4bb4-a807-e47d2095ee93", "comment": "Malware payload (OskiStealer)", "value": "47efe12c67f3d5bad06207b057f006f8f40e53bc042561f7c0884d52144a5790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745523, "uuid": "e3e41817-f40f-42fc-9215-deecbfdad42c", "comment": "Malware payload (OskiStealer)", "value": "5aa04eef18a62192cc8996d2fca6f5f319232832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745523, "uuid": "01bea19c-efe1-4efe-9d14-6a6bc3ade586", "comment": "Malware payload (OskiStealer)", "value": "11ab8aaef41d845c72d8b95fe85bae6a6abc68817941966d39e5fb9c3c192ec2711b11976c3374c0ea09092f0042f0a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745523, "uuid": "a3a1cb62-579d-4f61-91c8-c07da6ea1daf", "value": "5F94BF279B429AF9E72E98316477597FBAB17E22A2842157434EB34F0CB2931C43F057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745523, "uuid": "ad299784-d58d-467a-b8d1-b136655fdc8e", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745523, "uuid": "df4b221f-2a11-4d9b-a4fc-db7b8fb241c4", "value": "12288:M05Mwzc6pO0ZywAy3vVnNA95jZCaRMcRo3t++t2i4Hwc3X2QbM5Aah1hEA1MMC:TMwzc6pO0ZywAy3v8CaRG3t++LA3X2Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745523, "uuid": "76f72da2-9b4d-4f55-9bf4-a2e739554ae4", "value": 442576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745523, "uuid": "4f691a5b-e431-446f-83d7-00bb6bb9652b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745523, "uuid": "631f182e-eb57-432c-b7b0-be8f323a8386", "value": "P.O# 70058629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a644b712-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620717322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717322, "uuid": "b24962ba-24ef-444c-aa5f-1b8085653331", "comment": "Malware payload (NanoCore)", "value": "90bc8f4029793ea123a6d3e40a3372ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717322, "uuid": "3582b192-5510-4461-8aa5-dd1ce77b0f4e", "comment": "Malware payload (NanoCore)", "value": "483ebc17836e413fb7d61810ca179f3ffbeb5e14e9489a26822d1310e9144226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717322, "uuid": "f03f2ac0-3d76-40e6-ba4a-960c0f1f1b22", "comment": "Malware payload (NanoCore)", "value": "fc3a7ff5a9fdaa3a4eea712d1932502c8e12287b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717322, "uuid": "bc239770-da75-455c-9c8a-5ff17a7a8f3a", "comment": "Malware payload (NanoCore)", "value": "f0e64c081ddf63e568deac386c67640117a58fa7061a289ccc78cd67f37bcf5ee9f39565a980fce2824c2fc5be72183d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717322, "uuid": "148fc5a8-93bf-47af-af5d-45896e2d48a8", "value": "89558E5AA741D0C0F66E14B5CDB0FBF0056ABC2BCE0B6E1702963ED1347B6679B3A146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717322, "uuid": "53426727-f34b-4bf5-87da-beab0a15ad2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717322, "uuid": "31ec0ae1-0890-4793-be72-2d446eafd717", "value": "24576:kcO/BizWrG7isUzcGgnmKHWP5pY1FaibWYoG4dO:kD/BrG7isUzRgnmKHWPg10ibWYYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717322, "uuid": "1ad6a7f9-cf63-48ad-bc0f-14785d6b8966", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717322, "uuid": "ed027d04-e6a3-40d7-b4da-1b071b608b8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717322, "uuid": "703cbeb1-8948-4ae0-be5c-d254db8d9467", "value": "90bc8f4029793ea123a6d3e40a3372ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b56a364-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715961, "uuid": "147923b4-9fa6-4e86-80e4-8076a9a74934", "comment": "Malware payload", "value": "2cc3197cec01cd3130bf1e8b4cb9f2ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715961, "uuid": "70636846-652a-46c6-87e1-a297c0a7c471", "comment": "Malware payload", "value": "488af9e36269f0e4788a7fd987ba0b231c453c7c4ed68d990dad0b7277babcda", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715961, "uuid": "0851ba02-a3d6-47c6-b078-7f1fa21c358c", "comment": "Malware payload", "value": "e1fb14d1cddfbd5888f205b2a0741f04d5bab7cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715961, "uuid": "e79b6af7-50be-4870-8e0e-64e54d423496", "comment": "Malware payload", "value": "8599dffb038c0206d7b3e33a77675e40ba8c837addc56612f57d08d556776ebcaab16765c3e05d76a1f22132fff9ef31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715961, "uuid": "a92dc24d-8820-44dc-b36a-f1e6cb9dd54d", "value": "21F45A009357017BCAFA3A7E8153A331E3FEB95CD70293C762C4257A3D6661845F7AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715961, "uuid": "a4bf3f54-f22b-4392-8565-79d6217882aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715961, "uuid": "5e09088b-9a16-462d-8d09-b79473620a36", "value": "12288:T1K17Xl9Sv0UZdBhHWTSXYJ7GDz+BXJtATY62t/bkC:pK17Cv0UZXhHWTFJaf+BXvMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715961, "uuid": "b23cf2fd-604b-419e-ba11-7e0d59da313d", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715961, "uuid": "a2cff1a1-c5b7-4779-b9e0-9e79b68908d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715961, "uuid": "b6e93f5f-916f-44f1-845c-27a3f069ae43", "value": "488af9e36269f0e4788a7fd987ba0b231c453c7c4ed68d990dad0b7277babcda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb6761b-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620753066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753066, "uuid": "a037c8d1-21ec-4c00-abae-014140a1ee41", "comment": "Malware payload (Formbook)", "value": "b0053ddc80b4aa7b07029f94c4d3f063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753066, "uuid": "6f27e6ef-4cb0-47ea-9853-197bb41ae8bf", "comment": "Malware payload (Formbook)", "value": "4917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753066, "uuid": "e9f9c570-67cd-4505-bbc7-bef5f58b2a8b", "comment": "Malware payload (Formbook)", "value": "1e77172b6474bed24831b97e4bd42828f0cce91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753066, "uuid": "d756583a-08a5-42c0-b711-7416545209b6", "comment": "Malware payload (Formbook)", "value": "7f42ea8930625ede2ec55f4be18c83e9994cade30f28b299f58820b69df09119f84916781aa676dffb0b866aa1814b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753066, "uuid": "779848ef-b2b3-43b6-80b4-93abce4e2081", "value": "AD150135376C6FE2E67ED77D6820004853F6F80AE722E65E7EA504DC0865F8246A2F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753066, "uuid": "392ceac5-ad5a-43dc-8f1f-b04dfcc21f07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753066, "uuid": "e3e7d28c-5bf9-4275-83c5-2cd645b3e5f9", "value": "24576:YHAu7e/MGdDv4RnFBnhWqaCByHQ6tW8K3SjTmB73Z:Y0/NEnFBIqbyHQ6tTmB7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753066, "uuid": "89b54410-38a1-4589-a887-c75746e59014", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753066, "uuid": "76f9b9ef-cdaf-4922-80fc-fd765d8fcbf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753066, "uuid": "3ee5378d-d2c9-4d44-b09a-f846bbebbe36", "value": "b0053ddc80b4aa7b07029f94c4d3f063.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4046b27-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715224, "uuid": "b3930945-2869-458a-8039-b07a16cfd1bf", "comment": "Malware payload (AgentTesla)", "value": "8a40b2939d2f504ced76d2e13b0ade1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715224, "uuid": "e3a0c336-c0d9-493d-ab08-a12d551806e8", "comment": "Malware payload (AgentTesla)", "value": "495239420400a2e812fa7a1ad3d0050a746016c59e9a9b00247e42b6d67eab4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715224, "uuid": "c89be03e-9a64-4e71-98ba-94b8bc208036", "comment": "Malware payload (AgentTesla)", "value": "eaa6d4ed1c6c9886b1f83af56b49cf3b2f7e081a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715224, "uuid": "4fe61c34-9697-4825-8513-2b828dfb7112", "comment": "Malware payload (AgentTesla)", "value": "4c2e59ef2e794a4331c365a968de26b9b980768800a8441b7da48b132ce6a2b41dafc31061a46d517934923efa09497e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715224, "uuid": "4dbafda0-661b-4697-8a11-acfc6b954a89", "value": "BF05228723A86695E5FE0BBA4433064003B4E189E352FB5C7F8495AE1DE77E09B497C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715224, "uuid": "5383446c-92ed-4a4f-a4aa-44c4980c6c82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715224, "uuid": "03f155de-1a3b-442a-b216-db7aa3a51961", "value": "12288:qEjyiiQbshIzIekjD8Ji/mPocIIARssDLb2X1RTusX3G1piC3cLPW0H8XSvnLonJ:7aAPoca3DLKX7G10Bt8ivkriGu1R09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715224, "uuid": "1058e442-fac8-4f9e-92c2-54e2b92f58d4", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715224, "uuid": "40f1ef79-0a9b-46ca-a62d-f01017abe0a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715224, "uuid": "d9fb96cb-9158-4faf-9ca7-506853660cef", "value": "PO 2345566 hisob-faktura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666bb7d7-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716356, "uuid": "8a891858-8a5c-4dcb-804e-27316bc14a38", "comment": "Malware payload (AgentTesla)", "value": "09eb1d3a9a5d4225b9499f3e10be6db8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBBVA", "colour": "#DD30BB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716356, "uuid": "d949cec8-a026-4d23-a631-71231589e1c0", "comment": "Malware payload (AgentTesla)", "value": "49b3803530349aea6e6c1c07812f740c42bda10357ad4d83908a55b3c35ecfda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBBVA", "colour": "#DD30BB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716356, "uuid": "603b6eb1-c7a6-4c39-84a4-3e007cc5193a", "comment": "Malware payload (AgentTesla)", "value": "922b465d69a8a03dca4eb32bb40683b8387563cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBBVA", "colour": "#DD30BB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716356, "uuid": "3a32f95b-d7e7-4d77-969f-717b723236f1", "comment": "Malware payload (AgentTesla)", "value": "3c83e89fb6f717139bc07a93741c66e678659504b2c562f5ef3aae86313f8116171dbbfeb2e36afed28b430aa08142b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBBVA", "colour": "#DD30BB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716356, "uuid": "503561bd-f254-49fe-919a-dc82877fc3b6", "value": "9D05230323D8CAA0D0BE43F960777E8523B4E905A322FB9D2E5451BCB5A36C5CB497D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716356, "uuid": "20f7a249-290b-4b19-a4f1-5a4492223173", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716356, "uuid": "1d51be1a-e030-4b07-b48e-730dedaab05b", "value": "12288:fqkyiwdXAHtNiSZcZZC0ar+mdaoVOlaL5eJ4Lu9tvGSHA/lRQsQaFyUUPQ3F:tUiCrarF+lal40EDAfQmFVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716356, "uuid": "23b1f587-e350-475e-8054-6053e4407ca8", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716356, "uuid": "de75a0d1-ae05-42cb-9c95-8d0f3dbd381a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716356, "uuid": "0133e848-df58-4f86-b9d7-0d6fc3b9cd63", "value": "Garanti BBVA Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e051a4dd-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712695, "uuid": "342cdf9e-df14-420e-99bc-9e8f00025071", "comment": "Malware payload (AgentTesla)", "value": "28ea15ad667bb2199b036bc083a7241f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712695, "uuid": "abf32ea4-9381-498e-8f19-7c6098ea5132", "comment": "Malware payload (AgentTesla)", "value": "49c1da4f3bd8a3a016eb190528060cb090ff555d422e09e375cf190b97beb1b1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712695, "uuid": "fda9ce65-da02-4a18-8d52-e4cd2bdc629e", "comment": "Malware payload (AgentTesla)", "value": "c8f18a6320418c24e1dd04dcf2401f4c62b09fa7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712695, "uuid": "c0b268f5-9e41-416d-8125-2d1485235893", "comment": "Malware payload (AgentTesla)", "value": "9706078a00f83aba726cbf86fe620b49341ea0027a9aabbc00ea2a8e5196fb95f83933e623d6973a537448c96450bda5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712695, "uuid": "b3702a14-4f51-44c4-bba3-d4e256d3878a", "value": "E4E423A9C8F65609D4EADEF174D3889B2993F9563600304F3698D0056FE4DE0618EDFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712695, "uuid": "30396132-a909-4454-9fb0-53a7ce3524e0", "value": "12288:mKJu5xOHIOm+kgC1Ewjw+8JdvsjkfdhwZtcIciRlFd4dt7G57cTURc:mT5xEIF77jwLHvsjkfnwn3RlCS57iUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712695, "uuid": "0fdd6627-23f7-41ae-8e02-63a8dc9889ff", "value": 707400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712695, "uuid": "24a6fc38-c56d-428f-9b96-262dc43e726a", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712695, "uuid": "d7c4d72c-daa9-420a-a1a1-27c9ba5fd566", "value": "[SHINSUNG] SHIPPING DOCS.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539e7231-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716754, "uuid": "3ab1755a-9d6a-4540-ae9c-c315eb9d6c43", "comment": "Malware payload (Dridex)", "value": "13ed42e0ce6864e9b9b9723679514c58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716754, "uuid": "d4aca408-9947-4f65-9009-2651a77384be", "comment": "Malware payload (Dridex)", "value": "4a2911de0e2359fe83f41d33cb567bd0c4fcb640152e4d8aa08a3461055e590b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716754, "uuid": "7a2c5114-6bd4-4edd-bbb6-6567997e271c", "comment": "Malware payload (Dridex)", "value": "57e390f9879176bf8b91f06fce8ca40c4940a7a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716754, "uuid": "308cce91-6578-459a-9193-df9acf561ff2", "comment": "Malware payload (Dridex)", "value": "00c649b512fbafe7de9348e7ec90a6460404ed8c74ff79c53ca2fb33fd77a1d567ebcb90742955066de8638bbf04b7e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716754, "uuid": "294e6f2d-aaf1-466e-ab42-38d51bdb7906", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716754, "uuid": "d580d8e4-6734-47ed-af2d-d5996c8472fc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716754, "uuid": "dd3f1a40-9ebb-4a3a-91a2-ca00a7cf9d2c", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716754, "uuid": "064c4fd3-73f1-4d79-9ac0-4e40a1e578bc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716754, "uuid": "cd92bc01-1f48-4e83-ad0d-705c80266db0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716754, "uuid": "f3a2290b-cb36-419b-b48f-de90744ac140", "value": "13ed42e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be27740-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620717304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717304, "uuid": "c03e1ed3-a3c3-467a-a709-1859d596d24e", "comment": "Malware payload (NanoCore)", "value": "df65b0e1972dec5ed345f7d5ae42e606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717304, "uuid": "ca48ef47-416b-49c4-ad20-dec9571b6c26", "comment": "Malware payload (NanoCore)", "value": "4aa05fe194b356bf1a21857c7918b8304f9c3b17dd6f21253b6660056456b88f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717304, "uuid": "acbb3614-96bd-47b8-a4fd-8c6f5b3c7313", "comment": "Malware payload (NanoCore)", "value": "81e1e4af79339fb60ff8d2ddaacfb644bc52f158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717304, "uuid": "73031584-32fb-42af-a30f-c6084116f04e", "comment": "Malware payload (NanoCore)", "value": "7551c89ebcc626efe88e7f9ba1313150331fca4f64aaba95adc997fe698b03ddfd440cdaf7decb96cd52d823ce608ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717304, "uuid": "f93ab450-921e-4bb0-8df1-e06cc32c6d79", "value": "5F45F1786AA0C942D7BE47BC48B1A27807F87D66AD07E70E1EA431FC2E77720DD11619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717304, "uuid": "7c79a827-1d10-44fb-9582-796a143e26eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717304, "uuid": "7cf9582f-4de0-4f4b-87af-3ec46b9e3eac", "value": "24576:19Y+Q9cKuo6/FCS65C1sNkhdM8jHO3vLe:19Y+Qvujtv65CndNjHO3vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717304, "uuid": "b219ea9b-3350-43f9-81e3-023cbb59be09", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717304, "uuid": "c9000890-cdf3-4aad-b486-1c61270483c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717304, "uuid": "87f44448-4172-405d-9909-d6deebe0d74f", "value": "df65b0e1972dec5ed345f7d5ae42e606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bce64f5-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620720123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720123, "uuid": "8e2ad77b-3a9f-4e6e-b3e3-0342ffcf51b5", "comment": "Malware payload (RemcosRAT)", "value": "968927d627b5be1a39972dc04068b2b3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720123, "uuid": "506a1d52-d1c5-4e97-a65c-8a48dcb190c5", "comment": "Malware payload (RemcosRAT)", "value": "4ae72c1d1198e6ff1e19bb210c61a10e847e703c1f77be90c76c7438a3de9be9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720123, "uuid": "74dfea0b-0b67-482e-9b0f-5eeb9299c80b", "comment": "Malware payload (RemcosRAT)", "value": "f495284e62c4775c2cddee1d14e59ac82d6950a0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720123, "uuid": "3459a8d6-3c29-4f29-8e59-e7cf069fbd8e", "comment": "Malware payload (RemcosRAT)", "value": "35aeaa61d4648c543f14eb2b4d6af8cb4a0d4829f27851f779a272e0ecb11167f6203ff2e38640c82eb4c95775224a56", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720123, "uuid": "10795ef4-55b1-41b8-bec4-f012506dd9bf", "value": "22D44AFC751464F9D35B5C23A3CF0C1782242270A93B6A1B9B2113BE5A5BE173E399C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720123, "uuid": "435068cf-5e11-42dd-90ea-e8662d1ee077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720123, "uuid": "6d506b24-cf48-4dbe-8e56-b158b35c557d", "value": "12288:FoLLoS60/K7yh0ZV12h0sK3tr/5D0NYHenaGi/V8hVK:FoLAnw0zrBDWYHnGi/Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720123, "uuid": "d8d66777-ca1c-4ddd-bcb0-56fbb3f01933", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720123, "uuid": "ada2e13b-a551-4375-acb4-8da709ea0675", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720123, "uuid": "1b55560a-8c80-4d5c-8046-c2d4d8f2d3b8", "value": "968927d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f6b42e-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (MassLogger)", "timestamp": 1620738152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738152, "uuid": "61815b69-bb49-47f9-bdd7-8e5f7ffd50af", "comment": "Malware payload (MassLogger)", "value": "4efddcb5dc1617bd8a38451657291b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738152, "uuid": "7e5a738d-88c8-4b27-a76a-c28d60b68d98", "comment": "Malware payload (MassLogger)", "value": "4b21973994a4c674d4dd888226ffdfc50704bf10bdf6503c6c4a1c31ad95bfa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738152, "uuid": "e1982029-8df8-456d-b86f-56f2393318a6", "comment": "Malware payload (MassLogger)", "value": "13b3e65876c238ed6257590116c7817ce1b40260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738152, "uuid": "affd081a-5430-4c68-895c-138880f64e5d", "comment": "Malware payload (MassLogger)", "value": "e1a00d4174f064807917556dc2f5e127451d4376a38ad3eac1a069cabb7f927ad1b4ebd402e4252b75a7083ab8fdea6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738152, "uuid": "2592cab4-3e13-4904-a9b8-7c66bc753dae", "value": "1B35BEFC755464FDD34B5C23A7CF0C0682252274AA3B690B8B2113BA5A5BE173F399C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738152, "uuid": "5f18314d-7369-41f1-b1f5-baad2e19357d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738152, "uuid": "3ef97c80-edad-482e-a382-dae53145e398", "value": "24576:foLA+2/nen/lDwXBPRQ2rbcOnUo9OLd+NxMaPeQ/4qKx:CcnenSXhCy7Uo9OLQ4a/4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738152, "uuid": "edd7e4a9-8198-4ed4-9386-d3fd2f353136", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738152, "uuid": "95f5c6b1-e373-40ab-89ee-93eb38d4af02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738152, "uuid": "15a58f35-ca23-4839-95ec-636e620901cd", "value": "svch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15845edc-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702047, "uuid": "b0e20b39-e9c6-4a62-8615-66540681eaba", "comment": "Malware payload (Dridex)", "value": "8f7c6686507bf3bb249fa38a5013e2fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702047, "uuid": "d49ba48a-f60e-46c1-ab4a-a4f42a3cf2db", "comment": "Malware payload (Dridex)", "value": "4b2bd3a4ab6a43c6168ebb204664da27569742fd4aa0b4d8f56113cc01d84d29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702047, "uuid": "78ae0be2-789d-4169-92d2-34e5934ba5f9", "comment": "Malware payload (Dridex)", "value": "54342c904fd8cb88b54b6cf19259085685714446", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702047, "uuid": "79899e38-7da8-401f-918c-f63d32145658", "comment": "Malware payload (Dridex)", "value": "2809eb07b657ff10aa8e525ea6f346c1962fc9670fecf6bdbcbd9a69fea7d2167e6e8dee23451ac91050a65b56d6f382", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702047, "uuid": "1561082a-d825-408e-a0f7-de787014e1af", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702047, "uuid": "ed9695f7-f87d-424a-be44-83471e8ba5da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702047, "uuid": "5ee263c1-d6e1-409d-b0fc-6f22da868f69", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702047, "uuid": "12f9568c-60a7-4094-9f27-b74d1fdd0ec9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702047, "uuid": "2f703be5-3244-431c-9448-3e1dc4e0dbad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702047, "uuid": "b4c32e8c-8df9-4372-bd3f-1a2e475824f5", "value": "8f7c6686_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec00827-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620740824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740824, "uuid": "799ab410-11ee-485c-9a38-e76c82f373f7", "comment": "Malware payload (Formbook)", "value": "5b38031e274923f2d477a9612edec8f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740824, "uuid": "b1754056-33c8-4a6f-bdd9-4efa30497fff", "comment": "Malware payload (Formbook)", "value": "4b4efdb81c426d5bfcd3ec8f3c34e573a97bf9644bd6524b0e87baa0931775f8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740824, "uuid": "6827428c-982a-484a-823a-1db9533ba021", "comment": "Malware payload (Formbook)", "value": "b1d93a7926a981ae44af3a53133545a903f4f364", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740824, "uuid": "12b5c46b-41f7-40eb-b113-4b45e6bfa07c", "comment": "Malware payload (Formbook)", "value": "72935e3e8a56b0931c3cdcf8ae5ac9c96afd55380d45a853485594734b562e4817f5d3997cd2744180fb826e7728954f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740824, "uuid": "cde4a95b-22ff-467e-ae19-0ca56a4a4469", "value": "0C0523AB23D05A18D0BD87B1B461155003F4B9A6E227EB0D6FC686EC05B77D4CB62BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740824, "uuid": "042e6f40-af6c-4a56-8854-333a491a089d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740824, "uuid": "9788d88d-f01b-4df4-aeca-06377f4bdf52", "value": "24576:Z+oreiGbaMHhv8AMWRLDKqu/kVcY7DOL0:Z+oreiG2+58A9RLDK9/kVTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740824, "uuid": "77b66ea7-2054-44d1-a735-604496e91a9a", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740824, "uuid": "7e157cbf-04f6-47f2-ad2f-2e52b9b48f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740824, "uuid": "ac338867-2e1d-43cb-a09d-7acc5bc733d5", "value": "invscan052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1cb657-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715236, "uuid": "3fca9ce5-c9b3-4999-af87-2b7852ddc2b9", "comment": "Malware payload (AgentTesla)", "value": "59fa0cdf1e51a5238e7dc04128db9973", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715236, "uuid": "ce2c6760-f72f-4d69-9532-f8dc1c830598", "comment": "Malware payload (AgentTesla)", "value": "4b55e32234637e16b302ccfb3b30c34cebce0022c958b6afe5214d8ae4a74be2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715236, "uuid": "0d0f2f24-d8d7-4265-9d49-fb4d7f5ec9b5", "comment": "Malware payload (AgentTesla)", "value": "68d43720baf148602df2d1fa1002434de23fd758", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715236, "uuid": "393835ca-347b-4eca-b380-ceee1e00ce75", "comment": "Malware payload (AgentTesla)", "value": "2f784f147c9ba124a549db6a477fdb04cb116546017571d0686ae7a69e81d9bae5c8dc9da425198de1732e6b70857dc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715236, "uuid": "af466307-5b6b-4e83-84ce-0c99cd260e64", "value": "AE05237357850E3AC0B892F8811530C48561A31F7A37F341AD1659F96AEB3D4A7B23EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715236, "uuid": "90693aab-1e83-428b-b488-e7e882455ddb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715236, "uuid": "f3bc558e-a03d-40c0-86a6-370628f56aa8", "value": "12288:0gycPs4QdQ6C8RBZGa3dL6lVTdijZYQy/V3IZyyVWvMZFD8bidsT10EKTM:MhQ6CGrhdWLdifZyygkZFDVdG19Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715236, "uuid": "c2109379-7648-4580-97ee-c23b074bcf94", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715236, "uuid": "0ab658c2-259a-4aff-9cb9-7b214b48522a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715236, "uuid": "21bc4b29-1ab6-4070-8106-ede5218517a7", "value": "GRACE $$$.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b906569e-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728950, "uuid": "7d8f0fc9-0c39-48bc-b1a3-b0465da7bd21", "comment": "Malware payload (AgentTesla)", "value": "b5634b763669d07859bc6fc83c22a4cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728950, "uuid": "a8ef1db8-a966-4ccc-a473-c95ebe410a5a", "comment": "Malware payload (AgentTesla)", "value": "4b5b9b554eb832db072581a89807301c294360acac0a605c9d97e0d2d06f621a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728950, "uuid": "f7346a99-ac73-4ee5-93af-c9cc52c22284", "comment": "Malware payload (AgentTesla)", "value": "4555074dc437ff0f5adb3d83df8fdce9593df968", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728950, "uuid": "184f57d9-b126-4eeb-a2dc-3aa35ef4cfa1", "comment": "Malware payload (AgentTesla)", "value": "e0bdac46d1e9e73ce8444e256660eaf0e758b7629a8ec5bc370455c16cd2292b077b3ebe0356d1a98579c1bd622a075a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728950, "uuid": "4067c4ab-bffc-4170-abf9-d6e59edd08e7", "value": "79F47DFC751465F9D35B5C23A3CF0C1682251270A93BAA0B8B61037E5A5BE273E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728950, "uuid": "f9ac6a30-729b-40b6-bffc-fb4df404ac23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728950, "uuid": "2795a7c1-ca7a-419e-8d21-953cc529db18", "value": "12288:ToLLoS60/K7yh0phcQTS0D1yBOQBhux3M2j7byc0B70vTShsN0xTkA3JrknHUPCs:ToLAPlSEOQxc+7mNBcTSS6TnYHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728950, "uuid": "6b246d8d-ac0a-4271-807e-34ac2d5820b4", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728950, "uuid": "d965d3c3-e485-4ada-9f75-31661ce6ac37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728950, "uuid": "24a7f95e-ba88-4a0c-9f25-1e60e16d0aaf", "value": "RFQ Gas Pipeline RS003 - 01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae969463-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620752554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "14fa8868-5e3f-4bbb-8b7e-80f7c98269d7", "comment": "Malware payload", "value": "a5abc543640fed75fc620daa71e86b83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "8eda7d08-3564-46fc-98f8-3bc094426ed6", "comment": "Malware payload", "value": "4ce7cc88dcb11b448def18da0e5846c9e6748d05eabec529080a5098c8184d0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "bfeed977-aea6-401f-adfe-ec70c4e2bf0b", "comment": "Malware payload", "value": "9177d599996acfe002549a1c652907dd5f2e3fa4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "a801a19d-8ae9-433f-8bd4-76b26ebb6952", "comment": "Malware payload", "value": "a82b31b69f77929d53b50bb854b4778a43a4a834990e0dca120033a25c08a8dc18f02db1fc00171742491a70eea97fc5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752554, "uuid": "f750f915-ebd5-4b2f-bf42-63ae477b73f3", "value": "D133F1FA55993E9019617BFE84701AC8D89E1BB8725EF19C3F071AE081C3E6643B07C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752554, "uuid": "c48e27f1-86a7-4c95-9375-81ff185bc78b", "value": "1536:tEfO3I44RwUD6M3cdS6t0M8MHF6wqUFIy2izmJgA9A+p7:ToRwUexU6t0zMHFxqArzmt9Ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752554, "uuid": "953ba823-bf57-408d-903b-c6832925ab6e", "value": 52024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752554, "uuid": "399199ad-9944-41ad-ad69-ec833c7d8f44", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752554, "uuid": "aa84097b-fdbb-4ada-83cf-f6256384ec8f", "value": "a5abc543_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e7db40-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620740975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740975, "uuid": "9edbb748-03dc-483f-bb5f-eee3ca256ebe", "comment": "Malware payload (AgentTesla)", "value": "196729a5823b6c5714fd45ac15edbd51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740975, "uuid": "531c389c-a9f1-4eaa-8afa-0df8934419cd", "comment": "Malware payload (AgentTesla)", "value": "4d63261f0fd94331c1d6747464437b657a854ee9186f5a376f615ebf4a45ac97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740975, "uuid": "0b8d7e13-ee70-4bd3-b6ae-063b398d8daf", "comment": "Malware payload (AgentTesla)", "value": "5014ba2065e95fa085e758e4a2bc8bb1e50c36fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740975, "uuid": "c7ddbc27-324e-4ddb-b0f9-a6adfb796fa1", "comment": "Malware payload (AgentTesla)", "value": "7b39594e927884560da19b9c2a318dc7ecdd0d9b7e7a6ee64369e70335a201fcb7f1a63558975734d83e2b7b8a8f240a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740975, "uuid": "8d1b414f-4b2b-4955-9218-032593ac981a", "value": "E215230323E46154D4BD0BF234549A411BB9F186F353E79C3B88B6BE4AA77D88B017E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740975, "uuid": "7b58a972-80f7-4ef4-8f53-9c4e78282817", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740975, "uuid": "54d42f3a-cc78-477a-9b6d-f0e215fbe0b2", "value": "12288:sEtmyigQSLwqd7lveOv+ZCmtbaJxWHYkHF5z3dTs4KUzLMJwmfSrEo1DNs2a0pk/:l3hlvoZCmdafWn3ljkJsrHnp6UL+IEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740975, "uuid": "647d5358-f38a-4176-8c67-05235ddbb078", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740975, "uuid": "16d9c62c-4ec6-418b-aa80-273e99097c01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740975, "uuid": "3de425e6-dbfb-4113-a0d5-86ecaf0b47e9", "value": "RFQ_SGCCUP_24 590 34 532 -11052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb15e1ce-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729060, "uuid": "09ea4913-60f7-48be-a1f1-6810830813d6", "comment": "Malware payload (AgentTesla)", "value": "dabf948fefbfb4f9865e3f5a21582f37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729060, "uuid": "aea96ce8-06d4-4869-b248-8cb7aaa5c7c0", "comment": "Malware payload (AgentTesla)", "value": "4df30f642fff436c30bef6a48d5e8b6031fbb9236bf85e03c020bb42e9fdb734", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729060, "uuid": "87707e44-0d7d-419b-b2a4-56ac4bf9782e", "comment": "Malware payload (AgentTesla)", "value": "6bdd7d4796e442bbef69b5beb40642c1d96e8f4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729060, "uuid": "e64a5dea-7f1a-4f28-a84e-2a5f0d0d1667", "comment": "Malware payload (AgentTesla)", "value": "96b6a0e40ff13ea746c42d934fc77807b0ea04638ffa118902594d030f95471a411a765b0e1e37440a31fd4467c0dcbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729060, "uuid": "442bdd3a-0b1e-4141-a8c6-c1c70113c1c2", "value": "9E1538802526A19DD0613BBDA53134E003B8EE27F8E94DD7529C7B22FEFF9111FA1925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729060, "uuid": "19c4526e-0c49-47d8-a1a5-96a97c3e5161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729060, "uuid": "f2f51591-8287-48db-9c94-d0590465833e", "value": "12288:qYKxeayECY3CEZYlRhBb7UNeSH7fUO/yWvlOUy78kpoFkNheag:XIeaFb2lRL7oeSH7cOJtO178Uoqheag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729060, "uuid": "dcd228f3-d647-45ba-90de-e3e4d1512abd", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729060, "uuid": "1f6c42b0-7081-49fc-89ce-8c7885e4859c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729060, "uuid": "4313684b-00d9-4798-b2c4-04cf0addbd73", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6785129a-b260-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620741268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741268, "uuid": "e222a830-cfba-4aa6-a6e3-feba0299ee31", "comment": "Malware payload (SnakeKeylogger)", "value": "608166cd1118074f3fc735529e98c19e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741268, "uuid": "99214c5c-61dd-4c0b-8c68-c8344da4a14c", "comment": "Malware payload (SnakeKeylogger)", "value": "4e1090efeb8768538b32360fd4716921c75e0eb896a7bb2b4882ff9e621eba7e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741268, "uuid": "c32778b5-f688-4f2f-b622-39407a60255f", "comment": "Malware payload (SnakeKeylogger)", "value": "eb51fa78d362c40caea9c211866b722d9ce3ebfa", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741268, "uuid": "6b1ff409-efd5-459d-859f-c6fbbec6a5de", "comment": "Malware payload (SnakeKeylogger)", "value": "5305feb3d4d5b506fe7be8929dbf51a875758cccbda76c78021f8287963e4bd662eef1f09220241287c1bb3547bad6e4", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741268, "uuid": "680c6c83-c498-4faa-8705-028ff4025a09", "value": "E8F45BAC725459F1D36B1E7763CF1C0243652534643BE90A8BA013FE5A67F172E38A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741268, "uuid": "88687efb-0d6a-4253-843a-c9d6c0d5f232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741268, "uuid": "3e086b2b-92b1-4398-b477-b4475b690059", "value": "12288:9F5liB8BZkooLLoS60/K7yh0jPgPaVIIwo2tDzxH/7YNY+PuTAKN:RlG8BZkooLAjgcwx3JYNd2DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741268, "uuid": "2ad5daac-8acc-4fa1-9f6c-9618f3ab1c7b", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741268, "uuid": "96c120b9-b5ad-4cc4-8faf-a69949442adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741268, "uuid": "e675fe9d-6269-4959-b6ee-eef7f97a076c", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9905df9-b248-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731179, "uuid": "25e0b071-de8c-4a81-b2fc-9b4138ca0078", "comment": "Malware payload (Dridex)", "value": "e82c32abd367ed0b81f124e5bfb6f14e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731179, "uuid": "6865e73b-6552-4214-8a10-d3707af84d50", "comment": "Malware payload (Dridex)", "value": "4e532d2362abcfac7b9ace1dc57133f85bc97fa79a9aee91a6b9103adc3ccfc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731179, "uuid": "1ee05433-a7eb-4f6c-9434-bf306c06a953", "comment": "Malware payload (Dridex)", "value": "234686cf93ee3a6ad0d5b2aa1a4e894eb19525e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731179, "uuid": "4882f7d7-fe40-4506-9287-fcbf7feccbb5", "comment": "Malware payload (Dridex)", "value": "758e868efc8d3d3f3222978d6d1d754952aed251c6267d107954c8d07c915d267787b300c0b952cad2d327d4cf526d91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731179, "uuid": "bd677c1a-c273-4eaf-9c3b-82f217852b27", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731179, "uuid": "8dbc4951-37c4-41f1-ba0f-1ac8554884ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731179, "uuid": "b95035ea-543e-4bba-a54f-375ba9df8ba0", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731179, "uuid": "2f220152-536f-4fb5-8abf-ac8789b42b2f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731179, "uuid": "5e38bdf7-4ebc-4341-87f0-93d8ba72c4f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731179, "uuid": "9ba8a57d-4049-4602-bfe8-86f9e9a48da2", "value": "e82c32ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6be1ea-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716825, "uuid": "a1aad7ca-3459-408e-b786-949f46c3b7d4", "comment": "Malware payload (Dridex)", "value": "47b6595c37908b697856832d416d6c7a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716825, "uuid": "65ca1228-6192-490b-a66e-4bfa1dc8e064", "comment": "Malware payload (Dridex)", "value": "4e65bc4ccf77fad157a8eb297c5882be2956c0a204bfc1c01caef381f9ac4873", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716825, "uuid": "983e7dc9-b92f-4a33-a70e-60b894edfd77", "comment": "Malware payload (Dridex)", "value": "605d0fdf9a981188b6426df5cf0e10a32e5bb130", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716825, "uuid": "c725af64-3317-44cf-a4b1-d7ff91e8d798", "comment": "Malware payload (Dridex)", "value": "f3ab4749477efbbab346c589301bf2e034d30ed9329457856d66f690510ef57fcfa967dce97367b26fac06ed47730fad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716825, "uuid": "ef6cb733-6379-41d4-a263-f0498f7ed52d", "value": "18F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716825, "uuid": "fc6b3835-b916-46d4-8840-75bf83d62a98", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716825, "uuid": "a4f13c63-4623-45b6-9514-c35c8b39e143", "value": "3072:1IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Oc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716825, "uuid": "a782856b-74bd-4394-a90d-6e67fa7f7b8e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716825, "uuid": "bbf5ca65-03fa-4554-94c6-5eacd651b43a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716825, "uuid": "04debf27-eadc-4a78-93e6-093658098a20", "value": "47b6595c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e5a74a-b22e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620719920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719920, "uuid": "57d8892e-262d-4626-9a7d-8c334791100e", "comment": "Malware payload (Dridex)", "value": "9119374f09722dd61d4e028d1b156244", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719920, "uuid": "6a9f8da8-5052-4101-b145-edd071cb8ecb", "comment": "Malware payload (Dridex)", "value": "4e719d3dd57e73bb79da43788cf6e384c87a5b0a20b6e70c55bedd84f66a056a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719920, "uuid": "b86eb643-c022-4837-b019-a608f81eb38b", "comment": "Malware payload (Dridex)", "value": "f62fddc4655b35443bb51a09263e09d74b38f472", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719920, "uuid": "feda5d41-a99b-451e-8c05-443fc02862bd", "comment": "Malware payload (Dridex)", "value": "d420286f6d146880391a5bbc0955ed41d2aa030652be61ba6b59f5a0d4197a4bcf1db00eec3edd33c9520bfe6f8f1811", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719920, "uuid": "eb15534a-3926-4abb-92eb-394f0ff37e8d", "value": "26F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719920, "uuid": "58389646-7917-4751-bb69-e3826eebf8ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719920, "uuid": "51372096-f64e-4841-bd32-f4726fd708cf", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719920, "uuid": "0d4a82d0-ade7-4fd8-b88f-3c45ffe40247", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719920, "uuid": "47faa975-d48e-42c4-962d-19541c2e89d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719920, "uuid": "5c4c34ec-aeb0-4b59-bf77-34a19c9f37c8", "value": "4e719d3dd57e73bb79da43788cf6e384c87a5b0a20b6e70c55bedd84f66a056a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83a3781-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709272, "uuid": "958d38ac-cea4-4e89-b67d-9a5a647a67fe", "comment": "Malware payload (Dridex)", "value": "5d58dbaf24499e96967ef2f49e1a1545", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709272, "uuid": "8c7f3c99-284f-42bd-8d3b-9701ad35a83f", "comment": "Malware payload (Dridex)", "value": "4e7725d43438be9a79666dc0328b978a2e78fbc08584bdaf06675455f7bc9ee2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709272, "uuid": "31982d09-2c5e-4432-8daa-71c5d5fff83b", "comment": "Malware payload (Dridex)", "value": "cee43625f03cc2ed46eea0f04b8a146e9e6ea561", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709272, "uuid": "eca0b5be-ead2-4884-8db1-4f9482ac0d7d", "comment": "Malware payload (Dridex)", "value": "a6c5422da3727db75d53ac534a24d37c975edbc786b3ca3790b478b50c2d885de34e57ec4d57c89140a4f10f7ce8079b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709272, "uuid": "5585b571-6535-4161-a770-d09f2c73b4d3", "value": "3DF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709272, "uuid": "da9106e6-3597-4af8-a617-c8b79e34fb44", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709272, "uuid": "c79bbd71-48e4-4804-bfe4-901e6ffd1bf2", "value": "3072:VWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:V42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709272, "uuid": "1892deeb-5f19-4420-9b66-69a8ae7625f4", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709272, "uuid": "8d1982dd-cdf8-48f5-8917-2ed0522101f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709272, "uuid": "a46f4dcd-cd53-422f-a9c2-899097047e6d", "value": "5d58dbaf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c9f7fc-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720079, "uuid": "a5a992aa-1cd7-4a5f-a5f0-629da26db635", "comment": "Malware payload (Dridex)", "value": "ab81060c8d6726b8062c7218fad21093", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720079, "uuid": "e0c9c0d6-c28a-4b87-96a3-ce600bc22941", "comment": "Malware payload (Dridex)", "value": "4e917766f13c529c46dc2f09beb5fc878f1f0d85fb60334ca8a22a5612531f10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720079, "uuid": "ba8821d6-c3f9-44e9-9b82-7dc9c1287429", "comment": "Malware payload (Dridex)", "value": "c72f6db8beb00703890c4a1d0c1d6523050cc437", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720079, "uuid": "c1a3f4ae-d30d-4a48-ab29-624b26cd7863", "comment": "Malware payload (Dridex)", "value": "2c86f4d0a86ff4b8d9d759b050cd1806dee9b73684e5026ebc768c3c3755fd706235105be1ffc0be6f01ddab4d426003", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720079, "uuid": "fe9efdad-0b7b-46b1-b8a3-3851e3ef6864", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720079, "uuid": "0e529cc8-8088-4bdd-8afc-a4124f334da1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720079, "uuid": "1069c747-bc9e-4bcc-bfae-3363b3eab297", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720079, "uuid": "1d38ff18-62b1-4378-87db-4ab9a4db3232", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720079, "uuid": "44a9f673-7c96-4b21-8dfd-74411b31949b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720079, "uuid": "c21d06d3-39bb-408d-9b13-ed4d4134b6bf", "value": "ab81060c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fefb676-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717311, "uuid": "6163cb55-ad19-47e8-98a3-d7e0db8c9ac0", "comment": "Malware payload", "value": "03c03933b86d29746d552924c98716f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717311, "uuid": "80c8c081-341d-4ca1-aa07-f047b8c5213a", "comment": "Malware payload", "value": "4ef301c6664da9d27ff3b089f4428b1002cb8ce46bdfa20b97042997666a8191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717311, "uuid": "e315e49d-0c5a-47c0-a477-934130fe6a84", "comment": "Malware payload", "value": "3a7b64044a578eb0c0244a3e6b82a076e4226b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717311, "uuid": "a070955f-144f-4d50-bf9b-8bf019488ac5", "comment": "Malware payload", "value": "4abb5f0cb388d97125dd0cec26c4fe4059b805cda6ca65236c48bbd9e624a44b399b0d1a4e252bb773776f0f7681f623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717311, "uuid": "8446032e-9b97-4b4e-b036-947b3c73b5be", "value": "E7A2071662F8B11DE6E745783C32DCB43738ABB04855D01EE061534CCE616BEA8DEEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717311, "uuid": "a8de4966-ff1d-4724-863e-ca5c72454c19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717311, "uuid": "04b7ea91-0f3f-463a-94dd-a1c794ecc423", "value": "384:ywe1eA4QRpBHc19YA+tGlSL3QryMdy0sXWXIMIC/:6HHOYokLh0sGLI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717311, "uuid": "7b392966-369e-40f3-9e69-679bcd5fd26c", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717311, "uuid": "ae56f413-2bf9-42ac-919d-66a41605d10d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717311, "uuid": "3312d7a0-24d3-46cb-9f28-87049cab2ac4", "value": "03c03933b86d29746d552924c98716f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452ba77d-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715441, "uuid": "7a9e60f7-2d28-40e4-8bf9-6e3da9f0c149", "comment": "Malware payload (AgentTesla)", "value": "a9e20b1e8025e74d6587a489577cba9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715441, "uuid": "6db1bf3b-11f1-433b-9a0f-9d65677ef173", "comment": "Malware payload (AgentTesla)", "value": "4f10282a69b29dfe7d3974a996d9426d9debf532980fc3ae40cd843a6e8ae27e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715441, "uuid": "eaeb91cf-2a45-4c4f-9832-6dd036a85c07", "comment": "Malware payload (AgentTesla)", "value": "800ab69536aca12a51bcdbd2efdc18e4dd35f509", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715441, "uuid": "ea261755-8ccf-4079-aa54-7dbd4ac8c4f7", "comment": "Malware payload (AgentTesla)", "value": "105cae1b71deadb6efbc65af325f400b7fdaf8d8fc6c8a09ee9e54b9a13b3bc77c11815c4af98f330d783bb1d4e68d32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715441, "uuid": "a86acb9d-7fa5-4374-8e65-bd3f8814ae98", "value": "8B250112D2816B44D0A916F7042135C002A16B59D04EAACD3EF6FF7E3AB37D18B56EDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715441, "uuid": "2fb41b7d-75c1-4490-b8bc-ffbf68b99efa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715441, "uuid": "1f8890bf-68b4-433c-bab9-ac7d56a812b5", "value": "12288:HEyNyiVQ8riehl8lDs3IXKBkDZK4IE1qsDImCdsUN7Qg08c2NV0nSya8pDOdBK3g:XTl8Fo7mj8uySg072NmSuDOrkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715441, "uuid": "ade55eb7-23fc-4143-81a1-d6136c21e5c0", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715441, "uuid": "76bc8302-b998-4962-967f-adb123dc3786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715441, "uuid": "cf68bd83-7e27-4eed-8a5b-e13619e4dfd2", "value": "PO8564436622.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41b25bf-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620753074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753074, "uuid": "bca07b74-4f3d-495f-9f88-8548ca71b517", "comment": "Malware payload (RemcosRAT)", "value": "9ed17a3e5105ce4397d81965069ac0a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753074, "uuid": "7a9e784f-3cf4-4a93-a140-730cee298a08", "comment": "Malware payload (RemcosRAT)", "value": "4f8e0185fbd30f92a58d1846b85105db4942fb932c10c57705e6ff1a856d804d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753074, "uuid": "3e3aa26e-58df-4aa4-90ef-b5c7f0133a21", "comment": "Malware payload (RemcosRAT)", "value": "bfba64c4d42ccd0c22409a9c2b72f72d68949d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753074, "uuid": "32c1060b-e87d-4dde-9a08-86a88ed4b8c6", "comment": "Malware payload (RemcosRAT)", "value": "135f8205a6e8bf596c950bb34cccb8798b578783c0389dca19e45f9150a5a4b258e5b1e8f17f2cd191925e387eed580a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753074, "uuid": "afe86651-90cb-44ba-972d-ec70c8d308b8", "value": "B685F3603EF3C11D72AE7A0F86F645E84973FB55BB7289DE395623510B8B581080AF4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753074, "uuid": "028744e1-fa0a-4553-81bd-1616968da547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753074, "uuid": "e3381483-0189-4dc9-8e8b-81eb0ec463bb", "value": "1536:DhBveHJO7ezqnZ/vIqXVGPKwlzlEtxO19eJgijxI0pti+nkH367BLy3dEkKCV4CL:Dh2EgFbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753074, "uuid": "bbc1c215-4a74-48b4-930c-e6496e380079", "value": 1768744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753074, "uuid": "c2010bf8-6922-4c82-b452-7329d94072db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753074, "uuid": "4e18a506-b275-4aa3-80c6-12c97743cde7", "value": "9ed17a3e5105ce4397d81965069ac0a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a76c327-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694888, "uuid": "b99eb0f0-9cc9-4e09-ba3a-d4d79bf0d3c1", "comment": "Malware payload (Dridex)", "value": "d9411b6e00047cfd99a4cb2fe544f434", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694888, "uuid": "5e1ca96d-d0a7-4342-999a-9523322ed331", "comment": "Malware payload (Dridex)", "value": "4fced48715bfb38deed045df8610229f3986090b64d28f56bcb501fe887ef584", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694888, "uuid": "d7bd27c3-a5e5-4a13-a880-dbb7f067f93e", "comment": "Malware payload (Dridex)", "value": "bfa5b860dc703b0917a7aa25681a88d5c45dcdae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694888, "uuid": "f49e27e6-8aa8-4711-9395-9b1757922ac3", "comment": "Malware payload (Dridex)", "value": "da5f6406bf75bfc04d49814f8be8c621cdbbcc3befed6e6df7724bbf05cfdbb824abd8a5c149429d1e661dd9bfad2364", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694888, "uuid": "cc5bfdce-3409-4d09-86df-424844455537", "value": "BBF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694888, "uuid": "401f2c30-6a1c-42c8-9bab-ecc4ed7cd0f7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694888, "uuid": "008649de-9a60-4226-80ee-12712550c4ed", "value": "3072:XIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Yc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694888, "uuid": "f959dbce-320d-4ca3-8f91-fa7a81dc9482", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694888, "uuid": "0e4e29bd-9b5c-4dc5-b596-d949e2e17d89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694888, "uuid": "5ac8f4cd-67f7-437d-8ae2-7520b3641f14", "value": "d9411b6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f5d25c-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620714744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714744, "uuid": "38a97aa7-6ac0-4b20-91ab-dad5c3000b43", "comment": "Malware payload", "value": "a6a6388779abaed80e3e79c8d4fd02d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714744, "uuid": "594d3e7d-6c39-4cb9-9608-268d600eeb32", "comment": "Malware payload", "value": "507563bcdeb37a14d6603a445a087dc812d1a4decd926ca990771b8dc4d7e842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714744, "uuid": "e1883a3b-cad3-4be6-a0ff-e89ed9ef0976", "comment": "Malware payload", "value": "c7759ad3592309085be320584a71ecc611b70316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714744, "uuid": "ac4530ed-3d7f-4cd1-b74c-0450e6191ad5", "comment": "Malware payload", "value": "2997a97bad5496fce0c9b24c56a56aa9900447a1de399b6fd1d9590998f173cd64a05b69c5928964e652aece9369a955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714744, "uuid": "faa69cbf-fa69-4b68-b6f6-352af2dd1673", "value": "17957C85227FB95AB3B32F25129C6792136FBDB14C3D724D9284113A6692CE4C970FF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714744, "uuid": "ac16b126-af2b-4d08-a15d-d276b5be1b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714744, "uuid": "30e37dd6-2f72-4c0a-8b4e-82eda885bb1c", "value": "49152:kDBjdB0/vP5bN2Hk8QthZ2mqIAMhIsS8itVr2onZp:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714744, "uuid": "c52a5b23-60b0-4ba5-9e6f-983d995ed3e1", "value": 1930240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714744, "uuid": "b372719c-562c-4941-bdda-e715cb387584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714744, "uuid": "2fe11a13-bb29-40c7-ad45-04c2ca3c22bf", "value": "Factura Serfinanza_049777756717_0230731_17278213973123_222217_881713232743783526_91325679891992_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77aaa64d-b249-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620731417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731417, "uuid": "44291e37-71a0-48be-9251-b65fee2261a3", "comment": "Malware payload", "value": "e089656370c797425da893e6c9665452", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731417, "uuid": "209337ad-bb76-497f-8474-4a183cc02234", "comment": "Malware payload", "value": "50e6ab9438865ecb8b098bccea06958ef498d469c9c16609ab1c65017f991e99", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731417, "uuid": "cef02aca-7364-43fd-af20-e2543d5671e7", "comment": "Malware payload", "value": "0ac2c75ffea9b476d6981c6ab3fafcaea65a5112", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731417, "uuid": "560fde5f-63af-464a-8c52-5ba3d0b72a76", "comment": "Malware payload", "value": "07d6fcba44e757c6032e2ac3ce4b819e00c5363be9dfdbc67ae093de874bdd28561f04130a65d9779363a938f55fe2b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731417, "uuid": "71e44114-8deb-407c-8959-f042f24d412a", "value": "BCD4235D8A5F9DECF3F402346849ABC23D32160113B2F3F4B5F1A63F26906266A579D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731417, "uuid": "45d94a45-87ff-4164-b148-116e40681a2e", "value": "12288:pRxb8vdS1gbVoQDJC5jKqjBoUREaGjqJE60m1uHxm3r+8K9Db1VSvotq6Q:pRxb8vdSapoQDQmESTjgfZAHmrFKYv1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731417, "uuid": "ead71552-b06e-4154-b520-5d0af7d41087", "value": 619944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731417, "uuid": "50e73598-122f-4182-872c-e9c87d979b34", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731417, "uuid": "40489faf-6149-4c74-9bd5-bf4b6162a267", "value": "e0896563_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf04095-b281-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620755449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755449, "uuid": "e6617bbd-2bba-4fee-b3da-84a16ad5f6fe", "comment": "Malware payload (RedLineStealer)", "value": "1b9f3fdfae3676c148ba3e670b99a03a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755449, "uuid": "c423ddd3-4974-44a3-ad2f-5f619e8df3ae", "comment": "Malware payload (RedLineStealer)", "value": "5116892ae46e3242d58c587cfceeaf0ecc2204085d2e3a4de487ec444cdf9834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755449, "uuid": "e35a34aa-f9d1-4703-8666-8ce9cfcaf443", "comment": "Malware payload (RedLineStealer)", "value": "d8b686ed3908b52dff3a348a3bcda770a5857054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620755449, "uuid": "29402ec3-a25a-4cbf-a3aa-4986967005ae", "comment": "Malware payload (RedLineStealer)", "value": "894c8ce653f5c3ffd6607ed33d95ab612477a15bcacbed7a7b735afb0a3dc4e3571596292991b0ab3ebabd7449aed45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755449, "uuid": "f7eb79ee-1042-4f73-bdfc-ccbd2631c5c1", "value": "48054BE35A40DB3CC59C7F768E5F02A133E36C9131ED96C9598EBA67283201AF5CE245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755449, "uuid": "d626d48b-5d30-4071-ab51-bd30d5a270a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755449, "uuid": "0b36b5e0-a365-4cf7-a560-174e4e6dd9fb", "value": "12288:G5bwh2L5SSqyWQvcL7Ohm0E8BaJJ/CvBfnPLH5uj03n2e9HK8:G5wh2L5SSqyWQW30EQaJJ/kzZzfI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620755449, "uuid": "00e70443-04ba-40a3-b706-bf80a1a9a0df", "value": 841688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620755449, "uuid": "b071b196-82d1-482b-a3c3-03db88a59777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620755449, "uuid": "af867e56-d015-4888-a8af-b7999813d0dd", "value": "d8b686ed3908b52dff3a348a3bcda770a5857054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14302aa9-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702044, "uuid": "7cc653e8-1912-44e0-9e0d-c9c416c307f5", "comment": "Malware payload (Dridex)", "value": "e02f1b5eb034e303ab6c8ba9a313ae4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702044, "uuid": "f4bc8af2-e4c6-4e9d-9051-f2d0e4f9ffd2", "comment": "Malware payload (Dridex)", "value": "520334d07c39d01601d1b5762477d035a11a81eadd415408a66d8f7a2d585a37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702044, "uuid": "929fbdce-fe53-4375-bfb0-0a662bc29cf2", "comment": "Malware payload (Dridex)", "value": "b99ecb923214f707a7f0d6128d744f592cc045fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702044, "uuid": "0be1b810-8d82-42ec-adb4-7f95c02e32f1", "comment": "Malware payload (Dridex)", "value": "4ea73544f85fe442082dc71992dc9ba76a3fe44179215955cff71a7a0a657d12f99fdc2da93eddbf9b37ccac0987f9b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702044, "uuid": "3db6ae2b-928b-4f7b-a62a-67058bc51837", "value": "CFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702044, "uuid": "d71e124e-d32e-409f-ab70-6ae1ba7a0208", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702044, "uuid": "6fa12426-3ae5-4b75-b993-84f9c91bdb4a", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702044, "uuid": "5ebe6609-bb5e-40ae-a95b-dd67802f2079", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702044, "uuid": "5af92a21-d0f1-4be2-bd49-fd215d0fcc55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702044, "uuid": "9a563dd5-1143-470a-843d-65d85a45392c", "value": "e02f1b5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544b89bf-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712889, "uuid": "fd9f755d-981b-4ebe-abb7-9bc3f06e3d19", "comment": "Malware payload (Dridex)", "value": "58f6436ae6ff767cd0fa667a9a0631d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712889, "uuid": "b79c9973-4b58-48db-9416-af0b78911ec8", "comment": "Malware payload (Dridex)", "value": "5244be3fccb41936412038110c642bd8cbe089c0579bc9dc4994ea4fdf9e4d99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712889, "uuid": "e6748cc6-81a0-45f1-9849-b94bc946ca6d", "comment": "Malware payload (Dridex)", "value": "578c5139a7ba54a236462390dd74df50e1f183ea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712889, "uuid": "728603a0-9fdd-4e8c-b1bb-839d71be9cad", "comment": "Malware payload (Dridex)", "value": "6ae1c66f780dacb82c3c2220ead3bdd86b291b1c1b132b0e0b8cf5bbc835e970b60de38467cd00e0d768e380278f00b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712889, "uuid": "d2a975cc-8836-402e-a82e-734ec61c655d", "value": "A0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712889, "uuid": "8f71d9ec-f8c2-4b79-aff6-bd39ab1903d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712889, "uuid": "90a498d2-c497-4533-91f8-a3d581a703df", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712889, "uuid": "636d38c6-4842-47f4-9dde-60837a9b6bea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712889, "uuid": "a5885984-25f1-4e55-bc2a-0a35d1994da8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712889, "uuid": "8fce916f-f952-4744-a495-8f667a589e03", "value": "58f6436a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803fc950-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620715970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715970, "uuid": "88c5d3d6-fc03-45d6-8462-d950f76f9a43", "comment": "Malware payload (CoinMiner)", "value": "0a7267cd89dbcf83df8dfdbc7ce990d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715970, "uuid": "0f6782cd-a5c2-46b9-a91c-0a8b51551431", "comment": "Malware payload (CoinMiner)", "value": "5252cc9dd3a35f392cc50b298de47838298128f4a1924f9eb0756039ce1e4fa2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715970, "uuid": "8f456fe0-d9b0-4f4f-8185-c395391eb77b", "comment": "Malware payload (CoinMiner)", "value": "a37a3b88a15d31a8951243cd6f3f08149244a67d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715970, "uuid": "7c0a23e3-7595-4142-8fef-ffd49fd88a4f", "comment": "Malware payload (CoinMiner)", "value": "a8c84648588d92340c83ab40eb91ec7b7bf86003c230caf28259804d3a61c4592bd18488b84a5486c1b3430e323e38eb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715970, "uuid": "70770157-4853-4b8c-81a0-961937dab8b1", "value": "42E69ED087F76D4BEBA7053448A687E4563A7F6DFB23C7770750620E2C38DA0A582792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715970, "uuid": "b84ca7ec-d427-49d7-b71f-8f9a2c3f5e25", "value": "ce0c3d9c48154107536f23ff72da7fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715970, "uuid": "be303a4f-10d7-4f10-84dd-3e871b53c54b", "value": "49152:yuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuf:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715970, "uuid": "c9c6cdb9-0d02-4514-a793-9a0c059e2e5e", "value": 14658048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715970, "uuid": "e52d3569-959f-426a-adec-58c1f6d3dc83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715970, "uuid": "9c8828f0-ef3d-41b3-8bc6-9683c6e998b0", "value": "5252cc9dd3a35f392cc50b298de47838298128f4a1924f9eb0756039ce1e4fa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0930639f-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691288, "uuid": "00fc830a-aaf8-4f18-93b4-ad6d41145c8f", "comment": "Malware payload (Dridex)", "value": "09ab412089b230491a92b6becdf98462", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691288, "uuid": "caaf0cb4-4971-4739-94f7-a95015a56019", "comment": "Malware payload (Dridex)", "value": "5261d29a27d0df5dc3990e78a428029760d247fe7af03c47923602e564e93f41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691288, "uuid": "8c887552-e77f-4317-bff1-3f9e5494070f", "comment": "Malware payload (Dridex)", "value": "2175176997f82bdeb28815d9e9eb6e646d91ce42", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691288, "uuid": "a7bf2039-ea1f-4fd7-9e50-8ce353329cf1", "comment": "Malware payload (Dridex)", "value": "567d5f6945ed924f92c4fa1fcf205ccce0acfcc0aec07113f9be82d5edd8cd415772517227f9b3ff9791d522b8b29fff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691288, "uuid": "55ceb7f1-b77d-46cb-b8cf-9f068f703e06", "value": "A5F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691288, "uuid": "4316c1e3-d471-4c0b-ab91-60ad9320c4b8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691288, "uuid": "1fa60a5e-0f9e-433e-9cbb-6b89ef111160", "value": "3072:FIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691288, "uuid": "e3cfd3e2-1af7-4c22-abd2-52a6065ee633", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691288, "uuid": "f364e51a-43cc-4e1e-82a2-3e4a2c53d17b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691288, "uuid": "d63f7bd9-5bc8-4abc-ab1f-34b99696876d", "value": "09ab4120_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18017415-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691313, "uuid": "4db883c4-77a0-4e0b-846e-e40a031b94ad", "comment": "Malware payload (Dridex)", "value": "9372711744bb67eb33d49b24898746cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691313, "uuid": "78cfaa86-e9c9-447f-bf36-3e8864a88a2d", "comment": "Malware payload (Dridex)", "value": "52d2a7207cabd40edc1b51fd6b0426348d1ffc74a6a1093489da9920617b8d6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691313, "uuid": "042115ea-b050-4d3f-97e8-69a05f3f33df", "comment": "Malware payload (Dridex)", "value": "1b8996077628564dc708a3e93f2d9f22a6a235bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691313, "uuid": "18d8ead0-4437-4adf-8f74-808b8e36fe12", "comment": "Malware payload (Dridex)", "value": "d6654f1253b708a8fa57af0b37d3ec0b292e012b28ea2bb28a35fbdbd00dfd482528ea7152444cb1d4c1f11cd8654bbd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691313, "uuid": "a6d88750-596a-40cd-8e97-407b21944c91", "value": "60F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691313, "uuid": "2bb329d7-91a4-4976-97f5-5be7e270783e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691313, "uuid": "32831d44-2e58-4bea-8c6f-e8cd56a8cb73", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691313, "uuid": "eec0104d-675a-4c86-8cb2-da0e1f4ceba3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691313, "uuid": "70f74bb0-a370-4c18-84ca-f066869085da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691313, "uuid": "5ef68c06-5f04-4640-b5ba-ba12a9f77531", "value": "93727117_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc553d2-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694897, "uuid": "b0d2a37c-0142-4df0-b81a-8908011d8207", "comment": "Malware payload (Dridex)", "value": "7623c3d70e52ff8177fbeb126cdec03c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694897, "uuid": "6eee00ea-d9f3-409e-b709-526d1df708a7", "comment": "Malware payload (Dridex)", "value": "532d0fe9fa98b3fdb05fa4f36fe878760bef2f31f29b7d4041e9bebaca481c97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694897, "uuid": "6411b6eb-aeee-44a0-8411-3cb744b16adc", "comment": "Malware payload (Dridex)", "value": "4cf840da8a61aab079a710f87b9260b3be78a78f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694897, "uuid": "e905ee8d-b5c8-4928-82c5-d20ac6477ff9", "comment": "Malware payload (Dridex)", "value": "0830f8d554b91072f5f43ff76ddb4b941e54fe67be218e82cfb510577e03f43bda58adc44ab072ff1ad4c1578ac18cb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694897, "uuid": "9047b67c-43f8-4dc7-9280-63efba3181d8", "value": "30F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694897, "uuid": "27c648bb-ccb3-4c27-9961-781dd3d63fa6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694897, "uuid": "ff6ed7ed-d726-4484-9673-597ca68a2724", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694897, "uuid": "d222d5cc-f65b-4d45-9bd0-69c25fc1ab89", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694897, "uuid": "804f61e4-711f-4590-bf9f-315278b569a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694897, "uuid": "2e621124-28db-4a26-af1f-2a7f8775b46c", "value": "7623c3d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9184c1-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717257, "uuid": "27a2954d-e807-4669-93f3-b1ac39504cde", "comment": "Malware payload", "value": "1808130c6c566d8ecb43af894d4f873d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717257, "uuid": "ee66d674-5d7d-4b14-a8b4-9ff7fcf6b9f6", "comment": "Malware payload", "value": "534407733556dc9a993d73261613e4713d0a1b3c9b7f61ec5983e39a0641815e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717257, "uuid": "1bfc8a3d-409e-45c5-8d9a-76f9d1ce70c7", "comment": "Malware payload", "value": "dd9a80847a47a61db29383482c1c7eb81deac39a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717257, "uuid": "7b0e0e0e-3006-49af-b202-715da5d28d0b", "comment": "Malware payload", "value": "11814fc1e058772df97f932ec5cf739b659ee187372717177437c02d9efdd05bbe8ac9cb275c4b1b78d124905999a978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717257, "uuid": "214fe169-6b3a-4819-a3d5-bd8c495f7163", "value": "8F138D98B3C449B9C29E633786A7974517F4F2E10A33D58EABC423A51E3335B3942F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717257, "uuid": "8f402569-2ce2-4a5f-8b3a-016dd4c43e9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717257, "uuid": "1e3c9094-c6f2-48d6-811e-c32c576b2db0", "value": "768:s9WsMWWlVif1fvBFmj4ZwpnwKjqoWTf7b2XdpG8ses30OwZA3Njnv:IWgWHi9fLnyp7ZWTz6XdU8lHOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717257, "uuid": "b373c717-0f4d-479d-a7ee-7db46765d476", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717257, "uuid": "4e1b1bea-88f5-4393-ac57-6d9dc5c9db96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717257, "uuid": "f028bcfe-db38-4269-a5a7-bc24bfd91454", "value": "1808130c6c566d8ecb43af894d4f873d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b370ad5-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620711908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711908, "uuid": "7acb022f-3d2d-4c3c-8bd8-ecaeb9335682", "comment": "Malware payload (AgentTesla)", "value": "35ffdb9c5a2fdbf60949d7216b2415c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711908, "uuid": "91aec481-43af-4d00-924b-b04fc10d74c2", "comment": "Malware payload (AgentTesla)", "value": "542f0778168c7f9e98fd4e480256a39e0021f1d687d2dfa7a6fb2d21c263d520", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711908, "uuid": "9400123f-250c-4602-b41c-a1061636c9f9", "comment": "Malware payload (AgentTesla)", "value": "646f7976fef4b679350984efc7e9cbd21e7ac996", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711908, "uuid": "fb2b941c-e858-4d5d-9e33-90fd72eeff1e", "comment": "Malware payload (AgentTesla)", "value": "a2fc392d0bf1e5265bb8abe504267f15bd9c8bceb70804dce3f674b81e58e42fcf4f0831df719290f61a2c73c86052a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711908, "uuid": "ad8415cf-8946-4fa5-8a18-b7caa68c6e65", "value": "0BD4D06C3AE89A44E6BE57BC9071512487F9B00A9907F75D4FE060FC2CB7710EA12A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711908, "uuid": "9947e90a-2f92-4da6-a8b1-ec90a4aa1431", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711908, "uuid": "9cc167a9-fa1d-4e0f-91df-1e79f8e9c41e", "value": "12288:U4C3RMYWWZWAPfNnkcqiS5jLXbEV+odco8R3OTd:MmYWcP9QiS5nJo8R3OJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620711908, "uuid": "3a797852-6fa6-406e-ba7a-b7890bcf1ee0", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620711908, "uuid": "8be0d6a9-fe7d-4b80-a807-6ca93dd39a50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711908, "uuid": "1e7cc0a5-e56a-476d-a88c-c29b3f568c28", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181566cc-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620715365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715365, "uuid": "228cd665-f64b-4bef-9aeb-bec5e3d11050", "comment": "Malware payload (AsyncRAT)", "value": "44d56b4abbadd168521a0c530cf01c9b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715365, "uuid": "fab3a2c0-75c2-436c-8882-504102f41499", "comment": "Malware payload (AsyncRAT)", "value": "54aa6d64cad682c76a52ab839f0c60697a40051f44f6809b9bb137f604228c61", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715365, "uuid": "59945116-b63d-4c72-a802-126e2628fcde", "comment": "Malware payload (AsyncRAT)", "value": "5052d0ea75131eff812e0d48ee98b1c2d4efa745", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715365, "uuid": "c14b6663-0d4a-462b-83f1-af50e6678c8e", "comment": "Malware payload (AsyncRAT)", "value": "dff5fbd86387b0d7b42b726acb0f15b3af1f3e9ee6ee8e150f9133446df5803b1851841cb6486d3f719e315e02ff96f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715365, "uuid": "15f07730-0e38-4891-923a-6de5b28bd024", "value": "62053AD8710878E9D2471D316BDF5D22012A2EB4663A550E6B13337B5A73E173E3AC8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715365, "uuid": "dd55e153-4753-4052-b191-ed5470495993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715365, "uuid": "4efceff6-4c19-40dc-9399-3ad361c55249", "value": "12288:8oLLoS60/K7yh0mvKxTD8PTISyPiCUgMEsYiIXUiGa:8oLAmi1D8TyaWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715365, "uuid": "a68e4349-da4e-458d-9a9a-ccc791fec6a6", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715365, "uuid": "4e2101e2-b857-4552-a931-8989846b2e27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715365, "uuid": "87c87815-2e94-43b0-b6d1-1eb5a27427b3", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11057fee-b2a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770758, "uuid": "c342cb05-48d2-43cb-bcc8-c37235c80ca6", "comment": "Malware payload", "value": "4e3043b09d4e8e5b05e6d9d0f2efda73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770758, "uuid": "060b73ae-2190-4d80-8c0b-b1aa1384e12c", "comment": "Malware payload", "value": "54dcb81d2e89a31d113fa41992a22531bffcf4e1f6358b50f4e3bb49a2fba85c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770758, "uuid": "b62b077d-254b-4622-a42f-607aa5ff4942", "comment": "Malware payload", "value": "a0b93d29518254fcaf460aefd1be267dc1cc073d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770758, "uuid": "f0a4e5bc-50dd-4365-b4f6-5e2b7223759d", "comment": "Malware payload", "value": "26be33fa4560bc2a6bfbdeb4ac6d77e0af3cc45e71789f41052e43dc6a92131166724760dbb2a51edfab24b1d36df8cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770758, "uuid": "c93b7cb2-028a-4751-8574-eee86872b1ea", "value": "8AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770758, "uuid": "1a63646c-22d8-438e-91c9-d696a3b976d6", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770758, "uuid": "1546eda0-c669-4075-9d4c-6a98f4974535", "value": "3072:7A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:73J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770758, "uuid": "8876018b-d395-451f-87ce-5cffb07f9580", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770758, "uuid": "a58ab4d5-20b6-400c-bba5-6d4b4a6a24bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770758, "uuid": "ab3310ef-ad08-40f6-aa80-dd4c8e916d81", "value": "4e3043b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f925ba-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729032, "uuid": "fd723255-3e3e-498c-8583-4e6c919fdb62", "comment": "Malware payload (AgentTesla)", "value": "c53ba5ef5fe65b2057aa69376216ccc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729032, "uuid": "e6e233ed-9363-4fd6-9da4-c986035fc96a", "comment": "Malware payload (AgentTesla)", "value": "5505773e19fa155a75c0edc2cc89e2896c40d0fa9c2a5cb9ee1b5e2c6264f8c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729032, "uuid": "b083b130-d3ef-40d5-9498-c0741ba0ba7c", "comment": "Malware payload (AgentTesla)", "value": "a9683343c90a93f379702ddd6256ac66815da8e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729032, "uuid": "0122b738-1e40-4203-8e1d-80fef371684b", "comment": "Malware payload (AgentTesla)", "value": "4c8f5f5c051c6999623910672e7bb65c2e3aa7d034dd7a65fa99df130e91a849903ea194c11f043b5088877d4e241a56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729032, "uuid": "f314fa1d-9ae3-46e4-a7b1-473e560d55a8", "value": "3C150125336C9FE2F67E9B3D8815108453FEE40AE722E68D7DA804DD4962F4187B2F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729032, "uuid": "8e65d70c-8098-4a3a-a2c0-43ab06abd2b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729032, "uuid": "81092197-d161-49b4-96d2-74c1f86eeee2", "value": "12288:cJjyHAnQ/SoUXOtM9Q3Qo7p8uhWTf0+uFLdv6WqFDctzqtD3Rt3skElJMzSGE7l9:cMFBv6JFDcm7vp2GkpxT1D7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729032, "uuid": "6b23443b-9da0-4851-a683-c223fbe8a093", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729032, "uuid": "48bb8eab-8e99-4551-9cf6-950d2838126d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729032, "uuid": "033491c7-c5cb-4281-b72d-936237fdae52", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55136278-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715468, "uuid": "68b8680b-27d1-4fec-9455-40e566ce4925", "comment": "Malware payload (AgentTesla)", "value": "d60c5359fad423212c9176c286f86180", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715468, "uuid": "e2e13ab1-f68d-4091-84ce-7cc6685a47a1", "comment": "Malware payload (AgentTesla)", "value": "5518cf17d58456ba539de77af37d9f1b44595c535cccae6139d64d8a514cfa1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715468, "uuid": "0787db94-896f-4903-a9a7-2063084c7826", "comment": "Malware payload (AgentTesla)", "value": "2b8ae1bd453ed33ea310bfc121e43e24a713758f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715468, "uuid": "1319b897-4ec1-4f16-8b2c-be9e222f6c30", "comment": "Malware payload (AgentTesla)", "value": "4fcd1779cb10f91f40bec20b44d5d0bcb97720d0a8fe5d91a90d7fef7ca654ac5617c211142394363a9bba6abec1a659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715468, "uuid": "6af6a187-4cf0-4a43-b671-4f5a320b433f", "value": "F41538802626A19DD0603FBDA13134E403B8EE27F9E54DD7529C7B22FEFB8511FA1925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715468, "uuid": "e95d60a2-de4a-44ca-90e1-76fafbf0eab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715468, "uuid": "869002cd-9d75-4e5c-b82e-a4f2d3d128bb", "value": "12288:1JKxeayECYRqssfoGIWQ4rODYB9yQbbYta8tIG/JBWNpi8jhea3:XIeajUoGi4AGkM2faG/JBMcWhea3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715468, "uuid": "cacc2927-147b-4d66-b709-b94bbc600617", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715468, "uuid": "59102f08-c218-4848-8fb5-c08f605d1d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715468, "uuid": "45222ee0-6b6c-41cb-9835-e3e70f97ee87", "value": "4c6f81ac43405ad9ac6b5935a071f63d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56eb37ed-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620728785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728785, "uuid": "25d86ad1-f60d-4228-81cf-b06fc3ab427a", "comment": "Malware payload (STRRAT)", "value": "570890d3e3bb9894e18d4336c52ec486", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728785, "uuid": "30df8a4f-3ac7-49a9-b59c-863569727275", "comment": "Malware payload (STRRAT)", "value": "553886504dfab8a1b911838c97b8c5737d76f8fdf39f50b4212d19740e0be82f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728785, "uuid": "e852d437-f41d-4ff5-b9d9-6ae5f5ca1369", "comment": "Malware payload (STRRAT)", "value": "80ebcd8dc40a33ed519135a132626ceca421bf6b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728785, "uuid": "77d14b09-71c6-4205-ab6c-865f0aecb215", "comment": "Malware payload (STRRAT)", "value": "0f975855bf3212ae39c65cf8e4bc48ca311dfabad337a76b103e976339ab1338f556a37259d1d5429169a5d398a1f868", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728785, "uuid": "7355f01f-8545-4c67-b98d-ccd3a22d7180", "value": "CCA3CF2BADEB84B8E53F813B11058262FA2D129CC406946F32FC55982C70E6F57576DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728785, "uuid": "87052031-7679-4828-8705-9bfcf636ef80", "value": "3072:n+09623cOpbrZo6RHbF4w3JZEzwNcEFAtC0FoG09:n+8bnBxBTEzgFnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728785, "uuid": "dea84a8c-319b-4e2a-9a05-e141ccf11c6a", "value": 99732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728785, "uuid": "cd91fd96-0ec1-4422-b979-f7af5d38b6c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728785, "uuid": "83d2a122-7e0c-4e84-835b-349c1ef7b381", "value": "Passport_ID_jpg.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8d5f05-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620712048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712048, "uuid": "f341dd03-25d6-4b15-8c81-37b7ee3a90fb", "comment": "Malware payload (SnakeKeylogger)", "value": "13d99c2ac641f89128925263d6ddc4f4", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712048, "uuid": "2d8433e0-1466-41be-bc20-2439f5125789", "comment": "Malware payload (SnakeKeylogger)", "value": "55519e954b4b28f0d1497294eab96130c3932928fdf4a739c9a94a884379282f", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712048, "uuid": "010590d2-149d-43e9-93e6-2291c97c589e", "comment": "Malware payload (SnakeKeylogger)", "value": "3e68058db2a6da752fd3e711955bed24440d6471", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712048, "uuid": "075a1700-716a-4b9f-a15f-d229e143cb94", "comment": "Malware payload (SnakeKeylogger)", "value": "9cf6ac9cb4dc7e510568d9aadeae1a50d77f744e62c6d249b53e9cd70c365135d3d2dd9dca65465fba2150fbc87a1194", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712048, "uuid": "887e8422-1577-4959-a860-3e17e795c8d0", "value": "07E52B7519FD02EEB8E9F8994F55BE9D863E9FD14530F9850680228F025194B33E83BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712048, "uuid": "1d85dadd-b163-4ef8-8da0-c1b43186b9a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712048, "uuid": "c560e511-b086-4dbe-806f-420bb862cd73", "value": "3072:lLxiRXtaZdv0vWxcpVrTY2QTaZ5aRk79SseQs39DrdxuD167PUOUc2UdDBjUHU0j:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712048, "uuid": "9d2f1c25-95d8-43f8-b032-841345997b4d", "value": 3189248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712048, "uuid": "581d2b65-d49f-4971-a68e-d863fbd64581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712048, "uuid": "76d2a638-cd48-48f6-848e-9cf3122b73c0", "value": "Consignment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c9e768-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Adwind)", "timestamp": 1620752543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752543, "uuid": "9b138632-338b-4295-aacd-69a7aabde6d6", "comment": "Malware payload (Adwind)", "value": "10b169afa784377b3665a075da9626e0", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752543, "uuid": "12cd727b-8b98-4327-953a-47022a4659c3", "comment": "Malware payload (Adwind)", "value": "5555d84072a95c635692f5636c3671f951c467cc9e8d9d807b562f462530787a", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752543, "uuid": "6bdb5a8d-27e7-4326-9da2-e2f580c2179b", "comment": "Malware payload (Adwind)", "value": "4f222af3ac23ff24b23902f8eaa48af8f548503c", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752543, "uuid": "93d517c8-05e7-4f4c-bb72-e0dc3fb657c1", "comment": "Malware payload (Adwind)", "value": "f17ca31a89860d92368189efa92de0c59b292853acf7beac63cc8f536f3ad71c98d3cd2ba6996d62e28c8c7e7a84f03e", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752543, "uuid": "e39e3178-954f-4499-b3a5-12f82bbb5d15", "value": "431523AF82050E36D0D0FD6092795AFA8F8B70ADF974C506B1DA12154943EC9FF606FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752543, "uuid": "091e209f-d587-4a24-86d9-10e5df887b0b", "value": "24576:N31/4QgkIDVsxRpcXKPeqo2f7ioH2sq/T/r6yLy:N31/fYDevag2oH2j6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752543, "uuid": "67809dcf-cb85-40e0-9bd9-5cd4d36b7ddf", "value": 919862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752543, "uuid": "74e16b60-aa36-48c7-82a0-3f331e241bfa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752543, "uuid": "5ff25a6d-b77b-43fb-bc91-1be195b90c42", "value": "Purchase Order.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0237e54-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716533, "uuid": "30ce46f3-36be-460e-8124-98dab1b9e00b", "comment": "Malware payload (AgentTesla)", "value": "7ea976fa35d432a5f1fbd95fedb6b491", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716533, "uuid": "d88f80e4-25d5-413f-8b49-799c79ea932c", "comment": "Malware payload (AgentTesla)", "value": "5559a0af254ec91974ee7dbc6e48ded1b27e0b0bba31e8a5a7c3d935cbb3a134", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716533, "uuid": "8ec8d486-801b-4ac1-b49d-37460f3edeba", "comment": "Malware payload (AgentTesla)", "value": "372fbcd853b6e3143abce13481b38a398a18d1c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716533, "uuid": "619548c1-f8d4-40cd-a8e0-819218d162e1", "comment": "Malware payload (AgentTesla)", "value": "7eaa4a5ce76417d0a52ed7c0ddc3e8e9a7d8737777a2c02f76182b43733aa4334136af314c5b2ec70ecd543c8f317696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716533, "uuid": "a150da09-8ee2-4e10-b96c-2e40dcbf1900", "value": "A3842254B3E8CB63D24721B5CCC2C2DDF621FD22AB45C7873798BB2DA9363584A66344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716533, "uuid": "2ef7a44b-7b38-4e15-9221-e894840b9269", "value": "12288:2tOMzOH8ZoFzUOcFvwX9eepPZm4c9Tia:2UMWRFzUwFpPe9Tia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716533, "uuid": "e8025cdc-9932-4a68-bb04-7731b9dfddd1", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716533, "uuid": "ae599603-2aab-4b23-a0a0-98ac7654b80a", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716533, "uuid": "6e11baa8-f12d-45ce-a180-c2ba355a3535", "value": "PL_056_06_713.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78480a8b-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1620740867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740867, "uuid": "eda920e5-79e3-4f75-a49a-73d1594a2c01", "comment": "Malware payload (GuLoader)", "value": "68d376dd3915d00b3fe16370178b801b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740867, "uuid": "ebb818df-4a91-410b-80d2-8ecdbf1db828", "comment": "Malware payload (GuLoader)", "value": "55fbd4afb3b387dcab2c4ccb60e2ced461773add94567b99207ccd7faa3ed05f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740867, "uuid": "323a357f-66fd-458b-85e2-efad2272558c", "comment": "Malware payload (GuLoader)", "value": "b54f02236df8278e44bfe72e03ceb7aab3ca6b21", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740867, "uuid": "693d94ef-cb0e-4eb1-95dc-18d26d5004df", "comment": "Malware payload (GuLoader)", "value": "eb7a45fb3daca537abd9708d77873cacee1c4638b7517a63304d2fbbe630ca0bd3ae67c9610950623dd42a05d8a7aa91", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740867, "uuid": "38850280-569a-4094-9c19-b1b76e0b6f88", "value": "CD8394263F60E4B1E8D3A8F9371471764FD23B350613A05FF28DB32772B96118A16B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740867, "uuid": "ca7548ae-e733-4797-9fea-fd74f7ea17a0", "value": "ec8e962978786706cf0189109090c85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740867, "uuid": "38c60457-7f89-4743-a802-0bbeba7f9cd7", "value": "768:LCDyuyLYrFSyaqvgQcihminF6hp+3fTGyBjfkcJYsq3yDUaMvw1D:eDyu8i3aqvg1QmiyYjflq3yDUaj1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740867, "uuid": "2f387dba-d1f4-4477-a88a-386bceb429cd", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740867, "uuid": "08a33418-a877-4998-ac86-1bf15ac913a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740867, "uuid": "9d10ef84-5563-4085-a93f-ee1ceda53821", "value": "Cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718dd620-b25c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620739567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739567, "uuid": "496ff883-01fe-4a03-8c5c-147c89ee7aec", "comment": "Malware payload (RedLineStealer)", "value": "3c795310fba80298492c46fd2a284873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739567, "uuid": "106422fd-49d6-4603-a70e-62896912e1ac", "comment": "Malware payload (RedLineStealer)", "value": "55fd4b535cce4249de23d8eb6c823f0f000e9e988c72a5a88d55353d84692271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739567, "uuid": "e11d2594-95ed-4993-a198-86f64198182e", "comment": "Malware payload (RedLineStealer)", "value": "f057eb36c03c6d785d26bc6ca95d5d6f8f8ccda3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739567, "uuid": "d482d4d8-50c1-47b6-8219-b96b59972f32", "comment": "Malware payload (RedLineStealer)", "value": "152f83e7b2ec0425df3a79ddad74d6fdfd0df3ea27a35c236947fa915b722185083ca4b2f6845cb0544b6d9fdc5747e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739567, "uuid": "4a193884-4dcf-4fed-a6dc-16849ffa73a1", "value": "F0B37C15A3AD9A14F2BD0BB4A4B001668FF5D9CF3011E7AB8FD498DE3E2778535089B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739567, "uuid": "f96ea4b9-f6fb-43b9-9aaf-ef492c71d3fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739567, "uuid": "5da1175f-bad4-4fd3-8471-99edf12abc00", "value": "3072:6NGXGzo6cdf0L+be2sU6NDjyGdVsPi5XLp34mw:vXGz2ft6ByJPi99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620739567, "uuid": "9f63d531-2bb3-473d-b0a2-d6a7c84a2532", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620739567, "uuid": "094da818-ffba-4c56-ac7d-3a92cfdcbcf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739567, "uuid": "bfc54e82-926a-49fe-b30e-e360e080c651", "value": "3c795310fba80298492c46fd2a284873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa0c130-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712954, "uuid": "aba9001a-a93a-4f6d-87f0-605fc2bcb7f9", "comment": "Malware payload (Dridex)", "value": "df785e198a0135bac6d83c17d504e144", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712954, "uuid": "46899dc5-74d0-4d03-8d53-4201964f42fb", "comment": "Malware payload (Dridex)", "value": "5681f635574822b7f42c0f2518022f555308b976906b27fbed65b81cb3674445", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712954, "uuid": "dfa87aeb-3d16-4a4c-8c4e-c926d1b8990d", "comment": "Malware payload (Dridex)", "value": "16cb16089eb0eb2f23698e141fe064e7376c5cc1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712954, "uuid": "c2c691e8-4c27-4e11-8d58-9746516dcd39", "comment": "Malware payload (Dridex)", "value": "50c121486324d9ad634e65c5de9eb07d316cba2dae32bf01e42b5dbc801cbb96618bc71b831f24e6d667c05d9c5f17a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712954, "uuid": "828448ec-f7b6-4e9f-b5de-42ec360d20c3", "value": "E5F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712954, "uuid": "017e6f5e-a9b7-4dc5-bd58-96f878c4604f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712954, "uuid": "f61f0287-b070-4dbb-bb54-64c982f191b3", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712954, "uuid": "08f5c289-609d-482d-9a68-5266dc385c28", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712954, "uuid": "74d51ff9-e42d-4d9b-8c2e-4cf35ab7e23f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712954, "uuid": "bd2cb60a-1483-4cde-913d-99634de5348a", "value": "df785e19_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d238c0c-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705683, "uuid": "7a986086-ac25-45d6-bd4b-785b84ed6d90", "comment": "Malware payload (Dridex)", "value": "2929176d2b8e8812601935ec4d9f13f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705683, "uuid": "612d8c69-9226-45cd-9756-856c3cf85bcf", "comment": "Malware payload (Dridex)", "value": "56d3e7ed6b14f9c121cc14910aa40cdb55a59a9b125db53cc09858bda4d77b9f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705683, "uuid": "91a4d47a-ac50-4aa8-9637-c92c17a9e922", "comment": "Malware payload (Dridex)", "value": "fff878b7ed48d7107e1f50504dc97706b9b77e62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705683, "uuid": "e113ece5-58b0-4fa1-9e81-5b58a9f85c26", "comment": "Malware payload (Dridex)", "value": "a55d8842d2d0fe4dc7497eb9dc15e7000fbe882c86642a9a1274fcfd1cd90430c9cb7caf0fca54b2321151c2268e099e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705683, "uuid": "08573678-9488-4093-8f64-878136c3ab47", "value": "8DF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705683, "uuid": "a1df3a33-5081-4d99-b2f2-b8f343bd5bcc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705683, "uuid": "2b4e6d44-648c-43ae-b3f7-61ab2296fd8e", "value": "3072:rIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705683, "uuid": "06db02ff-f04a-426f-a3b9-34e2df22a8bb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705683, "uuid": "c3c35efa-8ca8-4879-8a78-acdc581f21ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705683, "uuid": "82782198-681d-4f89-8c2a-3408f178c88a", "value": "2929176d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb89780-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705681, "uuid": "6374dc01-4e19-435c-b932-4e623d308b5d", "comment": "Malware payload (Dridex)", "value": "c722a89e84d84ab7db6fa9ee9f54ef18", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705681, "uuid": "1b94d5ac-0ec9-4618-80ce-b4495d7fa124", "comment": "Malware payload (Dridex)", "value": "582dee73aeff7c4c7ed98995c06a4f96c7d60924fde99c34a2cd09d534fa8fcf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705681, "uuid": "c80fb9d0-2b1d-4943-adac-08f26cc1694d", "comment": "Malware payload (Dridex)", "value": "e9dc9c7e3cf7fdb0cd26e6a412d31d65874f9f74", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705681, "uuid": "192663f9-5902-4080-867d-db466e8f75e8", "comment": "Malware payload (Dridex)", "value": "63f088137cee5753d678afe98021e309d7510e96bba08f0b454ee2d47ef713a49b57e65ce69e97c1c455ae96486f7ca0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705681, "uuid": "42fc9f03-aee8-4e39-aca9-b739f5919a2c", "value": "DDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705681, "uuid": "8c236e23-1b22-4bf7-9a9d-799c5b9c204d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705681, "uuid": "11208c0b-46b7-4549-9f82-323f607c4547", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705681, "uuid": "efbb6883-31f5-406c-9dbd-af6d94ea6eec", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705681, "uuid": "46601a93-60cf-4721-b09d-7eee40a3b929", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705681, "uuid": "d554d63a-3c9e-439e-83d7-bb35991253d5", "value": "c722a89e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaad4f2-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691264, "uuid": "f2484748-455f-4519-b7af-39286def6926", "comment": "Malware payload (Dridex)", "value": "d4c17f964653085ef8e07c44a0c9329d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691264, "uuid": "a99e4052-e4d5-4956-91f5-42d650124fb8", "comment": "Malware payload (Dridex)", "value": "5849ba2ccc11b2ffe54a5c5f40f793d20374fe918ee8ae83e7a6b21862c32e26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691264, "uuid": "a880710e-6ff6-413c-bcd8-737ae81bdb5a", "comment": "Malware payload (Dridex)", "value": "3971bdf98f418d5cb12c8d2b502d7366e8caecb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691264, "uuid": "a27dc432-711d-40d7-a83f-ba6838a8f7f7", "comment": "Malware payload (Dridex)", "value": "8da0cfc1f27b3c45e22956f18acd133a8ada36159ec66a2915f08a6d50521c514e8d21ee95cf48777d0036a1fb424b48", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691264, "uuid": "628d2237-87d6-4ce4-823b-d0ffb9de38b3", "value": "C5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691264, "uuid": "48d4c9c2-94b3-4c9b-a691-121a90064576", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691264, "uuid": "6c4ba9a7-bb25-46fc-b371-399c928dfc02", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691264, "uuid": "6d932456-f6a2-49e0-88a8-2fa795aff14a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691264, "uuid": "4a898abd-03c6-473a-a0d4-ded753b79730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691264, "uuid": "1fbda96b-6f9e-4849-adce-1c086344c8c8", "value": "d4c17f96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdef9c04-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620716932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716932, "uuid": "55d393f5-9a08-46f8-87f0-26edaf072a43", "comment": "Malware payload", "value": "b29c2ac3f03e78d408a90251cfab2050", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716932, "uuid": "003d1abe-58c4-4eef-8434-2c6040d00789", "comment": "Malware payload", "value": "584e8cc37bceb5ce6b39a50794961ef9d0ed134eafe67f0443a4d180f4184a15", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716932, "uuid": "96159ae1-c4b3-4da0-949e-b32de27cbedf", "comment": "Malware payload", "value": "bc97c166c786b700a460b034f9169211f693168c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716932, "uuid": "b3d0ca30-72d0-4f7d-97ec-26bdd4e7aeda", "comment": "Malware payload", "value": "ffaf42b2d61b1256d477c8d962ef4b232dd7b7a71752c701df08104189814f9df09f6cc36c8014c83c7c391cd7641844", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716932, "uuid": "cb53983f-f46d-4caa-a5b1-c2cd1e36fb45", "value": "0FB2CF586360CE05E2E337F52E7AC0988F61FF1A0D28566A3685774D98B2CD60A36773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716932, "uuid": "85efc903-05f0-4343-a4a2-f59948ea78b8", "value": "384:jbOe3NfhJhnhKd4bq3PCGAQv6qU6haSEpuXHUddDpP9lOlhUm:jbOe33JhnXbYKB6Uyatpu4DpPeUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716932, "uuid": "2bc4282c-ecc7-469b-abad-c18ec4dc1d26", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716932, "uuid": "4138fd32-a343-47eb-8766-c9316daee8b0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716932, "uuid": "9036be43-6395-4108-892f-5cd2cb801ff7", "value": "New Bonus Announcemnet.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0188bdca-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691276, "uuid": "8529b88c-40ad-41c6-a2b3-a37595afee4e", "comment": "Malware payload (Dridex)", "value": "b6f0ab1ff5f8a1e822b39dc0c0eb5f55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691276, "uuid": "73f67c27-1d4b-45f0-acf9-ac7171614e90", "comment": "Malware payload (Dridex)", "value": "5956bf513b9021ee74f78b057204fcff6dfd08fa27c69f6c04c18d574c907493", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691276, "uuid": "bbd4cdda-4c8f-4294-a9d0-fbfb6063dfcc", "comment": "Malware payload (Dridex)", "value": "6d7ffd4b9fac56f2f47f5c7a7b9ac84d05f1f081", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691276, "uuid": "9c449797-7936-4a77-ad38-70bc40f8bc9e", "comment": "Malware payload (Dridex)", "value": "0263933ade725ab45447e9d49e768bdb133d8d8741a34228cc3453e55ec0487b2467131a60058086757d5d68bd3659e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691276, "uuid": "2bf68db9-2cf1-442a-a816-d29340f73470", "value": "6EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691276, "uuid": "2a03123e-48d8-4e1c-9ad5-8aaf9d784296", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691276, "uuid": "afe91e03-541b-4dd9-bec2-6d8e379464ee", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691276, "uuid": "5dbd4b15-8f1a-4318-a24c-2c14cc744079", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691276, "uuid": "52f4c7be-c932-49b7-bd23-cf5e81b162bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691276, "uuid": "f7aaabf7-6abe-487e-9cda-733918a9b083", "value": "b6f0ab1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cf0a20-b293-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620763329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763329, "uuid": "e1d37e95-ed01-4c1e-9fd7-8e61fc632492", "comment": "Malware payload", "value": "73902a69ea0d540f9c0e58be33833285", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763329, "uuid": "4dbd1b7d-11db-4775-8779-cb09938a650f", "comment": "Malware payload", "value": "59af628af034604778d40d9b950f3d3f39ba6dc1423e5a8bd886f3ceb4b33f93", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763329, "uuid": "09315e36-075d-40df-a081-276d90a55733", "comment": "Malware payload", "value": "fd6d1d40bdd44597058f1f9043a14d5128d3b2fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763329, "uuid": "4c3ab6cc-5dde-45a2-bf94-12a872c9e178", "comment": "Malware payload", "value": "3b399ed2d472ab583ac0639be5073e19af9040fd90ba89aaa4c671c2cf01e662c1c01f4d366e7a4af14b4c3f5d429eb4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763329, "uuid": "c9e370d6-f091-4180-8f94-ca2101a77c16", "value": "D3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763329, "uuid": "01fbf48a-7523-4372-9797-0d61e72b2a58", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763329, "uuid": "de235955-a574-4319-b0ad-b7811da926ee", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620763329, "uuid": "d06b3650-be45-4edc-82e5-997cc468a2c4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620763329, "uuid": "bd5ba387-b779-4188-8554-86f8ef2bf2ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763329, "uuid": "1d23c45b-4ad2-4896-bc6f-cb202fe2e228", "value": "73902a69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654a6f99-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712918, "uuid": "b5df074d-b793-46e3-9229-9388a0b61075", "comment": "Malware payload (Dridex)", "value": "2d6c149410e3242595715102475f95b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712918, "uuid": "b21b437c-1036-4b39-83c6-b6b963d39d69", "comment": "Malware payload (Dridex)", "value": "59fb610f78bd59058b919558daf88939ee7ccdb7b10363edb22a71d304e54603", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712918, "uuid": "d7270213-6ddd-485c-af54-24580515c2bd", "comment": "Malware payload (Dridex)", "value": "41bba3315ce709f8b1b64013f2d386743b277aec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712918, "uuid": "92d3d4b5-763b-4fd5-a176-9fbb5dfaf84d", "comment": "Malware payload (Dridex)", "value": "41f6ec274d90503e04498315b2e6a43ebe0380d9f3486cd3c7486f90e23a151ed1b1de5a5635717e45ed67a7354e1a99", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712918, "uuid": "00457e30-b139-42de-b64d-3f7b3c65aba2", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712918, "uuid": "8c76d2d1-987f-4ccf-bc63-48ff254a8ba9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712918, "uuid": "2af94239-5ed9-4d15-b7f0-eddb40e2277c", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712918, "uuid": "381fa854-a13e-4653-937b-f3b06dae4a3c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712918, "uuid": "71305627-32e8-4efa-a35d-c8a754de50ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712918, "uuid": "37bdfc03-0435-4e6a-a89b-47ba851ae298", "value": "2d6c1494_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbba09f9-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729008, "uuid": "538cef03-6e17-470a-acdd-afe28c226c3e", "comment": "Malware payload (AgentTesla)", "value": "c895410694b7aaed3c3495536c240a93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729008, "uuid": "c5f74b1e-2161-413e-b776-4928225c26a3", "comment": "Malware payload (AgentTesla)", "value": "5a8ea261a8f88443529553058026027054b62c7dc2969632de08212db8293e27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729008, "uuid": "227689f8-a1c9-4a25-8c26-9efb8eef3e5a", "comment": "Malware payload (AgentTesla)", "value": "3abe57e1d7073caf1711dbc4bd82df7379f47211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729008, "uuid": "3986ab9e-209d-4b74-9c51-10b7ca9c61ba", "comment": "Malware payload (AgentTesla)", "value": "87cfe2d532b5d882d23031f0a043c8861b1e1a4aa148c459a7e6c0d4fbd38bc76d524eff715a7087b8529e7850745a79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729008, "uuid": "d88b3146-6621-491f-bcce-9372614f99a7", "value": "5205023133686FE2FA7DEB7D5960108893FAB50AE321E69E7DD541ED0425F428363B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729008, "uuid": "5db4b334-95ea-483d-b78f-ad54d22640a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729008, "uuid": "e432e516-3833-4b4c-9444-a86d792b50ec", "value": "24576:qZNmP5j9ICrCUv0L0T55gKaad3KDfRtX:qg9vCUMkB1KDfRtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729008, "uuid": "a63ce203-ee79-44f9-8964-03837efb264a", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729008, "uuid": "9d4c111f-152e-4fc6-a8db-3ce81be2c462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729008, "uuid": "f6ebcff7-4f79-4282-8ac5-6ea3133b4218", "value": "Request for Proposal \u2013 Byco project..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf128844-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698492, "uuid": "48ece821-6c4e-41f8-b07b-9d73a213fcc7", "comment": "Malware payload (Dridex)", "value": "e4ba227ce05f0662d1210bb5e50cc9ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698492, "uuid": "c85ec666-8343-4cb5-b5af-4dde4a314ee2", "comment": "Malware payload (Dridex)", "value": "5aa8dba13ef43c0f9447dd61ded26f2e15ed168ffb2e564c87b1ea7a199ade2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698492, "uuid": "010387d9-9d53-4cb5-9869-66c8eadbbb6f", "comment": "Malware payload (Dridex)", "value": "050a902dc77c07dd94164109e3f9c286bf6b595e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698492, "uuid": "35bbf60c-ecb7-46c3-b812-6edbfcfb2561", "comment": "Malware payload (Dridex)", "value": "b05d78a35e9f2a401961bc88e97cadf8a307cbef52723d050e477525da589885a51f9396ec6b7c71669fce708d2998ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698492, "uuid": "e8ac7b93-a63f-4dbd-bd11-a602d2f9bbac", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698492, "uuid": "80a2f39a-aa50-41c0-ac85-d48fbd1060e6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698492, "uuid": "3c1c16e5-704e-4967-9943-5386f3e20b52", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698492, "uuid": "e8010d80-fc22-486f-89b7-904b181a753a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698492, "uuid": "08e56bae-0391-416d-819a-f2d558f520d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698492, "uuid": "31459937-4015-4927-9145-26ad1cce3b2b", "value": "e4ba227c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc94cd29-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620698515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698515, "uuid": "df5b5dd5-e753-4538-8885-375d03f615b1", "comment": "Malware payload", "value": "790509f5b0cefba5f622533771f06176", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698515, "uuid": "df1b0962-4bf1-4145-9e2d-3cacde1a5037", "comment": "Malware payload", "value": "5b247d96595d96e1eeb0f2091f7c29b384e79d8f152bddee78150d3829a37bf1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698515, "uuid": "a473fcf8-fb0b-4f52-8044-20dda2fbb8d4", "comment": "Malware payload", "value": "0a3abac511df20dc9a1d417e04c666c5cd97acad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698515, "uuid": "fdcb72b1-1ed0-485c-b36b-617fc2b33601", "comment": "Malware payload", "value": "fcb05080245e441c982e946d3e5493dfb9185f8f2f856a29b47e721b640f047f81aad58fe977205a709f57e131609833", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698515, "uuid": "711a85cc-eb0d-45c4-bb89-8c4a47f25858", "value": "F89312D7715E69A1624783589207B90E4EECC07FCF7BEB3F5A20630B845C3A61AC4D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698515, "uuid": "71206a10-f7a8-447b-9c9b-3240b98789b0", "value": "1536:AX3tuhPBoTqvJUJ1wl25ZyBGr2ocuOYMogOs/ZZIepg9icTQO+V+hnHSLJUes3k:AtKUJ1lPfrlFM6CkSwifBwnH+y3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698515, "uuid": "d3ee8cc3-2726-41a6-90f7-ec3e5c7e4703", "value": 89093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698515, "uuid": "1b1a2bc1-e865-412e-b28c-449c16e7f8f0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698515, "uuid": "a35a94d6-c577-497e-a2ef-cca4dd2b5946", "value": "790509f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cbf9f3-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620694883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694883, "uuid": "cf21debc-8022-476e-a952-1a7904307d3f", "comment": "Malware payload (DarkSide)", "value": "786a6eddf1e391d77228c29867b40d23", "object_relation": "md5", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694883, "uuid": "dfb7587c-0f4f-4b71-96cb-23d252b5b10a", "comment": "Malware payload (DarkSide)", "value": "5b565b5878ea50f5dd31992dd6f3a8363031a44b00e574f18ff70cc982cb2966", "object_relation": "sha256", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694883, "uuid": "866e7cc4-7ea4-423b-b1c5-01eaeae82af5", "comment": "Malware payload (DarkSide)", "value": "865be43b9d4d731f7af7b6fde24b75eaef951851", "object_relation": "sha1", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694883, "uuid": "21b44a94-3621-438a-ada2-18e731946581", "comment": "Malware payload (DarkSide)", "value": "42219333b5c7322a965a34e31acbe0a16dcfb1301d267fdff5f2575faf4624037e88647e376a53bfe6e978778e2d46b1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694883, "uuid": "00ce90d6-90de-4b43-ac3c-2d1a08395798", "value": "C1D2E0AD11087DEA20C3F1FDDF9584A6805379E80FF09EAA523B4B7A3EC5FE1085454A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694883, "uuid": "9559e953-0c9b-4cdc-9b2f-9de9f64cedcf", "value": "384:spSmq6n5O01hQ7K6RXFgFPCD2PUYAUPrSP/9mJJK4ZkXPn3C1ECFmeNaGQacy3B/:DWHHQhUm2PDrS3QtsP0XFm6aGNnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694883, "uuid": "1868eb8e-3820-49b5-a959-f1dc86cf30fb", "value": 29723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694883, "uuid": "c5486e25-c501-4056-b3e5-cc0811ce0eef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694883, "uuid": "6ffe1257-7c88-4c13-85d8-7f4d421a6e33", "value": "786a6edd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668c7c55-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694881, "uuid": "4200847a-5c43-4680-90a3-28e06282887a", "comment": "Malware payload (Dridex)", "value": "67052618ec5678381d05c73c51b00be5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694881, "uuid": "bc9bda38-a65a-4c92-85e1-b1c15588a423", "comment": "Malware payload (Dridex)", "value": "5b603b745ac84c4517e03a00fa5b7f33dce30ba707b2f21528b1e22d0e154199", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694881, "uuid": "5c9fbb29-278a-4ff3-a824-ca7c961d4555", "comment": "Malware payload (Dridex)", "value": "a480850d70c03f5df8d2706adad022c7e882e8b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694881, "uuid": "38007349-2966-44d7-acce-5af80259773e", "comment": "Malware payload (Dridex)", "value": "91efcf5f11505258aeef6848ee1c1561675933a31bbd35d8dd477aa6dfeb9c3478c7d5749ecdd8e795b90994e4205341", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694881, "uuid": "2b553e10-fdcf-44c5-818d-b94016390479", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694881, "uuid": "a0be6cd0-b08e-48db-b4a9-2461398144f1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694881, "uuid": "756c7b17-cd79-477f-90a6-925ef49e2270", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694881, "uuid": "579433fe-4dc3-4e91-ba46-d95b520603b4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694881, "uuid": "0963d31c-295f-45bc-a992-ab96626d1b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694881, "uuid": "58481396-a77d-4d82-b359-22e620ec6332", "value": "67052618_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616e946d-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694872, "uuid": "7b49577d-32c8-4a03-ba8f-e5d3c8a636c6", "comment": "Malware payload (Dridex)", "value": "ca15b6544279f0c08c865f7006d2176c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694872, "uuid": "aa1b80d8-3376-407b-96f9-a0204642b671", "comment": "Malware payload (Dridex)", "value": "5df8119b3aebe3e7380a7b409a624e83277f46aef191a3df2a85d5e1bee80648", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694872, "uuid": "4df678f0-d4ef-47e8-abbb-3941a2e62ba8", "comment": "Malware payload (Dridex)", "value": "c59d20b806e1e4c29613f272edd304e14e374643", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694872, "uuid": "9d3fa7d8-325d-4bdc-80c8-7f0daa72a47b", "comment": "Malware payload (Dridex)", "value": "4af4a6238c21354728153a1d1031b467b8e809be292384a37711ffcf0d07e7996134c57b66160a1b36d2839b11e3ff6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694872, "uuid": "4d8fc886-3d40-46b7-91d6-4fd4bb56753d", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694872, "uuid": "90b0d4db-8692-47de-8bab-6c9223d59d7e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694872, "uuid": "40fa16ae-3347-4a9b-bfa2-22c7964aa5be", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694872, "uuid": "d86f4396-193c-45eb-adf5-a261db7d4737", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694872, "uuid": "cb0a6d05-d970-488d-be60-ed496874a9a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694872, "uuid": "f19219b5-9128-4f5e-beac-527260f86b71", "value": "ca15b654_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81342c1a-b23a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620724991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724991, "uuid": "f2161deb-7939-4bbd-9996-743661533995", "comment": "Malware payload (Dridex)", "value": "7411ea209b97ce13f71859cfe359b80c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724991, "uuid": "ac620a55-5b91-496a-820c-94ab302cf376", "comment": "Malware payload (Dridex)", "value": "5e4db283fe36f0c953f86f6bae148b218c0d7bd8b25820e69c11a44e35444121", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724991, "uuid": "edd35541-1048-44e6-b0d2-bbcaca038895", "comment": "Malware payload (Dridex)", "value": "a1e35bbf26923fb17a0e40219884c42ffe5b3391", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724991, "uuid": "badb96c4-9ca4-4cc2-9fc1-5a639afb92e1", "comment": "Malware payload (Dridex)", "value": "6201ac8e699b38d255460b02d5b4fd2768ef4ea27679a05f3cdc43e3ab2572fa7fb7dacdc59a8bfde1ddf6192af98498", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724991, "uuid": "f5840e3d-6cfa-40fa-9cb6-9a607b64f195", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724991, "uuid": "84af901a-b37b-45ab-a31b-71566ef138bb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724991, "uuid": "ef71278b-4766-48b6-b071-194bf4084979", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724991, "uuid": "f2e35dea-3e8e-4424-b983-7d2a47e9c09d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724991, "uuid": "188be847-a4f3-48d1-a3f8-243467c7ec7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724991, "uuid": "a29be2f2-115a-4408-84b3-1a53c85bd2da", "value": "5e4db283fe36f0c953f86f6bae148b218c0d7bd8b25820e69c11a44e35444121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ef3170-b26b-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620745826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745826, "uuid": "952b21a0-1938-46b4-b6ea-1a6c75d04b37", "comment": "Malware payload (NanoCore)", "value": "b2fdf1f0e2245c9ba9f0f5ea2dea1b71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745826, "uuid": "7926dff7-b9fb-4ade-a798-ec30b3ab13b0", "comment": "Malware payload (NanoCore)", "value": "5e92e39b866d490cdeb534eb04a5cb2ffc34231c29881af7921aad42965afd10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745826, "uuid": "8a078de4-f80d-40a6-935c-56e1a8cbcb67", "comment": "Malware payload (NanoCore)", "value": "973ba80c1c7f386721cc27db81eebbee7a64ac43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745826, "uuid": "9cd1a074-092b-4276-9974-e9214489fa5c", "comment": "Malware payload (NanoCore)", "value": "05f4dfa0988f530d570db5a2663ac8f2c42c26ff5e4614dc7c3b543e49461d10dc61dc7ea13a915ede0558e07bbef39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745826, "uuid": "ee73cb0b-9465-4247-bc92-9cec6d199022", "value": "1F4412271332DDB7E06A0F715CB283CAAFE6604451A5138F8B947F393D32B93A12E941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745826, "uuid": "e9aa5cf9-4ba8-4c93-a651-0af4376030ad", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745826, "uuid": "6a7b7c6b-d7e7-4f01-a8c2-aca8747de9cf", "value": "6144:L9X0GgVt/ShZYBT+hGIRBMRE7+Xh/AmFDtOWcRRxPFZ:l0VDahOBqhZy1oaDtOLXdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745826, "uuid": "d935614b-b275-431d-b95c-dc79d25b6a6f", "value": 255644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745826, "uuid": "e4f56552-f408-4721-8d76-449a6ea7a34e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745826, "uuid": "c92a0aea-9966-4d65-875e-25868ae8b76e", "value": "RFQEMFA.Elektrik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19ee375-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Babuk)", "timestamp": 1620698497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698497, "uuid": "8b5fc0b2-b0df-4326-bddb-5143f6553c59", "comment": "Malware payload (Babuk)", "value": "a51961badad00c66fddf3a72f85327d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698497, "uuid": "28dcb204-0b1f-4e37-8a42-73d8dff5b5a7", "comment": "Malware payload (Babuk)", "value": "5ea6a1afc900ff3765b3838827e024e324e5180a7674fd1bf59c02425db1a745", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698497, "uuid": "18dbc1dc-fb99-4fe4-bff7-e66cbc223b3c", "comment": "Malware payload (Babuk)", "value": "18c6e911ade4d82fda26af54c183129421c919e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698497, "uuid": "0839f868-916f-4d06-b7af-dd17b6924ce1", "comment": "Malware payload (Babuk)", "value": "ff25645fa8c04253db307318377cd231b023f91bffb3228e1eb3f66960d5311fd03b3106e045273ff6f9feafd2203a6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698497, "uuid": "2d824f9e-4ccb-463d-8f58-bbf5745ed432", "value": "05D2F121E6DC1C347E513F9693B7EBC2E4D28552E7F05717CDC298A0A2B6442AC1AC6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698497, "uuid": "a4d9bfba-052c-41e7-964f-fb78f608f234", "value": "768:T+Yuh9HIUdTIMtgyX9b5EI+DcAI7emtbYdwIHY8NrBgKsF2gDI/:T+YOnHqqqYftEiIHYKrGkuI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698497, "uuid": "022b19f5-e2ca-4567-97c1-5737566ccfe1", "value": 30027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698497, "uuid": "d98b1b96-e4d5-4294-851b-e7a0e01cd88d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698497, "uuid": "2a284050-3467-4068-a420-7968f60199c2", "value": "a51961ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f8673c-b239-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620724373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724373, "uuid": "19e414dc-83fd-41a1-a985-f19f530ac233", "comment": "Malware payload (Dridex)", "value": "ec39f6e85ee66638551c372cb27c004a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724373, "uuid": "7e6711cb-d53e-4271-ae2b-13f31c5e091b", "comment": "Malware payload (Dridex)", "value": "5f0fa6a3a010e0019a84902e1e28ca8f3661b77fbe8b0a53605d1c98347e6a75", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724373, "uuid": "4f733860-7d7b-4936-bb8d-ed6764ab3823", "comment": "Malware payload (Dridex)", "value": "faa58b15cdd5c3bab0d433bc9e8a7b6e21c42894", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724373, "uuid": "dbe8fb07-75d8-4314-8fb2-64ad676656ef", "comment": "Malware payload (Dridex)", "value": "15d13b96fb6e098d6cd8ef519692f78bc1f2f38868e3f81444568c1ecdc73628fd416b4c6d80d7717a7d79e7c3dce895", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724373, "uuid": "bf863ad3-2378-410f-8f86-f8be9393fced", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724373, "uuid": "39f5b0b1-9aee-4d33-98a6-7e0f2d1da595", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724373, "uuid": "83bf4b8b-678f-4e13-b467-71bbdb066e8d", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724373, "uuid": "7aa702fa-343c-47ba-a6db-c0e58bc6ab9e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724373, "uuid": "b867cd06-8a6a-4aca-aed2-75ac16de558d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724373, "uuid": "0e96d3ab-d104-41e0-8063-f3cf5db0ef01", "value": "5f0fa6a3a010e0019a84902e1e28ca8f3661b77fbe8b0a53605d1c98347e6a75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef3bfe6-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705713, "uuid": "f464ca06-9e84-4bbd-9e2a-0f284dcef76c", "comment": "Malware payload (Dridex)", "value": "61ef4b49cf5f33835b348b6d7f9d0e1c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705713, "uuid": "00b84620-a483-473f-8ba3-1e35c003ca08", "comment": "Malware payload (Dridex)", "value": "5f94ad091adf89dd8e8de3e6abd7622eccfaf752f8764c364520a6c58501e0cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705713, "uuid": "c6de8305-b0e6-4462-8a47-1ba7a17ae713", "comment": "Malware payload (Dridex)", "value": "f91b3e988c719f6d1321cbf25404fe98b0da5e28", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705713, "uuid": "ed52c8e9-0a80-4d04-b4e2-348a5b2486fe", "comment": "Malware payload (Dridex)", "value": "9436cf9e19cf9a8a5d0cdd7e1ea36017d295d97a625e1f537125c1e099fdf550fc9f8f28195954386b0afa56209845d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705713, "uuid": "2500340d-f6b9-4bca-8c49-cec936271157", "value": "D2F3D0906A9BDF0ED9C13CF96A96A879B173458D811FDAB4D0CE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705713, "uuid": "db8f3054-49d9-4207-8925-471ff5de6937", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705713, "uuid": "90d51674-0d2f-4e20-af7d-c720a73ca255", "value": "3072:+esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLpM:w4+VZQpt5hyPsa1ekiEKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705713, "uuid": "3217e188-bbbc-478f-8c1f-50607e12faf2", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705713, "uuid": "0a688941-cfc1-42a0-a552-7a17ee9dfa8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705713, "uuid": "0d983c9f-4ce2-4e72-9e97-f64cec56ee29", "value": "61ef4b49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa45867-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715396, "uuid": "d249bc71-f7a6-4108-9d1f-d76c7c0ea529", "comment": "Malware payload (AgentTesla)", "value": "8ed66cadb1ad75764bff16d8546ee673", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715396, "uuid": "c807d80b-756c-41bf-a6da-cfa3402f737d", "comment": "Malware payload (AgentTesla)", "value": "602a957016136b06b8919ab263c95c0bb267ece981dcc6375d764dea3445fa51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715396, "uuid": "32599de8-9e42-48c2-81ef-d1168d401ed2", "comment": "Malware payload (AgentTesla)", "value": "cc5078f7d0e93c21c4ae1d938bac345801346b3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715396, "uuid": "856ddad1-3e5a-41a9-9744-1a6719429d18", "comment": "Malware payload (AgentTesla)", "value": "028179e16d10b613545d03149d740963e5dcccbfd32a3b94f3f23074a3a344bd723baebdf0a96e7abca245b27573c53e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715396, "uuid": "dd142076-be2a-4e4e-8ba3-fae4da6ea7bd", "value": "42F4E0203BD8AA58E5BF47761870D05023F2BA27C762C65E6D9DD08E1E72746C7B2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715396, "uuid": "7a37d6b6-92b7-4e14-b29b-e729c6211473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715396, "uuid": "a849d1e3-5b82-444b-8369-b8b3ec40af85", "value": "24576:1ELpXtPGhhh/bGrUW6oo2nLN+h3BszxU:GLpXt+KAoph+5Bsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715396, "uuid": "aeba28b5-222a-4d2d-b7ed-bc9db5c877b0", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715396, "uuid": "5736b4cd-9009-42e8-816b-7b4eb586551b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715396, "uuid": "21d8df4a-27bd-4e31-b9ed-dcaabcd1e85b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0427c7-b235-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620722757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722757, "uuid": "a8ecff6f-7a7b-458d-b938-17af5029ab59", "comment": "Malware payload (AZORult)", "value": "e589ae7662d7e8a98fb8a194e20d0ef7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722757, "uuid": "36b65d24-f083-4181-a8ad-1d40976a4bfa", "comment": "Malware payload (AZORult)", "value": "6049c21287620b9ebc1db5980c2c383ac7a5b57119cbf757a54bb5ba27645eb4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722757, "uuid": "61dedd05-1359-4627-a1b2-849a762dde8f", "comment": "Malware payload (AZORult)", "value": "5f780f386e173c4578e7b15cd92cdb7afa1c1071", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722757, "uuid": "aba8c2f3-fa26-4a14-a647-6701a5d4a519", "comment": "Malware payload (AZORult)", "value": "45d23ec0760696b6c42bf5cc74c14920fefe2a167a39b8244c7e38ccdff10eb0b5cd5f873aa6403ab08e906684ac9e27", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722757, "uuid": "f525deff-81ae-4ffd-91d1-d9dc0e821787", "value": "85B41205BA099912CAC21E3ED5E108790360BD976326C60B38FD7F193A37FCA596F15E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722757, "uuid": "98fb40f1-649c-4176-8e52-83528cf288aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722757, "uuid": "58de8767-8454-42b3-8e08-b3893aaae582", "value": "12288:/HFMw7Y9MA59CyMAn0Z3P0t6b1LJ0CDC/BB6r:/H+w09tVQT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620722757, "uuid": "d00856a5-6465-408d-84c9-6b36f3636b84", "value": 542008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620722757, "uuid": "714aaa38-e0f4-44fc-b492-52e774b85a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722757, "uuid": "95f43469-cbfb-4051-b05a-1340b8bdef75", "value": "e589ae7662d7e8a98fb8a194e20d0ef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8fd38c-b221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620714277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714277, "uuid": "44b9c947-5b1d-4341-a114-e8c72ad63530", "comment": "Malware payload (Formbook)", "value": "fb99f7f2c961cdf80e6b7c48b784d8dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714277, "uuid": "acae2367-a2f1-4501-be38-9d57e5090cb2", "comment": "Malware payload (Formbook)", "value": "60c1eab74ac9ffdba0ba4374de792394c444a0bb8b9ad3636f8813211417089e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714277, "uuid": "d9eaf729-008d-499b-930e-184bb1091450", "comment": "Malware payload (Formbook)", "value": "823cffd3e658e56e87ae38349a753df92b0e9b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714277, "uuid": "6ceb0b65-580c-4eb1-9b44-c92fc363e9cb", "comment": "Malware payload (Formbook)", "value": "423853e21a59bb242a3fea02b2c90eef95bcb0c0173f239714c83920c25d0260b51409d7bf1ec56bdde2672910bf5765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714277, "uuid": "09e8ddc8-58c0-4f17-9450-bf614c0db32e", "value": "1805D0683AA4C946D7BD57BC84B1A23407F87EA66D53E70E0AB030FC3E77724D91191A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714277, "uuid": "57aa1c61-83a3-44de-8813-ecb8581b3cd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714277, "uuid": "e4f67eb6-ee19-4b44-a0e8-a8f3aa5da81e", "value": "12288:PBY3CPgJz/mm2eW8sWFUEtnCoUjZFheqksMjvLe:nIJzJ2FWplCDjZFhgvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714277, "uuid": "f87fefd3-a4b8-4908-9598-197f130d3f6d", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714277, "uuid": "81e5ac1d-d89d-4d83-a0ed-f97d4427c149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714277, "uuid": "cf36e336-21ed-488e-a095-2f5795fb153f", "value": "DOC24457188209927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe1d170-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723801, "uuid": "9293f188-3ef2-4510-8bb0-bae0cd0fb1cb", "comment": "Malware payload (Dridex)", "value": "c5c91a7243d60aaf8793328f7f84a9ec", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723801, "uuid": "a7fde033-2c49-4abe-8e75-63d5ffff73e0", "comment": "Malware payload (Dridex)", "value": "60f1e0c919c4a269bf7f4299f1471616a955d0e0e3136585db6e43ce9fe91178", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723801, "uuid": "af3e4b9e-21ea-40f8-a3d9-7bd398149cc7", "comment": "Malware payload (Dridex)", "value": "894b446da42d2bef62753a3e13bf286b339167fc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723801, "uuid": "33a11d3e-7c98-46e3-9004-41537b06f336", "comment": "Malware payload (Dridex)", "value": "7a9cd46681b27445b03308d94350d4f74d21a9041dc32200e2ac61778840b0b3ff8c6b3211e145274801c8542003224f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723801, "uuid": "be731599-b5e8-4e72-a78b-71b8b31c5688", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723801, "uuid": "900579b1-1c11-4baa-95b7-896050f6c32b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723801, "uuid": "6c613c5e-3aa3-47e0-bce9-f66fb4bae293", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723801, "uuid": "2220d694-5968-4398-a81b-c83921f2c85f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723801, "uuid": "53b0aa91-a4cd-499f-9c27-51c3ce2c2db3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723801, "uuid": "162d30ef-1974-4a67-b5ba-cba27baafc5a", "value": "60f1e0c919c4a269bf7f4299f1471616a955d0e0e3136585db6e43ce9fe91178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c329b23-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620716339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716339, "uuid": "42f4964e-d69e-4448-b030-73df45ac5c08", "comment": "Malware payload (AsyncRAT)", "value": "fbf6cfb130b6a7b28cc1281d529b12a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716339, "uuid": "2f8bc429-8c18-4df5-b7d1-37f6717f667e", "comment": "Malware payload (AsyncRAT)", "value": "617aa92e831cdacf856b50cc3e2ffadfa1dc75ece61992caa1b44dcaa14fcfa0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716339, "uuid": "c9e77fdc-61b7-437c-b9a8-388e26837618", "comment": "Malware payload (AsyncRAT)", "value": "d36be9b86bf45a6858b4311d25f18f150f538187", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716339, "uuid": "d90d047a-0cfd-4be4-adfa-063cd7b6310d", "comment": "Malware payload (AsyncRAT)", "value": "579b601870c80f1bf2b84f4a058fc61dce4fb48991277deed22ca7994769fd8ab63c7e64943f8f69ad8979ec5207c170", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716339, "uuid": "3ac2d2ea-0a7f-4689-b388-4c183b7648a0", "value": "4DF4230333E4A524D0BF5BB969E2680543F4F1059266E70D7F8499BEA9E37C0C9853DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716339, "uuid": "04aaa542-1982-4bbc-8a4a-628180e88562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716339, "uuid": "046b2e40-9e65-426e-9ee8-8dd4e15500fa", "value": "12288:uERyibQxvyL4gcb5bygGHt07ochj6F8Hav1fH3FhZ1KboiG+vv:74Tb5byFN07S8HadhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716339, "uuid": "c55881dd-ecfa-42f0-8f39-8ce127ccb28a", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716339, "uuid": "2c356ac5-e0ae-463b-abf2-f90de542f1c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716339, "uuid": "b4e1c5d7-6c61-4b91-9842-455152c28fdf", "value": "SCAN_DOCX-36673672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4947b45-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729425, "uuid": "44cd58f4-a826-444d-84fe-a35ed849da2d", "comment": "Malware payload (AgentTesla)", "value": "9a67f0453cb0442cc374d0e95a7d20a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729425, "uuid": "991399d9-5b16-423c-9c70-7bd6c65dc824", "comment": "Malware payload (AgentTesla)", "value": "61d174848fcdab757bf469b021c329b9b698c1f3c621d3387ff515c360476cb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729425, "uuid": "66553507-8a45-4b51-a40a-3ede90d129b3", "comment": "Malware payload (AgentTesla)", "value": "0e49ab04d2aed969f87e9de86a1eb6f0e3fb67b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729425, "uuid": "f6b77ae4-5439-4e57-8904-c67185fb6dcf", "comment": "Malware payload (AgentTesla)", "value": "9b52b48ccc18635f8f8ad3e2075aefc317e51f7f1ee9c21f88038cb917a68adf1fa7a02180fbc4f713312a91bd694fce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729425, "uuid": "cc20cbc8-f278-4145-9416-96ac6c23df90", "value": "3515123233285FE2E27EDB7DD825108853F9B40AE311E69E7DE905ED0865F4287A2F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729425, "uuid": "17e943ae-0098-47c8-9d6a-929fa9907d06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729425, "uuid": "a0275143-5a5e-42ec-97a1-d969590f1c14", "value": "24576:Z6uaqUFvBh+QpjULwv8qplKN4lfBtxA1TkE:ZTUFpEQpjuJIKNcX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729425, "uuid": "0d664589-8e8a-46e1-9123-17822a5f018d", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729425, "uuid": "edcbeb33-5a7d-414c-b915-23bb7cb9d751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729425, "uuid": "e8caeaa9-e3df-48d4-bf9a-165123207023", "value": "w5FqUzyDmszpdwX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a012d1-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702102, "uuid": "47e2b4b8-82f0-4d3c-8e3d-9390757772e9", "comment": "Malware payload (Dridex)", "value": "3bef87017a3b1ce669b4cfb881bb87a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702102, "uuid": "94caec82-fcf5-49e0-90e4-0315a8940d98", "comment": "Malware payload (Dridex)", "value": "61d419bf0ad1b2dc493de95db7e1929f64bcc10ca63be41256932dfe09f171ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702102, "uuid": "e4bde00f-148e-401f-aa38-9f872ea88646", "comment": "Malware payload (Dridex)", "value": "6f4114f4336e04910ee32cf372eae9881461dc73", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702102, "uuid": "4d3362e1-47ca-4e9f-9b9b-111c281f7d8f", "comment": "Malware payload (Dridex)", "value": "51cb864d3ecec6b8577f8dcc097ec7880f9bfee117f12d5d038142db7692c6502465bc47756bd1f52f90e58d160e99bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702102, "uuid": "96418f4d-ef39-48d1-ac86-a1d66dd25369", "value": "5AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702102, "uuid": "754e4d51-b6ef-4680-b177-fcc67019d510", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702102, "uuid": "14325645-98b2-46db-85ef-f0ee205bde56", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702102, "uuid": "b3548130-8200-41ca-9980-1dea324fd790", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702102, "uuid": "4fadfa84-4993-4364-8dc6-36771a3d6dff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702102, "uuid": "2258d05c-008c-4200-b60f-959325735b35", "value": "3bef8701_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0443619-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723808, "uuid": "56f9f12e-4db4-49d6-8f1a-c5f9c0d9bb8b", "comment": "Malware payload (Dridex)", "value": "0e43a64bc766b3561d196ad234cc30b6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723808, "uuid": "2c82e90b-0c63-4df0-8d78-3e6b4cff3095", "comment": "Malware payload (Dridex)", "value": "61e19c16bab26494f5d4115a1ebb0c406e2b72a8b4ad2684248d6b68a5ebae58", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723808, "uuid": "3c013bc6-0a4a-49c5-9bd9-eeccfd1e7033", "comment": "Malware payload (Dridex)", "value": "04a24545a8daf2105ac10add175051af033ef41d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723808, "uuid": "29ea59af-bc03-4898-9e0b-76b19bd5ed1f", "comment": "Malware payload (Dridex)", "value": "15e40f4d519d7272e3a08402e72a3e74a05963d1a2232f01bcc634052807ca465be2d46e97cf91d7dff649a7e0160a16", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723808, "uuid": "14456a56-4bde-4945-9940-dc93d0df11b7", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723808, "uuid": "06315fb4-cb0e-4cab-b4c0-7e307a64349e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723808, "uuid": "6e1816c4-b725-4968-ae03-deefd5df85fb", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723808, "uuid": "c01e3a0b-b31a-4cf5-88bb-eeb45e9b483e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723808, "uuid": "ef43c24d-89d4-46b1-b98a-e66488cd18e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723808, "uuid": "ea8a5318-a997-4034-a3b8-90f0ab80fae0", "value": "61e19c16bab26494f5d4115a1ebb0c406e2b72a8b4ad2684248d6b68a5ebae58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5fa5e2-b24f-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1620733975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620733975, "uuid": "241a9a00-796e-4a1a-b639-b3a1532ed5bc", "comment": "Malware payload (GuLoader)", "value": "d4f1e0ced899708fdd34faab5f154ff3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620733975, "uuid": "77ccfd6e-6147-4160-b3d1-610c48507283", "comment": "Malware payload (GuLoader)", "value": "6218efd8433d165f2a8cc049395a53d1f0eb04f10e0ddc1f9a2c70b919b84dbd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620733975, "uuid": "82db3088-66b9-41b8-b569-ac80c35f9a8d", "comment": "Malware payload (GuLoader)", "value": "1d85ab627f08d4de28ba77623259d449f41f7112", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620733975, "uuid": "48b4c475-4fbe-4ef0-8c02-ed3576fd8a6e", "comment": "Malware payload (GuLoader)", "value": "e5eb3b4f049e1ea2a436280ee82fa542f0f492e14df43ccf923faf07ab18d7a762c9371f320784de2c461739f59648bc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620733975, "uuid": "bdc725e8-c299-433a-a727-f38a329b7a5d", "value": "F0B3A2B67254AC72E216F474370623BFA1592B7607C784CFCDC21118F6A1B9AE7212F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620733975, "uuid": "c2201e27-7412-4be8-a094-3dcb76b062b7", "value": "aa9238523bf06888358b073ba6a8b5c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620733975, "uuid": "d6b519f3-fec3-458c-8fc2-447a35499a8d", "value": "1536:jzFQ30+2EUZn/oGirSub7w8ozyNup80vnrAC6roHa5zWFAPQzMTI:/R+JUZv2SuFA/pXrApoWAMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620733975, "uuid": "b697d2c3-9f70-4c01-b3b9-1688d7a4b6dc", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620733975, "uuid": "853da59e-a027-49da-be66-af909dbeb347", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620733975, "uuid": "1a96b28e-1c42-42e1-bc96-54e9409e3971", "value": "NewPO.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb83db7b-b260-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620741436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741436, "uuid": "065f38f1-bbf5-4ca4-a31a-133d316b225d", "comment": "Malware payload (NanoCore)", "value": "c28e5cc08154a8dc996875f38c695a38", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741436, "uuid": "5bd24d84-2c98-4dac-9bd0-306b4cb9a933", "comment": "Malware payload (NanoCore)", "value": "62498d85f62171016203ccc515022d697af7fc0dbb1dd4a3dff9bece884aa04d", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741436, "uuid": "7ae01a86-9b97-4a21-a204-57d004f71cb6", "comment": "Malware payload (NanoCore)", "value": "66d133e2e0fd72a2b5981d90959f3ac99a91c808", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741436, "uuid": "2864026f-f2b3-4c39-9dc8-fe6a92d03969", "comment": "Malware payload (NanoCore)", "value": "d401679d4b32afd3c467bda9aff2d2b0feddc6a094ba9ec56a793630cff4400a6f37ba1e7c1ec30a5139ff40e1c257d1", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741436, "uuid": "961e5ea5-0278-48a4-8711-b78abb84dc25", "value": "9D7590A8315031EED577CEF69F992C14FA612866431B410AC22323F94A9FF97DE244F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741436, "uuid": "b0f30d65-3804-4e9e-9554-64d19d9148ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741436, "uuid": "1def54b8-040c-4877-b391-a91f94874b21", "value": "24576:Uwid3+K9oLAVW9V62rp+bWYB31QQ2NO/NMnLoKvDy5Zx:DC3+7bmB31QQ2Q/NMnMKrQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741436, "uuid": "d1f9c2f3-13fc-43af-8580-8c40fedc65ab", "value": 1569280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741436, "uuid": "aa276451-adef-4aac-821d-b67fefd4668e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741436, "uuid": "b4275e93-0d27-4f14-b2ae-14172d897088", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f85ab0-b232-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620721512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721512, "uuid": "3151ce53-9868-4cb6-95d6-367fcdacbb10", "comment": "Malware payload (Dridex)", "value": "2d6ea3d31bd478a24155e7071029c95c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721512, "uuid": "1dfcf0d1-6234-445a-8a51-c2f6b3d57b0b", "comment": "Malware payload (Dridex)", "value": "625f1430f41a7a5ff04e27513743307a3c896482169058a1960677954f34a5d9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721512, "uuid": "03a0fa47-6b45-47bd-be08-9f1a879eb2e4", "comment": "Malware payload (Dridex)", "value": "14fd02b9224c1b3f148075599ad741bf962a0628", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721512, "uuid": "96dada22-5e46-43ea-8e6c-52544a8ad982", "comment": "Malware payload (Dridex)", "value": "bc1167565e4ff32aad320c3fcc1e96b54370189d9508161950a2d9a05d415b12f7b2711b9e0ed0ec8a60347e6630b4c5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721512, "uuid": "ad1aa77a-960e-4604-968b-f093eb0d27c7", "value": "8CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721512, "uuid": "e3bac591-e655-42ab-a9d4-ea0c7821678a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721512, "uuid": "78d9b7bf-2a34-469a-a562-7a9b3aeb65d0", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620721512, "uuid": "b8d7bcfe-9a68-45aa-8ff4-98cbb08e9dda", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620721512, "uuid": "76e80f02-f9c9-42d2-9b61-2bdc8751fdfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721512, "uuid": "99936af2-de4d-4e94-a1c8-8380f8cc6d90", "value": "625f1430f41a7a5ff04e27513743307a3c896482169058a1960677954f34a5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce03f463-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716529, "uuid": "804d2a1e-4d64-4e73-8403-c64204d3f68b", "comment": "Malware payload (Dridex)", "value": "1905d14bbbdf78db68cbe7635e7bc128", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716529, "uuid": "c626d374-cb22-4330-9f9e-5e90b1d06c9e", "comment": "Malware payload (Dridex)", "value": "62f52114126f53ca3d5c61f712d050903058f11e52727ca43e501828c08c2645", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716529, "uuid": "9dab02d1-3350-439a-a7db-9c0813f97098", "comment": "Malware payload (Dridex)", "value": "0414bea0d61721ef4f2396806015f85a85cfb808", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716529, "uuid": "70aa0476-67c5-4c49-8b2a-073a8faacdba", "comment": "Malware payload (Dridex)", "value": "82b2d204d4837032314ed4d020bad3ee83c51e48f4524dc3056785aab3954001c75a729dceacb8f1330b99d6a8c99e70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716529, "uuid": "5be02469-6582-4326-8983-ff049b99ac4f", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716529, "uuid": "ae0ea29c-3437-42fa-856d-300d628a62ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716529, "uuid": "b1ef2741-3579-4804-8d64-62c9bbe84d14", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716529, "uuid": "10e513b4-e7fa-4a6b-be01-aea720e81dc7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716529, "uuid": "ca4afa63-2f2b-4639-b12c-b55503bf8235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716529, "uuid": "ad093a6a-39f7-4584-8181-7ab1f69aa9fb", "value": "1905d14b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fa33ec-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770520, "uuid": "b0921c39-3f47-4964-a96c-415e93803f40", "comment": "Malware payload", "value": "dd79a2a61d8273a9c4fd989dd2b27e5f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770520, "uuid": "5413dc3b-aba9-4db9-9fa5-79bfeed78adf", "comment": "Malware payload", "value": "63454ec6e58b8b89769859542999c2d8377cc49b1f350d29eb60f5648e7d4719", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770520, "uuid": "27b90913-308d-45d9-916d-7a04a32f1ab5", "comment": "Malware payload", "value": "2efa6c042ce98e554710644c4a084b72b09a3c7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770520, "uuid": "4527f20c-e8cd-47fe-915a-66627f3aa465", "comment": "Malware payload", "value": "755d0a97ab2bb83662f6faef75d50994c510bdc4a6504fb217697aea906a4c84c3a316166a24b51dc8b1096ddb22f036", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770520, "uuid": "ef88dd8e-250b-4aa1-806e-677a4eff9e15", "value": "9CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770520, "uuid": "419f36e5-e86c-4f93-9df2-7ce7331e54d6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770520, "uuid": "536d7192-f69f-4163-be77-6f97251d8568", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770520, "uuid": "6b45b293-7920-49c3-b84c-1180855269d7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770520, "uuid": "6dec6cd5-feea-4160-9d03-1a0604902f80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770520, "uuid": "b3164890-fced-4e5e-b127-3cab1e23403f", "value": "dd79a2a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f1aa97-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691308, "uuid": "80a50475-0cc6-454b-aca1-530a39a29047", "comment": "Malware payload (Dridex)", "value": "f602986fdb8025a8092b8968d684f1bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691308, "uuid": "a4644297-4285-41af-b267-40387fa91488", "comment": "Malware payload (Dridex)", "value": "63693ddae5b68c32374a6de6b8a1107f2aa045c3ea339ca32d0121cc65ccd4e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691308, "uuid": "a6b5d480-1363-4109-a646-edcc2c457904", "comment": "Malware payload (Dridex)", "value": "6f032ad6326b20af192bdf40ba936f54f4d98d68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691308, "uuid": "dcf89c77-7198-42fa-802b-3d8e926721d4", "comment": "Malware payload (Dridex)", "value": "06ab15133ec4fb7dd550816d784b7c90e7d17efad094e2213b2fde02bf075f32d2893f893b8003cc116226d118ae20ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691308, "uuid": "525ad329-44a5-4d1b-bcb0-bae209b9346e", "value": "85F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691308, "uuid": "a98f5382-1571-4694-b07b-d14fc3bb5a80", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691308, "uuid": "e47649c9-e841-4082-bd7f-76b6b0972433", "value": "3072:Hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691308, "uuid": "1e10bbf3-e3f1-4070-b116-d09f5a3ca05e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691308, "uuid": "74699348-e156-4c3a-9207-1034220ae1c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691308, "uuid": "8e892748-eb0a-4450-a016-0e6ee8275f2f", "value": "f602986f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38ed2f9-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712217, "uuid": "2e7f7afe-a454-4d95-91f5-462e625d97f0", "comment": "Malware payload (AgentTesla)", "value": "48a7f68c9f7330dd90954755853fb5ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712217, "uuid": "1457fb12-9b73-465f-ba9d-97d06d0b1e67", "comment": "Malware payload (AgentTesla)", "value": "637c08924afdfb02e35a02c81b72ccde2f0e3436f1f7e1747eb86b6b6ee5bd68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712217, "uuid": "835ae5d2-9910-450d-a381-3d35889f64aa", "comment": "Malware payload (AgentTesla)", "value": "80e4e69d0bfc5ceaa47939f2b4bd356d1be5a243", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712217, "uuid": "66d81349-93ea-4598-b91f-114f411c2e58", "comment": "Malware payload (AgentTesla)", "value": "453a526ab6bbba68cf5defe368ac0fa7ff80f7d0ce673c0fd873420f75b4f990f5dbeb56bd2c44b32d557f04d5415938", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712217, "uuid": "5c1b55fb-2df8-4322-bdc2-aec983aceae9", "value": "89F47CFC751464F9D34B5C23A3CF1C1682251270A93B6A0F9B2113BE5A5BE273E39D89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712217, "uuid": "3ff1e429-3752-4a18-afd0-2a0a8c39c3f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712217, "uuid": "7bccce12-bd4e-4b22-963c-3703726d566e", "value": "12288:8oLLoS60/K7yh0KzT/kAFbGHReAelyCcm4qLB4hMi9DpKvUowfVJcMp4pjMQ:8oLAC8AZGReACyCcBqGnpcUoEbV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712217, "uuid": "0b8daaaa-368f-4574-9209-f9b8316bb042", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712217, "uuid": "c39fb8ae-078c-4fc4-8048-7c78e30bf392", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712217, "uuid": "37b4d00b-8ce2-49a9-a2d1-341499002497", "value": "SecuriteInfo.com.Artemis48A7F68C9F73.16321.12057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efac75a-b275-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620750354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620750354, "uuid": "ae129f8f-65b3-4e7b-8395-1892df3a2ce2", "comment": "Malware payload (BitRAT)", "value": "b7766094799b5416840b3df3da77dd29", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620750354, "uuid": "1b0b9c6c-ec08-4929-a623-1f629069d027", "comment": "Malware payload (BitRAT)", "value": "6387b0ded51410f864b093626cfa7e711c8885d6870996f8138de12ced45730c", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620750354, "uuid": "4422724a-d033-4c01-aaa1-8ba0df2eca2e", "comment": "Malware payload (BitRAT)", "value": "1f21d1ea635f4f5ef06426dc23093b16478df990", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620750354, "uuid": "c2235aa6-53cd-4070-a980-064153142a70", "comment": "Malware payload (BitRAT)", "value": "194bd03f0328b015085e49c5e900e32044e979464ad9ebf46b32b24e753bd22015398037e2c11f89cc3d1e9911cd4486", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620750354, "uuid": "e686ed44-fb68-451d-8399-f1ebf014f149", "value": "1AF5233073682FB1F5BEE37D65A11208A3F6A512E730E2497DDA55EE8826E804727F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620750354, "uuid": "1ae45470-6bd8-4583-b52e-259683639b00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620750354, "uuid": "fe5bea5e-0a33-4ec9-ac4f-1a764559bfba", "value": "49152:f65R8xdzBYHVreQ1gLH/oX8rw8X1onE32M82xOpMKFPhJbhxrUM2qKB:f65w9BY1reQK8odl1s2EhbhxrJ2JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620750354, "uuid": "12bc8777-9260-44ef-9198-263af670c228", "value": 3422208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620750354, "uuid": "7561be2a-dad7-4fcb-915c-95fb3bec1013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620750354, "uuid": "56d6d04d-86a4-4288-a07d-33902765727c", "value": "DHLShipment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed61b8fd-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691242, "uuid": "bb9ad4c4-fc3f-419d-bde7-11fc0cfc6865", "comment": "Malware payload (Dridex)", "value": "de62b940d884cb1e3e3372bdda004dbe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691242, "uuid": "11e6c452-8eea-4990-b687-ade1f15ea120", "comment": "Malware payload (Dridex)", "value": "63b5010becf81d4029ee73b86d60f819c5b28043bb94f6b561a098331e5b914a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691242, "uuid": "88a00cd0-82f7-4f1a-ab72-494c1e140d90", "comment": "Malware payload (Dridex)", "value": "e4291670dc1943f54708163a0740d2254bb09d55", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691242, "uuid": "23f935d9-36d9-4469-b0d4-03a087a865ac", "comment": "Malware payload (Dridex)", "value": "a341d8c75439836ad3ec0ef38b0085e6ee2e3b549e87ce37bafaa4511d477bb0dce6ad00c8ecff4c19c3540da5038c28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691242, "uuid": "a2fdd224-c959-418b-940e-5defea33c21a", "value": "63F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691242, "uuid": "b60d0566-c954-4f7e-9512-94f01759984d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691242, "uuid": "cda3c210-aceb-4c05-bf31-b88f0b0a9d07", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691242, "uuid": "84f1cb00-209e-4ac9-a2f0-2e85475e5051", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691242, "uuid": "52bca7eb-b25d-44c7-8fa3-90d361238e62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691242, "uuid": "44b45484-bbe3-4ad5-a50c-b14558f5ae51", "value": "de62b940_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b746a28-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720176, "uuid": "9def65dc-828c-42db-9cae-eb8f6bff70b8", "comment": "Malware payload (Dridex)", "value": "94a37c34c91432eaff97ce4a4a66b506", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720176, "uuid": "8d7e8a04-2ba1-4eb9-b9f6-13c2035f4081", "comment": "Malware payload (Dridex)", "value": "645609188761a1c5e79bf9f1daf84a672aea67872afa20d70674883b9da3a021", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720176, "uuid": "b8d9e9ce-6cee-4a93-963b-aac0f4d37b9c", "comment": "Malware payload (Dridex)", "value": "8674959c676a5d63f6ab0ba4beee62899f8e4967", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720176, "uuid": "bc30d9e3-7bf7-4628-83a5-cd4b8799c8f1", "comment": "Malware payload (Dridex)", "value": "4fd5193f1455166ac224c197553d1af538171615ebe797a75745f190670ce512059cf24a5b17b1f7390beb260dd7d450", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720176, "uuid": "423519f7-88b8-46c0-a17a-e3cbde60da6a", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720176, "uuid": "8418a5e6-6664-4ce6-a0bf-0508f9e1265d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720176, "uuid": "0b1bd533-da78-43b8-8506-8c583d166a87", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720176, "uuid": "20391648-c8f4-479d-bf85-28263fd688e2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720176, "uuid": "b1be2c58-dedf-4bd5-b909-a13a6620f2ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720176, "uuid": "18c6298c-51b5-4c43-b839-d1c74f060ef8", "value": "94a37c34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf6434a-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620729386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729386, "uuid": "31b158ec-d995-4112-98d6-837cd67be699", "comment": "Malware payload (NanoCore)", "value": "ab02d19370377ebefa832e38e4f9531a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729386, "uuid": "d6b739ed-346e-4acd-a6db-db60a2736054", "comment": "Malware payload (NanoCore)", "value": "645a6049e233daf9c05944e1644eb7ba86ec8368ebab70862e926eef9117dcbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729386, "uuid": "13bb0b56-ce84-4aec-af5a-c8881e7d47cf", "comment": "Malware payload (NanoCore)", "value": "79855a0e2d4378d91f987f0046a2d2f470ca3193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729386, "uuid": "8983a8a7-d527-4b49-b491-300d68873ee7", "comment": "Malware payload (NanoCore)", "value": "294ce45a5ad1dc0353c28e3d4607a62f3a9f4e6cd5de74a87d52cd175bc4178c8318f422f01b3b6b4936f21bf1f9c954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729386, "uuid": "b7ee1cac-a92d-4d80-b06a-07fb39c6524a", "value": "F4351241B3C288B2D9330D3159297B12ADBD3D205F689B1FA7D509ADEE356816630FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729386, "uuid": "51372a77-77d1-4576-b3a7-4f199ccd7dc7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729386, "uuid": "957cf1af-4148-4eea-88c3-f44483674d31", "value": "24576:BAOcZpJ3SCUY30ga/GLRJAXu1p4JJj1eLQy3gM2soAY5aRcKX+C:bcSG++1J8uP4Aky3D2xA2aaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729386, "uuid": "84a6105c-430c-4f49-ac3c-7ba0dd4ea1f5", "value": 1139346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729386, "uuid": "2d2c68e4-2e9d-4b8d-9835-0c9eb01f0589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729386, "uuid": "f53ad8cf-fa8e-47d7-993a-5aeefd782c09", "value": "remittance slip.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d7315b-b25e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620740573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740573, "uuid": "b4ab46a5-8d1b-4ee7-8a72-74e50ec3f4f0", "comment": "Malware payload (AgentTesla)", "value": "aba2327e781ebe026a77959da2a991c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740573, "uuid": "9e05c642-4437-440b-9558-09ec73d33be4", "comment": "Malware payload (AgentTesla)", "value": "648f45761fbb9401657dba11d86eb09a161f5213609a34293bdca823d51bdc39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740573, "uuid": "71dc841d-adc8-4f0c-b881-08c0eab25b50", "comment": "Malware payload (AgentTesla)", "value": "46159444a91400ad0a5aeef7b8adc61b1a96b70e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740573, "uuid": "e6b114b6-2c97-4d1f-b9b7-3b6c5b38c3ab", "comment": "Malware payload (AgentTesla)", "value": "442c4b87fc4e667a6696ea124118f3f150b60c4b5aa61d3ce92bbd5c5b80c78d412cf82e745e88466a14ad39c97d760b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740573, "uuid": "ea700cf8-da98-4b82-9343-2b6b9d03652a", "value": "8215F13133A85FF2E2BE9B3C9850518863F9B50AE310E64D7DD908EE4975F814762F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740573, "uuid": "e6056a51-9835-4316-b2e0-c689372b9707", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740573, "uuid": "3e7bb900-3c4a-48c8-b03d-8a192ae1ee03", "value": "12288:kMTi3Q3gPiVEHe9cNgHiYr+MeEmjZEOFpiFt7ePJXw3FrUqPrEV3UJ2sXijoVdhh:klpMtSXw1w89wsXDvhCByr8eL6TFix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740573, "uuid": "0e1dd996-7191-48ff-9a0a-2ac14bd37db5", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740573, "uuid": "d46203e1-daf0-4915-af19-28bb46e28684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740573, "uuid": "ffc3cc0e-306a-4a50-a2e0-61a4aae86a5b", "value": "Request Sample products.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc5f7b8-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728693, "uuid": "49a71524-2f98-4333-b4d0-6d292936e244", "comment": "Malware payload (AgentTesla)", "value": "0e14ce244694767b1ddd34323cbf85ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728693, "uuid": "128a802c-c91d-4579-82d8-6eecda67a14d", "comment": "Malware payload (AgentTesla)", "value": "65768da8576274ef64cd3586ce475a890db13da14b05da3e6792498737c54faf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728693, "uuid": "078451cb-ed9d-471b-9de4-5b1f25182f04", "comment": "Malware payload (AgentTesla)", "value": "c72b71f958a430de60964abaf80e68c600e6f35e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728693, "uuid": "84b8ed6d-0906-44db-8080-98531ae7cfb7", "comment": "Malware payload (AgentTesla)", "value": "2306e4e51a04c8be7c35f4b9ebd23fe77b204cd77ef50912000d1c1289f027e471f9c64abda60ca2682d077cbf6d1894", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728693, "uuid": "dd8ffdd3-ffce-43ea-9b04-26dec12d265b", "value": "AB8118F0A8380590EFEB8276543AFD7752CB3097C6C54848308DDA86036F3AC9B16D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728693, "uuid": "7194c811-823b-4762-90d9-9335d6ff650d", "value": "96:cNOAD+zxdi3NceUp5IEuvqiMKyU9OvWRL3dREquoJ:IX3SeUbpuvqiFIMQq1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728693, "uuid": "3a243697-b3fe-4fb8-b3b2-f5680467e6b1", "value": 3928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728693, "uuid": "4720f79d-a326-4608-9e69-f5d2eaae46a0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728693, "uuid": "81d1786d-ba62-4439-b371-b1dc24b798d4", "value": "Supply Inquiry Ref S -400049-08.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee09efe-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720128, "uuid": "15a42c99-1615-4168-ba51-148a7f88c277", "comment": "Malware payload (Dridex)", "value": "758619ea3a7bf0d7e4273511b289394a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720128, "uuid": "e992a53d-297b-47e4-8d78-1b6ebeba9cf8", "comment": "Malware payload (Dridex)", "value": "663ea16ee78e03906e97e64f53eb4fd9b153c79dea19e9b36889e15ab17fb1a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720128, "uuid": "54f4d2c8-1135-44d0-8b9f-54a37b548a02", "comment": "Malware payload (Dridex)", "value": "bf63ba6b05e9cbba1eb7d7b3ddc38c1f616f7ca6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720128, "uuid": "fecc738e-1504-455c-82e6-c2d3bd2365c6", "comment": "Malware payload (Dridex)", "value": "ae4b746f756a4e621e5d43d482a379d5ea195e4dd66c7f5707907848fb958eab685f9a4d2318ef484eed5d6c15b3ad38", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720128, "uuid": "5f535a42-812d-436d-895a-317080b81eb8", "value": "C6F3E00AED9FE988E84C55F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720128, "uuid": "25cf4802-e47f-4257-9af3-3622d2d80fc7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720128, "uuid": "f7e0576f-e78a-49c2-86aa-f198fc38863f", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720128, "uuid": "8a666a0f-80bb-4365-b3e5-1f9e0a55aa6c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720128, "uuid": "b8f4fe29-cfcb-4c11-989f-373459be83db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720128, "uuid": "4051b60a-6b92-41eb-85a3-b0cc870c48b3", "value": "758619ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b7a021-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709275, "uuid": "4abf084c-9d06-43f2-b9b3-992c12675eee", "comment": "Malware payload (Dridex)", "value": "ae7a05fdf837a0f91ddb9052402549c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709275, "uuid": "3153421d-c7b1-45dc-ad51-3a0b5193085c", "comment": "Malware payload (Dridex)", "value": "6687cb6fb5e5e72a0f265aa87c35a56fcd0aa5140eae633cae2d7e4f92f88dd2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709275, "uuid": "3889bd16-9068-46b8-8962-2247b5ec958b", "comment": "Malware payload (Dridex)", "value": "aa016a2de18a0a4a999a70f9bd03f23288719e32", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709275, "uuid": "44b8fd77-08c9-4a46-8006-8c2910e5ff7b", "comment": "Malware payload (Dridex)", "value": "4c687e91252fff72878281f2ac869d1a9d89335685c87ed8de4fbc28d9fbe38c4793949aab1fd59b6b3107e799784bcc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709275, "uuid": "4005604b-2b18-4e97-8137-b96ab5ca242d", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709275, "uuid": "0eba6cbe-9b26-463d-9841-1c375240406e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709275, "uuid": "d5c35bfd-1b54-4943-8b79-11c670a5e148", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709275, "uuid": "f72f1de6-bb0e-4068-b018-1f5a8ff9803f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709275, "uuid": "963854e3-1010-49ed-9f25-0753afeaf0f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709275, "uuid": "52c82be7-7b1c-4764-9024-755745939abc", "value": "ae7a05fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0355b53f-b294-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620763434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763434, "uuid": "3c7f7720-581f-4f4e-ab73-c954e82c0871", "comment": "Malware payload (Dridex)", "value": "f671a0f7875d9873d1363c728d8e193c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763434, "uuid": "822625c1-d8ed-486d-8d78-8de3792e007f", "comment": "Malware payload (Dridex)", "value": "66a9d38c397674081b6e4d71daad45477e561a835bfa836fcc0ccef5aee8adbb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763434, "uuid": "4bb9098b-2de3-4e26-b857-dad10d0c711e", "comment": "Malware payload (Dridex)", "value": "42c2ad0e0fb78c98c93ba683f84c829b3a2bb37d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763434, "uuid": "f1763aa1-de3e-447f-a5d9-7c99767e7f8d", "comment": "Malware payload (Dridex)", "value": "2e29df01d1d16ca3d437adba885a0279c85b3242338fd94441825358619a476cb96b0bd706ae3dd8fd8885cad7afb410", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763434, "uuid": "1d13312c-82c2-46bb-bc7e-5f9ec56b11ce", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763434, "uuid": "796c9dc6-ca84-4325-b76b-d6a45effe674", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763434, "uuid": "395e5f42-8d12-4a14-ac80-9d005a8eb4e1", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620763434, "uuid": "6931b79c-23f6-4c9e-a253-90226c5e62ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620763434, "uuid": "38f41248-e8a6-4e9d-bf6f-3bea99a8798b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763434, "uuid": "8483b9df-34db-4e8a-8d7b-97edbf11d178", "value": "f671a0f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c57920-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620729043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729043, "uuid": "cfd93f45-437b-43a0-8e9f-6c583700b0a2", "comment": "Malware payload (Formbook)", "value": "21e8676fede4e9e629ac0b0e36a3772a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729043, "uuid": "4a85cdaa-035c-414e-8daa-002fa6b0adb6", "comment": "Malware payload (Formbook)", "value": "6716f9ca37043f0684164a12c5971f67c738cefb8b8322556d970f60333d72b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729043, "uuid": "6682f9c9-7ba9-4da4-be49-cffb8ad81b03", "comment": "Malware payload (Formbook)", "value": "2643fb666f938fbdc0ce81994629a2ad152451af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729043, "uuid": "aae3c2d9-05da-41ad-908f-e2efd844bb06", "comment": "Malware payload (Formbook)", "value": "54c312cd846a65a7d63672181953a993b1af88d3df44b9bcf602e06652cc92c30973b64c1279e0eb818480912639a453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729043, "uuid": "2fa07eb3-e3bf-4310-846a-49af7b148625", "value": "75150221335C6FE2E9BEEB3E5811115813F9A806E322E54EBED919ED0951F8143B3F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729043, "uuid": "4375d4d8-0e64-40ec-8128-2c96c9cd1ad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729043, "uuid": "a807a96d-3618-43e3-94c5-2b9fde050beb", "value": "24576:KZsg91tXmLoVmSgLmr8xQPzZ74wvubThs0i1:KzrqSgLm4xQrZ71Ws0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729043, "uuid": "79cf2210-8023-42b1-aff8-64d1dd379c24", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729043, "uuid": "54ea974b-a2be-4786-8003-9973ffa49c92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729043, "uuid": "53bc35be-a5b0-4dfd-a4e6-964dc1b74bc9", "value": "PAYMENT INSTRUCTIONS COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e06a98f-b249-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620731347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731347, "uuid": "26a10e85-1e7b-4706-a153-5fd9896903e6", "comment": "Malware payload", "value": "994a654345e518f67f9dcd3f3b9618b3", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731347, "uuid": "61b86ca5-afbe-40e1-a5ac-d26084fe107f", "comment": "Malware payload", "value": "675af8110138d2e1d4ca277638ca650389e98a2aee84f3311831e182b439a192", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731347, "uuid": "f6a9a5ef-c3c2-4842-9f86-f30607a7e36b", "comment": "Malware payload", "value": "ff1d0007356307554612e232a28a318f0efc44d8", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731347, "uuid": "690f44da-84ef-49f3-a1ae-f06a860e5dea", "comment": "Malware payload", "value": "c12cc80ccd8774ba0944ed2be2857c7ef10c62e49c60af42a277440d53f0727bec2e18e7f4f92155da7cba65e63b73fe", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731347, "uuid": "58bcbc85-49d6-482c-a0c4-c37bafe2a97f", "value": "19A3C4C66F62DD7ADB54D2358CE981952361EC404A6E47833544F33A3EFAE70BE026C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731347, "uuid": "5bc4b055-8f09-4d4d-983a-e4a1b7036fd0", "value": "3072:1hlYkEIuPm3fNRZmbaoFhZhR0cixIHm0YjVCfhG99i:flYkEIuPm3fNRZmbaoFhZhR0cixIHm0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731347, "uuid": "a6efa671-e73d-415b-bc76-6844e75a5530", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731347, "uuid": "e2216f1b-97dd-44e8-ac0a-49de5f4ec7a7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731347, "uuid": "d7b5069e-9320-4fc2-9d11-09cb6e693263", "value": "Fattura_01196831.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2ae71c-b23b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620725492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725492, "uuid": "66bf32ff-c41d-4483-8022-afe952b74e23", "comment": "Malware payload (AgentTesla)", "value": "a708b477ccef2cba28ecf13292cf2aec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725492, "uuid": "0ebc6e43-4ef7-40ad-95e0-71ccf32dd6e3", "comment": "Malware payload (AgentTesla)", "value": "6840025134fbaf51166ebedfd84bb32b0dcbebc40f1ecee660c2323239d60b5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725492, "uuid": "0b658df5-2b63-47c4-90d6-46dd120f9514", "comment": "Malware payload (AgentTesla)", "value": "299b0c6bbaf575b732359f65fd7165d0c494ce43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725492, "uuid": "4385e49e-10c8-41a1-b241-06ab86655e11", "comment": "Malware payload (AgentTesla)", "value": "8ef940091f30d1648a59e911289db3e4cf0e498110a09ab3e1004384e79342d7aac874221d7a8ac47caef2dfb2c33bbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725492, "uuid": "1616b2f2-6bf3-4576-b318-9ca7c08b6a2d", "value": "7605221232F4A771E1FD63B66C122E4107F9F1595621E7892EC8A4BE46EB3C883057D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725492, "uuid": "40e7f5b7-8c4a-42b3-8424-2d6e060dc363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725492, "uuid": "16c353ff-01f2-4840-972a-198d190417b2", "value": "12288:IEZyieQCcY89LgHOVN7vz1JcfUIujrvjq55Xm+MbKqCt75Fzcb7fkijxqOJ9J:acXVxTeF4r+HXmpbkRDzcfkiNJ9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620725492, "uuid": "592af37c-8813-47c0-95e5-eace6cc8c47b", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620725492, "uuid": "4daa6270-22a8-4abe-a02f-8a2df67f8ab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725492, "uuid": "0384d16d-2587-4323-9d55-157b233dfcfd", "value": "PROJECT SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b922e4ee-b20a-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620704469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620704469, "uuid": "6f2949c4-28c3-4656-8837-3403e8345a96", "comment": "Malware payload (njrat)", "value": "d9a4b2c3e2f2bca1ca278bd9a0d642f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620704469, "uuid": "6e039b0a-95e9-4f26-a229-5aa2c26515b6", "comment": "Malware payload (njrat)", "value": "684a5f52add55dfb891523ac71e822022de97af06ba520c1d4f4d5f8831d5419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620704469, "uuid": "e6ee4425-40c5-41f5-a7f3-2822e0f74d16", "comment": "Malware payload (njrat)", "value": "a4689b182f7cd2ca775bc9760561dc67d6124806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620704469, "uuid": "bb843f10-69fa-4929-81e4-72491f2852a5", "comment": "Malware payload (njrat)", "value": "a65fab0df125db182d4bb7d56286cab989114bbb64c798881885229233f756752634966a9b8e585b2b8ff4377c6e6c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620704469, "uuid": "3b9f3af0-df88-452e-aca8-42a9c0c89587", "value": "8BD3935426DAE15AF6B76FBA43F875D74ABBFB733A02D45D2C40220609A2F815F40837", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620704469, "uuid": "30368f1a-ab06-45d8-a295-ef7dc45f2e47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620704469, "uuid": "8872297f-8822-4029-a13e-e9f00d59d01e", "value": "3072:z32GhNvFB+c427dvlsmwVHF1YeAIt6Dvvfc/uXUqEJC:D2GhNnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620704469, "uuid": "ac6a7542-5310-4361-9165-1213a16d252d", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620704469, "uuid": "fe7b965e-9cac-4628-ba31-9c09c301da9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620704469, "uuid": "f58fe648-21a1-46eb-ab40-8725966f9b13", "value": "684A5F52ADD55DFB891523AC71E822022DE97AF06BA52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb14921-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620752395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752395, "uuid": "28e75b64-7046-44e3-a64d-b586c526d15c", "comment": "Malware payload (AgentTesla)", "value": "b71f1893dc6d9b4e4c6c49ec152c0c94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752395, "uuid": "bbdf2a14-e0c3-49f8-b4f1-9f9ba8b864ac", "comment": "Malware payload (AgentTesla)", "value": "68578ec812d1d18d8fe9a8bac3ef92d73255a4291402ff960c59df9deff5fe19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752395, "uuid": "1fd3a623-f0ab-4023-8e3a-c100330acc4f", "comment": "Malware payload (AgentTesla)", "value": "7d9d371109021bf1e33f76c8dabd2e76d5272271", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752395, "uuid": "621b4fe7-839f-4d53-a663-b77f1b5bde35", "comment": "Malware payload (AgentTesla)", "value": "42bdf8a20669315972b96bab35a886e227b6d328b1380e7c57dfa8861d00290b83c235b4e23b718db217a257ef291734", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752395, "uuid": "d7390ae4-dcff-4529-8ea9-e58f458d18e2", "value": "1705231E3718E34FC1CAC578A0E94685A6F5D857F0BAF7668B839668E4B3300BD157B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752395, "uuid": "75a53f4c-aaf8-4c89-b9d9-d4efb842a966", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752395, "uuid": "2d486e70-fc4e-4e88-9438-99523dac43e6", "value": "12288:z3WxecGXjjN0a86Sol6M1hFrQStV2ClOTVGFTvBK68e1Fny+TkRxLk4bSWLa2QhS:r4F3T6SlMHZPVhYjefr+La2QT9kqMN4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752395, "uuid": "8bb1da5e-3468-49d5-b422-dd1f1bef1b11", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752395, "uuid": "ab559357-7d77-4470-b03b-2a960c3fdb91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752395, "uuid": "8a8b58c6-2f71-4848-afce-01b1fd83d9cb", "value": "PO.#4500499953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958b99ee-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705697, "uuid": "e7bfb862-7c88-4c50-8799-c0d7c72635da", "comment": "Malware payload (Dridex)", "value": "b25bdbae78d0f4151d9d09356f1ec680", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705697, "uuid": "99b47ca6-5c5e-4b71-9131-ee3dec702f4c", "comment": "Malware payload (Dridex)", "value": "69044449eae5553c3ea6b0a56c0372681fd2baa95d4ef605a3e8a604403c97ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705697, "uuid": "ffdcb152-9d6a-4e82-89ee-0287dc554f6a", "comment": "Malware payload (Dridex)", "value": "0186358848132c42fc3bdf39cd89542493c5bace", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705697, "uuid": "86c35953-5dc1-4eaa-b48d-1fbd191d6def", "comment": "Malware payload (Dridex)", "value": "a140749fd8661c08a848e7cd88042fd90980d390015f9cf1150a115cdba71c68bec001fb3a39c400183d7be0d7864ef8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705697, "uuid": "07f08a0c-ad6c-4217-b882-9551262c609d", "value": "A5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705697, "uuid": "9b1b296f-2986-4c81-97bf-13265b6e6bc2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705697, "uuid": "18e3774d-2ecc-4f38-87e7-8da6b6932e41", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705697, "uuid": "f1777e86-b4c1-4757-962a-c408e0db091a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705697, "uuid": "1c627075-5636-4230-9e55-435dd827b565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705697, "uuid": "40d4e287-64cf-40e2-8d13-46be66fce732", "value": "b25bdbae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2f40bf-b210-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620707155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707155, "uuid": "53ee6190-0615-4266-af2f-648412e9d282", "comment": "Malware payload (DarkSide)", "value": "9009593ebf5ea20407ab19bff045dc9d", "object_relation": "md5", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707155, "uuid": "31ad6a96-35ba-4bc1-ba45-1d0a67edd2f1", "comment": "Malware payload (DarkSide)", "value": "6931b124d38d52bd7cdef48121fda457d407b63b59bb4e6ead4ce548f4bbb971", "object_relation": "sha256", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707155, "uuid": "6dbc224a-a90f-4c39-8985-9dab294b5f80", "comment": "Malware payload (DarkSide)", "value": "03c1f7458f3983c03a0f8124a01891242c3cc5df", "object_relation": "sha1", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707155, "uuid": "2a627cab-59e6-45f4-8b7d-e7a0d90be4c5", "comment": "Malware payload (DarkSide)", "value": "68014d12c4349d876e81ec841e924fa968104f1fbee7f23da3d7c47d1d9ab4fa97d72d80b71817cc43d4a327098a0de3", "object_relation": "sha3-384", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707155, "uuid": "e2868dbd-e063-47f2-bfd7-a1169439644a", "value": "F872C049536D3522D20B3D36CDA29C25B086D661CB9A6DCF384EDA9DBC71D84CF7A700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707155, "uuid": "b15d3162-c246-45da-affd-4ce931488569", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707155, "uuid": "d2fc1dc4-2475-43b9-a8fc-dfe5849918ae", "value": "384:SGyUrEk/yEoQE+yckIYN/pBa3AWK3T2oTboHblKR/o:l4klFypIYFpB/x9ngbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707155, "uuid": "5e28e5be-1ae6-4c2b-bf5a-adfcc87d6fc1", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707155, "uuid": "bfd558be-8284-49ee-b5d3-71576c85bfc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707155, "uuid": "0a3f61d7-bec1-42b4-a2fb-6633bab6061f", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af74529-b218-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620710324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710324, "uuid": "404e564a-ccfe-481d-a9c8-7f94b1ff355a", "comment": "Malware payload (AgentTesla)", "value": "49ad6fb2dca5d329f6c458ebb172f35f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710324, "uuid": "9c6d3f23-4cdb-4e57-90a2-7517f079561c", "comment": "Malware payload (AgentTesla)", "value": "69ac0d42dce05bcd01273fc11a1a73fa7d6ab446ef129677940a328aa8f1e4d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710324, "uuid": "59c39c33-18f3-482b-9739-4e7c281eca6a", "comment": "Malware payload (AgentTesla)", "value": "814e7ee66ade2d0b7eeca2f4c655709939b31ac9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710324, "uuid": "0925e525-eda9-4430-831f-ca78ceba3f0b", "comment": "Malware payload (AgentTesla)", "value": "912bdbdc1849990ba8d1e18972a7533b3e1096f0396c4a7fb8a75cc90812c31994982d0163b79f03ebac657deda9bd7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710324, "uuid": "23d9f5ac-83f5-49c4-b757-a0e4019d1b77", "value": "80040266F3EDCCDAD08610B14D86C1C77661FE6AAE01942B7389F34E6EB90B0485275F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710324, "uuid": "10fb9174-770d-478f-b395-0911454df185", "value": "3072:9kqZrBX6HxU1GoLa7r5rligZBYnJbTS7xNn9JxtLOfa27jwg4o:O2rgaGo+/i63ntLwaCjwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620710324, "uuid": "cef477a0-0071-40df-a04f-60af82d6187f", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620710324, "uuid": "24e7302f-23be-4955-999e-d42874dae50b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710324, "uuid": "6186946e-30b7-44f5-bf2d-7366c55ed5d3", "value": "IMG_057_163_22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a71cac-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702094, "uuid": "b55feb8c-f4f8-4a7b-8f56-2be7cb52f603", "comment": "Malware payload (Dridex)", "value": "24349158bc11a536968f2cee5dd86737", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702094, "uuid": "a772266f-9a28-406c-aae9-815e6c0eefc0", "comment": "Malware payload (Dridex)", "value": "69f830ce9895ca063f968b9457d619c817681b15e5f7e032acb58b891858f8a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702094, "uuid": "c6f495cd-049a-4daa-a2e5-213e5e95be92", "comment": "Malware payload (Dridex)", "value": "13c6bae1a6a6b1fad26ba2e3b1d9aaa71ee74b3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702094, "uuid": "3b753c50-e510-470b-b0ff-fa8450a92ed2", "comment": "Malware payload (Dridex)", "value": "8c43ade29fcd64944f40539143737c7be90a0705b088c0cb77902a5b10bc202b2d5808cd55d4bef29541699fe7b3cbdd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702094, "uuid": "aea15533-8aff-4c09-b112-c5cca9fac177", "value": "46F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702094, "uuid": "0ef10b54-4af6-4501-8db6-3e0956ccd0c0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702094, "uuid": "4c3feab0-b2b6-46e3-bdb7-c2e9a3fd23fd", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702094, "uuid": "a6a2a4c2-a66c-4246-87f1-417b682970c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702094, "uuid": "ba89bb8d-66b3-4ef5-b3b5-01545686021d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702094, "uuid": "39e6e658-cd1a-47e6-a3e7-03e3dd5aec6f", "value": "24349158_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f932d25-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620752959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752959, "uuid": "a37d9809-f90d-4074-97d6-c6ef3ceb85e2", "comment": "Malware payload (AgentTesla)", "value": "7b4bdba51e916785f6d6ae59cf39cc3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752959, "uuid": "60f83808-205f-4f52-a865-4470eafa4b30", "comment": "Malware payload (AgentTesla)", "value": "6a3db8133d568c1627a7af1b354b66465f8e78e4b49a2e59bfe176592ef3e393", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752959, "uuid": "e9abbfa6-c639-4587-bec5-8c0c2d4c5c9c", "comment": "Malware payload (AgentTesla)", "value": "b6472cc4075493acc3acd599fbd44cefdcf93471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752959, "uuid": "a59eaca3-6149-4284-aea9-bf8f408427be", "comment": "Malware payload (AgentTesla)", "value": "4c23f2550074b741de05af48d3eec1e70b556cf4a44750e24f2263b9e19a6d82cc3b645e9d1c9a7b5e3e65eedbb488bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752959, "uuid": "604e3759-ba46-4391-aafb-dfaf9ff52ce8", "value": "3025F17133289FD4E53E97BE4824404003F5AD5DE722E50E7DE93ABFA672B425662F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752959, "uuid": "10af448e-3416-4c7f-9767-e76f941515de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752959, "uuid": "9ad5685b-f3ad-4146-b833-8b9a39870ec6", "value": "24576:CyTlvaFv9WMiAFi95t9JXEbxnbGRXGCgbbiGkE4N56:C3lwMni9LXEbxnbG8PbbAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752959, "uuid": "3cc77cbb-5989-4349-80f1-6ce56d26b7ee", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752959, "uuid": "a8a9fb8f-d772-4d5e-aa23-66deaa05a8fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752959, "uuid": "fe62ad1b-fb86-428e-9a92-12587545f92d", "value": "7b4bdba51e916785f6d6ae59cf39cc3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22111bb-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620716590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716590, "uuid": "e6929c54-f1f3-4230-ab4c-bf2f1c1f3e85", "comment": "Malware payload (SnakeKeylogger)", "value": "97bf9d2ff4a2e7bff7f841eec69e28f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716590, "uuid": "84fbee4e-e8b8-4dbd-bef2-be4474a4d29f", "comment": "Malware payload (SnakeKeylogger)", "value": "6b30a081e6d52a65bb0cf0ff16c899d77eea2d1db1716351dbeba959748e47ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716590, "uuid": "7b0edef6-41dd-4b00-9d9f-4024c51f8467", "comment": "Malware payload (SnakeKeylogger)", "value": "c3b562191d7f159618e9152481041d3f006f580a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716590, "uuid": "bd388f1a-c135-4750-86be-2dc85da2ef3f", "comment": "Malware payload (SnakeKeylogger)", "value": "0661ce1e8a0c58ac9db01ab791119df0b77e8caa83f53a064628a6d3a3b9c7d14cec44b20e3d999afc6753a37730aca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716590, "uuid": "d652c853-99c0-46e2-b29c-c952ec9ee5d7", "value": "4A05230333E4570CD0BD677098B2245693F4B59A8661EF9CBF8484F911EBBE68A593C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716590, "uuid": "af37b6b2-f4d2-414c-b44f-666202947c28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716590, "uuid": "479c6be3-7472-4922-95e6-ac6e3c5d9581", "value": "12288:LEHyivQDviQizqzKffl8OX200HK0QC9BlUyk2IHW4HWze/6AXrJbCp1ttJ:Hvi1400HK0QC9B+wVmWze/PXVb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716590, "uuid": "84d628a4-dbb8-486b-a5f0-c2006b030541", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716590, "uuid": "98f52a1b-38d6-487b-be1d-1a62dcffbb48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716590, "uuid": "e9396808-e3ee-4828-9f41-f821565e82c3", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01420bbb-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620727353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727353, "uuid": "4ed7e1ab-5088-4308-92f4-d1f179780c4b", "comment": "Malware payload (Dridex)", "value": "248e9822279ae8f4245a6c3a74937bd7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727353, "uuid": "be89b784-d663-4841-bed0-62492e58a7b2", "comment": "Malware payload (Dridex)", "value": "6c0076fde0bfdfe547d105fd87ba8d7c3aeeac637699ac5dce532705084cccd0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727353, "uuid": "289ca8ed-87eb-44a0-8c89-6b2377e3c712", "comment": "Malware payload (Dridex)", "value": "43776ea135ff1fafbefb340fc70d6d4ed260636b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727353, "uuid": "18b78bf3-7036-492f-9566-ef84624fac57", "comment": "Malware payload (Dridex)", "value": "d595897703f782e2c0773914e56263278367cd2b07f3b110cffa6198e0a46848a5aed59f98b0c884a88949b028c1071f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727353, "uuid": "5df92654-41bf-4cec-8369-51aa6564ed09", "value": "B0F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727353, "uuid": "d372f27d-809d-4d68-9302-db7d891f8692", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727353, "uuid": "20add767-46e4-49cf-bd75-13ad8d6a8f99", "value": "3072:pA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:p3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727353, "uuid": "17ba806e-c3ed-4684-98c3-c4e862ad65f9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727353, "uuid": "8db311ad-15bb-4eba-8096-2f8114421613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727353, "uuid": "e67fb0f8-83f2-4ad4-9461-8c5d9e51f4ac", "value": "248e9822_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef760868-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620712720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712720, "uuid": "2b5e062e-763b-42c3-a7c5-b1ddb173a1ee", "comment": "Malware payload (SnakeKeylogger)", "value": "f88eb3bf3d12fdea0b538b6f49e9a449", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712720, "uuid": "3e4e614a-9663-4a5f-b548-dd4cd4651623", "comment": "Malware payload (SnakeKeylogger)", "value": "6c8ee04cb1de0d415f12d8ce178d6bd579bb563625b10c1697230d0f41d3930d", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712720, "uuid": "da904da9-1119-4a8e-a480-9e5880dcc6ae", "comment": "Malware payload (SnakeKeylogger)", "value": "9acf878b99976de10ce4d931f4d1cbf662bfe1a2", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712720, "uuid": "53a58cc4-3b71-44d0-9b0d-ff6edf86a00d", "comment": "Malware payload (SnakeKeylogger)", "value": "c4765e90990e727763070b7615c09387d6074d60898a62f0927b10ff4f1d84a1de1e6a6695c6d4d06b0dce82777b6b1d", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712720, "uuid": "7c25c201-6f64-400f-9527-8b08b4511eaa", "value": "21F423470E96F46AE3ED5C80B7093F0D83E8973EC4B2D1B64A776315C06548F5F82A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712720, "uuid": "03c5862f-bf62-45b9-804a-fdcddc735334", "value": "12288:kiOhULkSKXCnI1slA/fSMmj+4+6p2PlpAmoXzN1E1OkkXygwene8VzH4TU2H5o:kOkSKulMmj53pKcmoXBOBkXeee8VWU22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712720, "uuid": "6623f21a-ef92-4aab-823d-e80c89c26fb6", "value": 746603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712720, "uuid": "38b17a1e-8994-485a-af85-3c4f12451f6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712720, "uuid": "57a0ae34-0db5-4f4d-b10d-01c0b92f968e", "value": "Scan 22370.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5c5773-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705685, "uuid": "cdef7dcd-5296-47f9-ac10-e0771bf42190", "comment": "Malware payload (Dridex)", "value": "618b400790b74b075c592f54ecdff5fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705685, "uuid": "2b869830-6fb8-4f9f-a857-dfe2a7e182c7", "comment": "Malware payload (Dridex)", "value": "6cecac187cf006b5f4dd32999986991afa68ebf197c9b51cfd1be25fb38574bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705685, "uuid": "cc42bf5c-3bfc-4380-a5ff-418cdc02025f", "comment": "Malware payload (Dridex)", "value": "12ee557ffa8aedf268ffef103dd363b28c6838aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705685, "uuid": "c5c7ca66-01cc-4819-8442-e70640f315b8", "comment": "Malware payload (Dridex)", "value": "b363df4c9b52ad39d707cfaa80a24df02a887d552ff54c0c1912cb22df878ea3ba953a157b4a54b228c2921dddc3e2ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705685, "uuid": "71ce0712-be72-41a5-9895-4f904063d4d1", "value": "81F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705685, "uuid": "f7ea0c9b-a90f-4249-99f7-d4ba67a65516", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705685, "uuid": "bcaa0ace-a0a3-44df-95cd-7b2996cd5e91", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705685, "uuid": "e6705009-00dc-4cd0-9a03-b3f296ec83bc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705685, "uuid": "e18226fb-809f-4976-84b2-516c7ac88ca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705685, "uuid": "4babde64-0b8e-4897-a188-f6c78f7e84d6", "value": "618b4007_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958fbbdd-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715146, "uuid": "c19b2c48-298c-4c38-8bf6-40513d6d3791", "comment": "Malware payload (Formbook)", "value": "01d2e7db798623a18020df7c6141e830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715146, "uuid": "189414c7-93bb-4e5b-ac70-1171d6cab5fe", "comment": "Malware payload (Formbook)", "value": "6de7dc68d718b43f2a890a8f5b176e6e9b9e50e118993ebbce79d89f25039d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715146, "uuid": "79bcc302-2614-4c83-a21b-cb7f4c1d7771", "comment": "Malware payload (Formbook)", "value": "1d5d8acea4a3ee341dd347d94b3fb374d422faa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715146, "uuid": "a834f0a1-fc40-45f6-8090-c04114b0b993", "comment": "Malware payload (Formbook)", "value": "731534673937845ab279783eb48035bf73b1baca33228373ec0bb5fb07934d46a9ad7b6e8625a7bbc9a75b8b4fc61343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715146, "uuid": "0d0d2201-2878-491b-8ae5-31bc253edf1c", "value": "9A05220737E5E71CC9BE07F86452115217F4F118A165E38E7F8095ED1AA3BC6CA8A2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715146, "uuid": "78727090-6949-4039-915e-1c5d672ea024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715146, "uuid": "66231d8b-6177-4e34-a04f-bb6d6f4c0a87", "value": "12288:VExyi7QMvnFySB0aEiXpiSFRWuEUxE1MrJVf9gXJw5MW0SUB/5TV:4ymEiXpi6RWuE1WJVysMoUdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715146, "uuid": "83055487-95c1-4c7f-b8d7-632f007c11bd", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715146, "uuid": "d1708855-d4f1-42bc-b2b0-81d89df5c133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715146, "uuid": "3464af4b-3ff0-427b-bd2e-8d9194eaeb78", "value": "PO9448882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979190cc-b231-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620721163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721163, "uuid": "996f14f6-2af4-4440-9f21-6766be92dbd6", "comment": "Malware payload (Loki)", "value": "217779bed934af71afc6c861f99ff065", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721163, "uuid": "442caeb4-506f-4e26-be5f-e02786c3f9ef", "comment": "Malware payload (Loki)", "value": "6e169a50fc817fbf2e60e10f1e6816aaef5567dccbd36aab28badb1114909925", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721163, "uuid": "3da3a027-c091-4ba7-9d79-1c49144aa175", "comment": "Malware payload (Loki)", "value": "afba3658e7d5685c1e61428ada937c7b570639f7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721163, "uuid": "f57dd77c-d3c8-40a9-bd2d-ffd5bca7a2af", "comment": "Malware payload (Loki)", "value": "0d7f3d181f7fd36c1d5db90de6ddb78b8e1ae6e4e42e831be6666b0367cf1631fc1bf42f1b33519d4bb0835ef9998174", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721163, "uuid": "4e26641f-dd8b-40e5-88e6-3cbabb690e67", "value": "C6C4CDB0B6F0F07AC65696326045BDB043F65D49EC22A921ECDCF2D82676EE47B1131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721163, "uuid": "75c3bab7-be2f-468f-ba1a-d105db1780a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721163, "uuid": "08cf4cad-620b-4f9b-9546-1b3225ce222e", "value": "12288:mthHFMw7Y9MA59CyMAn0S2wxjzjLES8aHjeOuAv02:AH+w09tVowxjzjn8WjeOt82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620721163, "uuid": "02c3b8d4-0f29-4cec-aeff-2ead31622969", "value": 562088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620721163, "uuid": "6e231212-63db-45af-a7c2-91d3cf3621c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721163, "uuid": "678fe2c8-aa83-4eff-a2cd-7f4af49d53b0", "value": "SecuriteInfo.com.Mal.Generic-S.3107.26469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbd830e-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698490, "uuid": "b15883b3-4d11-43b1-92f6-8954ac02f85d", "comment": "Malware payload (Dridex)", "value": "71f39fd8186c0273c1635738432faa17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698490, "uuid": "1a805a4e-c77f-4e7b-a423-ea68138a9981", "comment": "Malware payload (Dridex)", "value": "6e2953dd2c2d916130ac8ff7e6e9de11e1a182a1debc951cfa2911eda3d234b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698490, "uuid": "fa52cfe7-32e6-4ef0-82ce-a877bd6d0013", "comment": "Malware payload (Dridex)", "value": "a5115464fe461774d3c57e5b50a3109dc2fe5875", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698490, "uuid": "3dca67b7-f145-4499-9e75-ec9245e47c80", "comment": "Malware payload (Dridex)", "value": "f7a51c7bba5794b9c72368508363eb71589220018eedddb5d6abc03853da2c262b10353a7eda21175800bf00c5f7da8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698490, "uuid": "3afdf0d0-22ea-40b6-9967-73c5b1fd7e96", "value": "CBF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698490, "uuid": "529e9743-1da2-4ad3-be8d-2b489018f3dc", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698490, "uuid": "4e2b5589-095a-4ed0-b52b-36c3be793c88", "value": "3072:EWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:E42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698490, "uuid": "fe7c8ed0-d76b-4644-99eb-9fb596b390f3", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698490, "uuid": "47edcbca-94b0-4e89-9fdc-b4e9d42a8cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698490, "uuid": "0be7f4bc-ecaf-4876-976e-2c25734fd010", "value": "71f39fd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6dbf28-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709256, "uuid": "ebaae5f3-31c0-4e5b-9222-2b7f799c9531", "comment": "Malware payload (Dridex)", "value": "abc0c4ee08c4b1461c9b278c13a6f297", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709256, "uuid": "37ba4869-02e3-480a-afde-872a6dc90e75", "comment": "Malware payload (Dridex)", "value": "6ecc3fbf0f79eece6cc9e3d30d77750db43833802cd4f90871978f8250581cfb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709256, "uuid": "bcb4ee9f-e315-4d7b-8b97-90cd10c7423a", "comment": "Malware payload (Dridex)", "value": "e4e0c621075a9768102be3ced27e6f49b33b083c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709256, "uuid": "5acf3d95-e9e5-4ab8-920e-32ab14fbde22", "comment": "Malware payload (Dridex)", "value": "5b4749f5259b6f582096e3c66476d344dc4f1ae6c8158efa679450c7d80857abe9b652956c3912211bfae33db3298a4f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709256, "uuid": "73cc65ff-03fc-43d8-be97-aea48780904a", "value": "EEF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709256, "uuid": "22846339-6160-4afa-ad0f-8e9a4114a51a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709256, "uuid": "5c91cc1c-1821-464b-bedb-6ec58eeff2de", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709256, "uuid": "75bc13c0-f0a2-4408-8bd3-d08bb525a4a4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709256, "uuid": "44e7f99a-89ab-4138-8f64-df935b22a124", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709256, "uuid": "28e7a840-b97d-4da7-918f-2ecbc791c429", "value": "abc0c4ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3b0f1c-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620728692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728692, "uuid": "50427e12-b020-401a-bbf0-0400de61f328", "comment": "Malware payload", "value": "33fbe50892174bbe15c4fc65254e9063", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728692, "uuid": "e84731bd-0dae-4a74-ad27-0995fbebe086", "comment": "Malware payload", "value": "6f2bfc4417cf4ce6049248941da5e4acdfbaf89d60da8647ced40f45ca2d874c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728692, "uuid": "642ddda1-6e30-4aac-875f-27a5624de4ad", "comment": "Malware payload", "value": "67ec5e09eabbfe9e512b2973c9810e41b86f329a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728692, "uuid": "5bc91e5c-ed20-4590-b8b9-a396b538addc", "comment": "Malware payload", "value": "21f2cb39664aab44e1ac9cab1a395399dd988e0ed4cdd700e49d650565f5490434080f383df9d404946ff3d936636f29", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728692, "uuid": "9e8dae6c-057c-4eb7-9ccd-72fe344c2753", "value": "1691E565827C1563DD26D6F2E4B1FF3611E2F22E86CB0E8837ADF9B00BAB7115861084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728692, "uuid": "dba833cf-e373-4e80-a4ef-bd1952a4563f", "value": "96:Jt82HKw/SzHXCjl8Nd4e4O4w4agkDC8mujWHh/:Jmw67C3agrXbB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728692, "uuid": "24a9912e-8fc6-48b8-9353-8b878f2b2472", "value": 4500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728692, "uuid": "ffc3d41a-ae87-49da-a24f-54ac74ee9476", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728692, "uuid": "c5e3b882-9f91-4093-801f-8f558bbb1cc5", "value": "Enq 557.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66eae40-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715228, "uuid": "672d1f9b-aadf-4983-bfa4-4072b2c1ac4d", "comment": "Malware payload (AgentTesla)", "value": "73ca54f380bcf2f248512ca4671e79ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715228, "uuid": "b8783ff3-21b5-4791-87c6-b7b799942f61", "comment": "Malware payload (AgentTesla)", "value": "6f8710e6b6e1995fa20b77cc67c0b06adc292fb8b0a37a827d5155795628e1f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715228, "uuid": "a1f1b611-d1bd-4868-b5e9-8f3a2296b97c", "comment": "Malware payload (AgentTesla)", "value": "cb573f88a2097c826c7a955ee240e7cdd536d76e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715228, "uuid": "dce19197-a891-4368-86af-2a1b9f774b3e", "comment": "Malware payload (AgentTesla)", "value": "fc2de59d5e852c4f8ba530409c0c6e8cbf8a4c159619db30ebc7f92573edce206a72059d7f7a6557cf510ddd7b04bdeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715228, "uuid": "a3779ccd-a287-4bf1-9823-cd913938a0d7", "value": "3D15231727C8D510C1FD07FAA4A34B0103BAB4166157EB9C7F8869ED1BB36D88647AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715228, "uuid": "4e3f1b89-4a28-4e9e-851e-ddf636a867b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715228, "uuid": "5230c8f3-2c6a-4591-8d08-3686580e6db1", "value": "24576:3qjCKrTG0RxO1KGVWBZO5DAp9Hm3FE/5fd4esuuj:3UC0TGk4KGVaBHmVihd45uuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715228, "uuid": "1320b25c-9360-420e-bea6-80f45a097caf", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715228, "uuid": "541c53cc-f143-4a52-9665-849b8c09f941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715228, "uuid": "118f4be2-99e0-4309-88b8-d1e02ed6b3f9", "value": "PI-ARKEMIX HMX20210511_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a097d54f-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728909, "uuid": "fdebf61c-ef83-4422-ac69-ad46f3baa31e", "comment": "Malware payload (AgentTesla)", "value": "02d84808b070f7232a96a2dfbdf77be9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728909, "uuid": "14774cc4-e10f-4e9b-b847-f032feab436c", "comment": "Malware payload (AgentTesla)", "value": "6f88a4bdf6ca9a0b63e8dca6b56c2431acaccb7b58a6ddf5166028756c172d5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728909, "uuid": "ee58ab55-c3a8-46df-8de9-b92b41ac709c", "comment": "Malware payload (AgentTesla)", "value": "35f15873b331fbd261c3ff3a39388616d99a1782", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728909, "uuid": "02aca0b6-ba61-4f05-826a-5bbda03a950a", "comment": "Malware payload (AgentTesla)", "value": "d5fc23ece282c51e72799f1343a31e6b3ed92ce1ed9ddeb1a12b4510e170f5a517971ad0822ae142af0c85b2b3d4d12a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728909, "uuid": "f22d521d-45b5-4c86-8e4d-ca9a493f0170", "value": "4A150126336CAF62E13ED7795820115193F5E406F722E55EBEE810DE185AFC08BA3F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728909, "uuid": "84deeecc-48bc-45fe-ba2c-cdcff7dd2b7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728909, "uuid": "cbb1a011-f8dd-445d-b6ae-3e57fc5eaf01", "value": "24576:4r383DK4TPXp640mkERlL6W8HOiNshTlax2GepHoO:mCbJxbhTnFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728909, "uuid": "0ea4aefe-892b-4c59-9e15-be075b178c05", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728909, "uuid": "497e2862-f7cf-497b-b7ee-963f484521de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728909, "uuid": "74357d5f-577d-4794-bfcf-91aafd722b42", "value": "PO#6275473 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a00cc1b-b1f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620693061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693061, "uuid": "c9385655-670b-4d99-9e2a-7742bdcd7c36", "comment": "Malware payload (OskiStealer)", "value": "bf8ab0b1bfc29c194ef553d0246199d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693061, "uuid": "97e49917-c1a2-417a-bcc5-aff143b84a8a", "comment": "Malware payload (OskiStealer)", "value": "6fb172bb9c23b3a8067a40f09264c3fa8ecb4f081c659de59560c5d52364d9e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693061, "uuid": "381585e5-9b4a-42d9-bf7b-94bba57f876f", "comment": "Malware payload (OskiStealer)", "value": "f5f170eed6e8cfbf42f605e2a21bfcf1d772a348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693061, "uuid": "d69a6aac-627c-4494-b200-86587bb54654", "comment": "Malware payload (OskiStealer)", "value": "15dec81e45b4353093da1e360fa815a173a5a45f04eacd34055d4f90e8faad74d62ff2d23cc7be7afc45e71241fdebfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693061, "uuid": "bfda00fc-c007-43bf-9b05-c5d4d1a8e9b0", "value": "54659D31515E4955CAA11730DF9BD13D8731FE916222B3B76AEA3E9B3072232580C6FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693061, "uuid": "79f554a8-2e7a-4c6b-9fde-2bf233155b77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693061, "uuid": "450a4669-d969-41bd-a04f-27e8eed117ef", "value": "24576:ZASkcYOBKG1qZPikojMoztjnzNzwxrXa4YYUkw:jDI1ik4M81nzNzMXa4YYvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620693061, "uuid": "436f3eaa-766e-48a9-b847-9629f0a3aa5c", "value": 1485560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620693061, "uuid": "6e5cd188-2516-444f-97dc-5ba47380f21b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693061, "uuid": "7a0a0850-0efd-4b56-9b36-7cecb2c6747f", "value": "6FB172BB9C23B3A8067A40F09264C3FA8ECB4F081C659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f202c32-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712934, "uuid": "9b35352e-d4d7-477c-b4a5-8f20340d2503", "comment": "Malware payload (Dridex)", "value": "2ae9319b070779692b8fe96394f555b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712934, "uuid": "410ef7a5-d857-4304-a7e9-fef2bd30a782", "comment": "Malware payload (Dridex)", "value": "710482c3d6af680f98b7ca508f7f55c21d3442a2fc71017abd38dc69b86c5f79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712934, "uuid": "4e982b2a-e355-4378-8720-da6c6a311b7a", "comment": "Malware payload (Dridex)", "value": "a167e1772f12a621ea9f00fefec6187652b84b37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712934, "uuid": "367ccfe1-eb8a-4a6e-9990-7ef7bf9d497b", "comment": "Malware payload (Dridex)", "value": "642484101a63a37145e35944c778b953d7d235b3bd826eca91a52a3675bd56fd13eedc5877a49f4852e38fe4ec504f94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712934, "uuid": "9e6231a1-3ee7-43a1-b0c1-94e63f339c9c", "value": "ADF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712934, "uuid": "8ff63cd9-3f16-49ff-b823-a9c5710cf4af", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712934, "uuid": "c3b39e2f-139b-4531-8811-56bec09d80cf", "value": "3072:2lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:2lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712934, "uuid": "49c8d641-39e9-4a36-abcf-101e92df958f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712934, "uuid": "8233fe1c-abd6-4fa3-a146-68d8e08f6751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712934, "uuid": "430a3df8-10e2-418d-b02b-76e37e10b369", "value": "2ae9319b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e242ae0-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715349, "uuid": "285ace0a-76b2-4977-8797-17b7d01eb718", "comment": "Malware payload (Formbook)", "value": "65340529bbb528979867f252fc271f24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715349, "uuid": "0863065d-3e37-4b07-bf24-da42ab2e9c0f", "comment": "Malware payload (Formbook)", "value": "710f83428f51d2ae997921220b3e96802797260ce5de34007392ebabe0bdd12f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715349, "uuid": "a14f261f-f1c3-422a-9351-9b1c5a8425c1", "comment": "Malware payload (Formbook)", "value": "541f2424a0a081637b538c599b72e922e4d6bd3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715349, "uuid": "05a1c60c-ae70-4177-9f91-f92d4da8cba1", "comment": "Malware payload (Formbook)", "value": "65e3df90ad8eba3d4645afbdde02d113243b14557066ee8722dfd20611fe66829159f1aa00df68f10efe9606494682c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715349, "uuid": "1355fec2-29f0-4b8e-8ade-aca357752400", "value": "C01512072FA096D1E0F8277C20D2559813F3FC0FE645FA8ABF8074A96B73585CE81695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715349, "uuid": "f3e51d19-c28f-4b1d-b12c-61eed8e39853", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715349, "uuid": "bc0047f7-3277-4d6a-8a9f-6bee56b91415", "value": "24576:TZgOOxA4MuC/XjN7OqbQgW4h61jrnE/JOPiQ4k:TZgnMuejNaWhIEOPiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715349, "uuid": "ae395149-58ef-44fe-84b1-3b39f4806cb9", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715349, "uuid": "65d7815a-2573-4634-9902-ff118869ba86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715349, "uuid": "594ecbf3-3232-4d66-a581-b85a9b183c63", "value": "\u4f9b\u5e94\u6750\u6599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1fa257-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1620717197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717197, "uuid": "12e1912c-32e3-4683-ba32-9a0483e6fbc9", "comment": "Malware payload (Amadey)", "value": "2e0d574bf00170bb5a448510c2226408", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717197, "uuid": "e0477788-c1ee-43cf-b2e1-54407f0b2770", "comment": "Malware payload (Amadey)", "value": "7110725acbacccb5dc022fc2eb1b1b7c9e30f2a6b24ef77abfed8cea3d297966", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717197, "uuid": "db9c3dc8-d70b-4095-a549-32870c19a216", "comment": "Malware payload (Amadey)", "value": "05c599f0ffc3a7474a51ecbda9de51f8dce0ba62", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717197, "uuid": "da126cc1-f0ad-4151-92ac-ab1513537b3d", "comment": "Malware payload (Amadey)", "value": "14cf4c1035befc2b0ab494df1f9f449222064bd3ab9570dc1d932b128ec27893071b12214870fb94685c9b08ed2899c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717197, "uuid": "65e7c15a-6ff4-436c-8991-bfcdee23722f", "value": "2B257C193F64B55CD3560E39D494B30C4BAA6D58EEE3C183BEBE7297607EF1202A4712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717197, "uuid": "555dad47-c6d3-406b-bec6-e26c8b778abe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717197, "uuid": "a0ce1ad4-9337-4c78-8a12-1a737a843fcc", "value": "6144:oso0KUqag1sLmgGNibC6FsTEpv1CWMNsnh8ERhq7xifEmBblsI3y7GZ2/:ToD4tBM2h8qhEQfEmBJsYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717197, "uuid": "2cd92cbd-e9d2-4b39-ac8d-84e27390210b", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717197, "uuid": "11087b81-f818-4174-9a1f-b24791929359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717197, "uuid": "8d37bbf4-3307-4cd4-9971-3d3fd9ca8059", "value": "2e0d574bf00170bb5a448510c2226408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a857bed5-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728922, "uuid": "c359d291-76b1-4510-9f45-f2949dcb16f3", "comment": "Malware payload (AgentTesla)", "value": "d3a2edaff3070fd462a89b3c5d75391c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728922, "uuid": "d1e78df3-3412-41a7-b779-34746a4add62", "comment": "Malware payload (AgentTesla)", "value": "71276409f3ed154c5b43a4357d4644350d89c064e0db3ad4cca5570dbeaaa3a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728922, "uuid": "28f494b8-7a15-4761-877b-aae2539943aa", "comment": "Malware payload (AgentTesla)", "value": "63fe1e5b263c0cfc796010f7ff5e39ad631a39c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728922, "uuid": "b92aed51-73d0-42d7-8e56-c58b9b43ffda", "comment": "Malware payload (AgentTesla)", "value": "e6be0d98b93e701bde236b72b7cc16104832f7e1ac17ae8a61a6c792cd9793a39e64ccea2c42779bc25164cf7b690d8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728922, "uuid": "cb3272da-bfaf-445d-b01f-4ffb67bee823", "value": "2015F1313368AFE2E6BEDB3E5854004853F5F41AE721E68D7DD905EE4425F818BA2F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728922, "uuid": "b1f29dcb-0849-4ac5-b8fa-6e5ed7da545c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728922, "uuid": "af61c032-7c0c-47f7-bfe5-50bc905ea758", "value": "12288:8bjyHAnQ/SoUXOtM9Q3Yo7B8uhWTf0+2ao0zAH0ZP3cYd/mxsnuRvIRBCalF++TP:8KaTzAH0Z/cse0u9InCaj++TOnf931C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728922, "uuid": "48f86e96-fb3a-4e53-854d-cdf065319a6b", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728922, "uuid": "1af087c8-e34c-42bc-bcb5-5291b8eaccf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728922, "uuid": "8b4cba7c-6b4f-4de3-8f2e-7eab9666150c", "value": "BL COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17990cf-b289-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620759109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759109, "uuid": "f042b9e7-a3b7-4ad4-bb2d-259a4dee5254", "comment": "Malware payload", "value": "e6fa4e620f40158675e05a337318ee50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759109, "uuid": "bf1db0fb-40d3-47e1-97ee-fe76bffd91b5", "comment": "Malware payload", "value": "71adba3a8692ba36d24a2280954bc55db0b0c2a067a84a569682414443893ac7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759109, "uuid": "0650e338-42fd-4570-af8f-32be9c3b2e2e", "comment": "Malware payload", "value": "5b6dfc5bcdd0d9fd0b6ed397c1d325f41784a0d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759109, "uuid": "4e481add-8cf4-49a4-afec-a048e29e828b", "comment": "Malware payload", "value": "2e6a441b1a7c93f961902fdb66e7c5ad140e51b2c96b13dbac668d694d7b25e4c45bc1ba3750004c04181c2816325409", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759109, "uuid": "8a79426a-c6ab-46fa-9bfc-785a53674694", "value": "735337394F680BD1DCD72A735245CEB1D3350EC157A727B3FA2C3648A768E5168281BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759109, "uuid": "a937b452-0e68-47a9-8069-2c2b5a7b1230", "value": "1536:cDLh6DrkzO9HT2ftnKQ+80Z+abc8fIH6L1Yx:a61T2FnK7cOIaB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620759109, "uuid": "15081641-4a83-44e2-888d-50f90079e2b0", "value": 64691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620759109, "uuid": "05de3457-dc9f-4ec1-841f-f8977805ad3e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759109, "uuid": "a0a05f63-902e-40de-9db6-f7c0555629dc", "value": "user-invoice-8488888.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b25037-b272-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620748971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748971, "uuid": "a2834533-23ec-423c-9ae3-a17aad4cdd50", "comment": "Malware payload (Dridex)", "value": "21270a3133ace626b8cfc44fb8d18453", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748971, "uuid": "c3621d69-2575-4419-b40e-c76911240fbb", "comment": "Malware payload (Dridex)", "value": "7257fec4d3e50b6a4d6100b1ebaa4cf51095892dc31f3b5301c9ad86094969fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748971, "uuid": "75966dee-2a28-488b-9df0-bde1c3fe0076", "comment": "Malware payload (Dridex)", "value": "404387797d08abee532395b739dd2ae433fb17f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748971, "uuid": "dbefd3d5-eab7-4476-8346-5527f20c6596", "comment": "Malware payload (Dridex)", "value": "8bb98082c16aa19bf7a6e4a14fcd2117401039d07040f10722bb7fa653e8363fa8daa9f7ae34e7a47c3225c6c4426ad9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748971, "uuid": "854b990a-8a48-41f6-979b-8386f6c69946", "value": "71F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748971, "uuid": "eff4641f-8400-4f3a-b1a9-81d34ebc97c6", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748971, "uuid": "b6807e12-f182-47e8-ab18-1b3349f73667", "value": "3072:0WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:042IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620748971, "uuid": "1f25c273-46a2-4610-9398-9d42a7d9d0a0", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620748971, "uuid": "d9fac6ce-50bd-4465-9ee9-128b776be026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748971, "uuid": "7e9dac67-373a-4b71-8578-6ee5f3580e06", "value": "21270a31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c536654-b258-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620737706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737706, "uuid": "aa9c080f-b2ec-46bb-88c4-517ac8fc6d99", "comment": "Malware payload (RemcosRAT)", "value": "c92c34ed08c2495905803b41a57aa7f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737706, "uuid": "9522f4b4-869a-42df-9254-e0784801bf53", "comment": "Malware payload (RemcosRAT)", "value": "72849c508e7534ebab7eb520f72ba0e7811ea7bb01a37400e1031c176d84b23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737706, "uuid": "ddf688dd-3951-46c8-a4dd-284e34198327", "comment": "Malware payload (RemcosRAT)", "value": "7a9cc21adf388ef89d9056dd58c556d747021593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737706, "uuid": "3b8c43a2-795a-49cb-90cc-ce95a0c9f84c", "comment": "Malware payload (RemcosRAT)", "value": "49b974fd2c2b5f13ecaa8a90a82fcbd2afeffeb53b39c46780e9fa3e6f10ce33830d73c6f4e5c35bf168b8082775b63c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737706, "uuid": "ca19f998-b08a-4719-867e-297824acbd23", "value": "1795550252CD898EF7F33E493FF90231690B7BD1AE7AB16C65805918D398C58D1F5BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737706, "uuid": "d3a198fe-f133-4407-a5ea-dd81b9fd35c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737706, "uuid": "82e709ab-ea1d-4638-a759-2476a4af2876", "value": "6144:XoTxvXfyatGTKPeyZ3Sp4m6fmzQPeowx/UOG0WFLMV0C8iDOYT:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737706, "uuid": "ab2d4498-dfd8-4c98-93c4-aebc2bf09bf7", "value": 1924832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737706, "uuid": "18115e34-da97-4847-9a90-86394bfad1b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737706, "uuid": "ead5af5a-22ef-4e85-bdb0-fa8e9d90e675", "value": "XEG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a60e49-b22e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720012, "uuid": "fe501ead-35f7-4222-9a49-98509df4c344", "comment": "Malware payload (Dridex)", "value": "682f723d81ae6470e5632177d1d83bff", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720012, "uuid": "02c1da98-49bf-40db-8b37-3d1c87239460", "comment": "Malware payload (Dridex)", "value": "72889e3ca7d94e559991b04d0e02d1a68fa2dc92c8ebdd29fc77ba472d491897", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720012, "uuid": "2c30a953-c61f-4c7e-aa55-3fd95defa8a9", "comment": "Malware payload (Dridex)", "value": "1cdca219c597c3ab280ffad4c5cb46cb67326233", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720012, "uuid": "73f0b3f0-bfcd-4ec8-ae1b-fe1ad9078b49", "comment": "Malware payload (Dridex)", "value": "e628ceca6084d5ada370439e31a0b3694a0d8236ef0f670949d778d71c1609be9a445eecde63e2cb01e8ba7e97e8c5ae", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720012, "uuid": "c931f17d-2997-4178-b4ab-b996425cfde4", "value": "65F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720012, "uuid": "50dea7f3-9848-4847-8912-09ee0647d849", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720012, "uuid": "6344471b-1bb6-4758-b0c0-d2f9cc46f545", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720012, "uuid": "be3c85b7-68fd-49fa-a4f8-92050c02805d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720012, "uuid": "bd94d54a-df67-4337-a345-02fc61b8ddf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720012, "uuid": "00f9f05c-afd5-4214-aac5-1764c977854e", "value": "72889e3ca7d94e559991b04d0e02d1a68fa2dc92c8ebdd29fc77ba472d491897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8655fc49-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705672, "uuid": "96775838-0973-4cdc-8492-783b14456d37", "comment": "Malware payload (Dridex)", "value": "849a2b12843b2119af26acb4aa5a66d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705672, "uuid": "0a4aa2f3-b91a-48f7-b245-61ddb466b481", "comment": "Malware payload (Dridex)", "value": "728fa2b0e664abf48a301db7df6424f7b82ef3d61aba243e2ea703e87a7e8c89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705672, "uuid": "da2351a9-bdaf-42b5-b6bc-65b05f34794c", "comment": "Malware payload (Dridex)", "value": "246da5c94d50b0100e38909975d17f3334340c60", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705672, "uuid": "e2b7b03b-1376-48dc-85df-77d002f5af68", "comment": "Malware payload (Dridex)", "value": "3fe5848195a4969819ac1b4c273abb13949ff1a66bc85217cb522a89e81ec1dd5138d962d1dface7983595015253f8c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705672, "uuid": "8e2dc775-f77f-47bc-ae5b-cf6244c9a709", "value": "5DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705672, "uuid": "0a0e849d-9d17-42be-8e2f-1d7a6d8341f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705672, "uuid": "db39d7f0-c760-4219-a842-29a272dcc4b8", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705672, "uuid": "47f5bb99-015c-4aad-9ada-be0721df361a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705672, "uuid": "bb6ab905-d6b3-4170-bece-ed5a054d452c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705672, "uuid": "9a241378-50aa-41fd-8560-c7f6b8ccb07c", "value": "849a2b12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8897e6d-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620741028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741028, "uuid": "e40fce79-3d74-4d7a-96f7-828ebf405e92", "comment": "Malware payload (AgentTesla)", "value": "f92a3467a738bf01d029db773b5dc867", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741028, "uuid": "2f8355bb-0b6b-4513-bcf4-d4f7978626ac", "comment": "Malware payload (AgentTesla)", "value": "7295a582fe88bca9f42f2849c9d40ceeff3006c1911dbb08e6ecf02f20cfa60a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741028, "uuid": "337faa97-c2ea-46b8-9c59-2112a04a3ccd", "comment": "Malware payload (AgentTesla)", "value": "b691be8d760aa3f4e932baff1295573ac50de770", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741028, "uuid": "7504c9cf-a858-4ec1-8089-eda42d92c01e", "comment": "Malware payload (AgentTesla)", "value": "18865e9b8ee51bbcee45b0382eaab5f4a5f934900287fd46def3a724b9b5eb4e19d79c11694946f717c8e559d6244662", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741028, "uuid": "0c4943b7-74b4-4948-b31b-07d2453130bf", "value": "5D058CEC750464F9D35B5C37A3CF1C0682141270AA3B6A0B9B2117BE6A5BE173E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741028, "uuid": "66792be3-de12-4630-a46e-bfd19dace537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741028, "uuid": "525275d8-6a68-4b2b-abfd-1f5f350d427d", "value": "12288:1oLLoS60/K7yh0Bm0/gDFFb5EHHqSa/YZsPgzLtDpXLOFy3qkxj9ExnCjDK:1oLABm0oR4qStzLttXLdxEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741028, "uuid": "1f521b4c-1518-4c61-bdf0-5722501c18f7", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741028, "uuid": "98230d83-4587-483f-962f-104e89e9f3cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741028, "uuid": "d139fb35-75a9-497e-bde2-ff11b074345a", "value": "#3001470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e072b04c-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620741901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741901, "uuid": "2ad01bb0-c3a5-4120-804b-d59f7d0b4148", "comment": "Malware payload (AgentTesla)", "value": "c3dd015c631875adfecc6c229b474cf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741901, "uuid": "34f8edbf-930f-4a3f-93f5-ef758a07e346", "comment": "Malware payload (AgentTesla)", "value": "7299f2323910def53bb344e98441a66dba82b84b0d8ec89dbddf0ee6a936280a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741901, "uuid": "41858278-d6f5-4163-ae0f-b4a4785d14af", "comment": "Malware payload (AgentTesla)", "value": "26835d1df6761a455b6645fd27dba5dc7ed506b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741901, "uuid": "b5ece037-5ccb-4df6-999a-957b6be36e01", "comment": "Malware payload (AgentTesla)", "value": "f2f4cd26dffdd51e574cb2e2d3ebb050d9bd709d22e1678af8fbd28ed0e76ddc767db981802e99285be75cc2b6ea2214", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741901, "uuid": "2f3a2acf-af29-42cc-a4f7-55550884ba58", "value": "222501B053A51F67C7BD5478F8028245AAF19243B22BFBC47DE514E910C6BC24BF2A79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741901, "uuid": "b383691f-f010-439e-845c-95abd7e5a147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741901, "uuid": "97304caa-e6f6-4616-a69a-f4c8212e4c14", "value": "24576:G0S7CXmTyp9m4wUkQGOcjfpCvZ+JbdKJCK9jap:TS7McyK4/xGOcjhKZ1JB9jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741901, "uuid": "645d88af-91d6-4bf4-b23e-cc9868d910df", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741901, "uuid": "6f27c251-fe31-4fbf-8ecd-4e1915bfab3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741901, "uuid": "a7e69df7-c77a-4c82-b259-580e392534ac", "value": "DUE INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58d1667-b250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620734608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734608, "uuid": "51061840-dbaa-4d98-93ab-f7e03ac7dd4a", "comment": "Malware payload (Dridex)", "value": "1674c156bcb0840d06db42ec7a591951", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734608, "uuid": "377b5b24-a76e-44e0-b2f2-74f65948e819", "comment": "Malware payload (Dridex)", "value": "72b5db3f418c3775bda8492a76478294222a1aa52aa132a8c2384b6faa903501", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734608, "uuid": "c1728088-aeb1-491d-ae9c-7c47c3aa7b06", "comment": "Malware payload (Dridex)", "value": "9345f6ac8065e2268173665387565029235d48a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734608, "uuid": "fd11ab8f-229c-4bd0-bd6f-9a787b9ea787", "comment": "Malware payload (Dridex)", "value": "d61ad111eff631050ed81ea83772d0f573b61e72329b800b0555fe946f6335a4a77386b1c1c1baa1c906eb1307f95d5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734608, "uuid": "0953f89d-3f85-409d-b4d7-5a168c912dad", "value": "75F3E00AED9FEA88E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734608, "uuid": "3fc6a572-761d-41f6-9fec-b74d66ae4f1c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734608, "uuid": "4bf244e2-722d-41b4-a9b1-ae64ef867c53", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734608, "uuid": "c783f663-4fe6-4a25-ba5b-baf76fec4813", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734608, "uuid": "a1d6b58d-42ec-4743-96e4-0975b91be45a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734608, "uuid": "0080d342-77e7-4c56-b2c6-5b352a3263b7", "value": "1674c156_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c614e9-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620752786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752786, "uuid": "fa9bae6a-a111-4cef-ba62-0cccd4db3006", "comment": "Malware payload (Dridex)", "value": "1f5686480099e3efdc480fd21870d5b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752786, "uuid": "2a357a3c-b422-44fa-abe3-0d4cf47856e9", "comment": "Malware payload (Dridex)", "value": "72c0b312b3f30856840cadfab733060618c0e656c84f0bc537f8b73875c67b90", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752786, "uuid": "730f0c69-a6d9-4dc9-a20f-4e33e34d9709", "comment": "Malware payload (Dridex)", "value": "60425e767f47ad90acb948cc2fcfbd6f49a61180", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752786, "uuid": "d412ffad-3b6e-4e20-92f0-9d445ab4adef", "comment": "Malware payload (Dridex)", "value": "d1857e62cf36c71be81efdadbb0c08f025fc56e0447b61a62459dcc005a28a23bf18d5a4b900de65f70ae3ae1a60f418", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752786, "uuid": "a34c6e06-ca30-418b-883f-1406b8f9626d", "value": "D3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752786, "uuid": "2f54ed66-f491-4f99-904b-6a4814e08212", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752786, "uuid": "cd8ee258-4ca3-4602-bf62-01e07e4843ea", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752786, "uuid": "55e73aeb-b1e3-4840-b26b-de9e63345234", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752786, "uuid": "a9f31a6a-cb63-4130-9a84-2e02eccd8003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752786, "uuid": "492231b0-e4ab-44c6-b5fe-6926a193b45a", "value": "1f568648_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70685f69-b22d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620719379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719379, "uuid": "7f257e04-84d7-4fcc-85f0-62a96029ef4d", "comment": "Malware payload (Dridex)", "value": "9924a92c4dc58663bc1469c87b6c1425", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719379, "uuid": "b84c722a-8805-45e4-bb1a-7adaff3dd415", "comment": "Malware payload (Dridex)", "value": "72f89a6e6696cb6d735535032a7d06ab4de5ab13468946116cf13a9abf941e95", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719379, "uuid": "ac4af76e-5c40-4762-8b00-44663f91e877", "comment": "Malware payload (Dridex)", "value": "c8d600339f51c150aef7ec5c9e827f593de2d579", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719379, "uuid": "1f926a7e-ee9d-487f-a042-e9cc5d07adfe", "comment": "Malware payload (Dridex)", "value": "f1158c71a6ac0aa7b691c3213b1eaa098e0046a22220f1ac02ce00ffe4a5ce7aa676d22635364d204e88e0c6fd33a4ee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719379, "uuid": "f607936c-0071-408f-a3eb-ccdff86ecbb2", "value": "52F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719379, "uuid": "1f04e6a8-0e3f-451b-bf29-df6b1b0f808b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719379, "uuid": "8a67f52a-c90c-4685-aeb9-9c1d5ed0a745", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719379, "uuid": "70491814-11b2-4cf8-9736-a1372cfc0bfb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719379, "uuid": "2ea293bc-2361-4599-bfc2-afdafb0dc64f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719379, "uuid": "78d57e7e-a1cc-4f1e-820e-1a985a3df436", "value": "72f89a6e6696cb6d735535032a7d06ab4de5ab13468946116cf13a9abf941e95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f24f001-b263-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620742516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742516, "uuid": "e5bb354f-9608-49e4-b0a3-237a718708ab", "comment": "Malware payload (AgentTesla)", "value": "16ac48b497b41ed5c7c91151db5cb1bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742516, "uuid": "54ab6289-fd9c-4338-b5e8-f92f7d60e6ae", "comment": "Malware payload (AgentTesla)", "value": "731d4912db7dffdbdad671f3606fcdf1aa28bc081f13a12dc59b08cafbb5e944", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742516, "uuid": "466371e7-953c-4800-b699-00c15bc38ce9", "comment": "Malware payload (AgentTesla)", "value": "63e1e2fbad01c5bde26f5d0a03c7ff67be1f9de3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620742516, "uuid": "571c0a94-841f-407c-98a1-7472faecd9df", "comment": "Malware payload (AgentTesla)", "value": "7002dcdab5fdd05a6074e302ab51c5f358abec4f91a52526a8c3ee2ac9b8b276f0aad3f484c135dbbb0ccc5cd7312b7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620742516, "uuid": "b98f4e4b-afcc-40c2-a068-430c8df59cdb", "value": "F1257BA8714064EAC79B5C3767CFCC3142102DB4A12B551A67E03FBF79BBD632A38589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620742516, "uuid": "0ccf17a8-7b85-413a-9115-cb222abed629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620742516, "uuid": "a843dcdf-e3bd-4fca-b297-2ce27d5f52b8", "value": "24576:GoLAWtlwES9ufpq6dxblFykvC05nMMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMv:1laYRq6dlvnKEMMMMMMMMMMMuMMMMMM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620742516, "uuid": "84c8e868-ada3-4b13-ad4f-b5b8215eb409", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620742516, "uuid": "3ce5a3fc-a852-48a6-ba2f-3a1348aec962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620742516, "uuid": "bb6690ae-08da-42d7-b509-a979fea39779", "value": "incorrect bank accountdetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dd0723-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620714739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714739, "uuid": "5a7b5107-130b-4cca-915f-f8eaf2c20981", "comment": "Malware payload (Loki)", "value": "30482b8094f0e15a121d8646eb61f42f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714739, "uuid": "e18b294c-f982-436a-ade7-ae39d6a60887", "comment": "Malware payload (Loki)", "value": "7341bca425b4a55f447738806f7b9bf9cb53a76774d4be7faf38ff1c2b7cd7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714739, "uuid": "0d12abe1-8014-4080-85e5-4cf74352bf43", "comment": "Malware payload (Loki)", "value": "13a675d8d525dedec64c82f0e812f64f4e4d054c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714739, "uuid": "83615a92-2cfe-4c07-97ac-caf3110e4191", "comment": "Malware payload (Loki)", "value": "94c77a85acff007b857fce3b93a652832da539c23627632af35a2b0d1bf112ed6bd501c00c751e889c477a1bae6f4519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714739, "uuid": "89c3132f-d52b-4ec5-9ab9-518c70f93f60", "value": "0A25F81636D82F14F17DD778A13A040543F5B527E733DB5EBDE820DA2E61F418BA2A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714739, "uuid": "77794a74-d88e-4984-8a4c-75b0d8347026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714739, "uuid": "4060a8a8-4da9-4abd-9ed9-cfa6bd4b6115", "value": "12288:E/eGqboK65kLs7vpLsLiVC8E9eJPhjVwm:fG3l7Nvrwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714739, "uuid": "8c1118b9-2b29-4739-ba67-04d7207ae92d", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714739, "uuid": "c177bed5-d7b3-4e6d-ae9a-ce53f86d47a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714739, "uuid": "a4f116ae-3d56-4ed7-87eb-25d4c20edf1a", "value": "210503_McDermott_NFE_RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2156efc2-b23d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620726118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726118, "uuid": "c39ea234-d3ce-4fd7-8e4f-d9fbf361d786", "comment": "Malware payload (Formbook)", "value": "5830b69895c4f5b70d2f5c94cd718fa6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726118, "uuid": "81b7bc0b-b29b-4d54-99fa-f3b81f2b2625", "comment": "Malware payload (Formbook)", "value": "735d11c1fa476083846e9e622af57a902ff20be1a1bbce7d8ec9f7f4179d1bb3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726118, "uuid": "1f3a622d-d8fe-4823-b165-8bd74c0aafe6", "comment": "Malware payload (Formbook)", "value": "4ccc32740d632777fd30c8029ca2ef6c3def984c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726118, "uuid": "a694b778-62f4-4a53-9981-574b8b648527", "comment": "Malware payload (Formbook)", "value": "cd19911ab94c660f0cb5e01aa09954f50e55c19e338600a0afd076c7adf4c7d36d5d8de27dfe145d45147251a6178d9c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726118, "uuid": "60669ee8-24f7-4514-92ff-af889a9e486c", "value": "9F2412CB1650C93BC95601B02DB6EF30DFFED17A01AA6F07AF502F977552B92191D222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726118, "uuid": "2c9649e7-5fb6-4334-81df-e004b468ca97", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726118, "uuid": "e2cf1678-8479-446c-9876-d3143c4bad40", "value": "6144:L9X0GglZvjfTwLvgHg+U7elvRPfCNJx56:l0VlhOvgYelvRCNJxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620726118, "uuid": "bfd40c39-f9d2-4b3e-84f7-3f34b26b3439", "value": 210613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620726118, "uuid": "a6a0118c-d92b-429a-ad44-6903210f309f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726118, "uuid": "3c762642-a899-46b7-9bab-13c9aee2ae9f", "value": "slot Charges.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babd1086-b28b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620759876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759876, "uuid": "1b7df31f-386b-4afe-8a72-77759534fe21", "comment": "Malware payload", "value": "1f6fe4963280b5e16644341842c63e0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759876, "uuid": "7fbad4cb-91cc-447f-8ee6-60809597743a", "comment": "Malware payload", "value": "740fcbd92e95d25773cae9642afa07f18a88d9ea0566b5f0aff4156a813adf49", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759876, "uuid": "3b364701-ed54-483f-894c-c332ad240139", "comment": "Malware payload", "value": "fd53e060fa847f26782397d0408636b756b0d70e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759876, "uuid": "d53fbe33-1695-452b-b542-6d52b5a91974", "comment": "Malware payload", "value": "6cc55ebdaab8612d008fb2c3c21fe3beafd1e6a8b06dff7154a826cd3c37e3155eebffee347944d4cae865b9baecbd34", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759876, "uuid": "56394863-71e4-4651-80fb-7c8de1d9777d", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759876, "uuid": "2cd1dbfa-3f8a-4834-bdc0-477774661081", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759876, "uuid": "a752aad0-7995-49f3-be4f-89bd7906c2ab", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620759876, "uuid": "4fe62f58-d642-4791-918e-02b2255a6c7e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620759876, "uuid": "a53ea463-dd50-47dc-af22-825c7b5b5c94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759876, "uuid": "a67d7643-b7bb-4834-a1cc-6aa60148558a", "value": "1f6fe496_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3067185-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620717370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717370, "uuid": "059d8b71-917f-48ae-8d98-2e1964786e25", "comment": "Malware payload (TrickBot)", "value": "78902f4328e653d0f6c069e59d3b39b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot97", "colour": "#72A3B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717370, "uuid": "af62ee62-f399-4022-87f2-1410877361d5", "comment": "Malware payload (TrickBot)", "value": "7500223b9a23a332ccb85b42ad8536250ba2cbd77ed8cf80c1b1a4ffe6876865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot97", "colour": "#72A3B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717370, "uuid": "52c25b99-c51d-45f5-a144-7f2541db9e53", "comment": "Malware payload (TrickBot)", "value": "72f1ae3266bcacd45abd6f7adf708f5a7dde9132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot97", "colour": "#72A3B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717370, "uuid": "0cd6721f-e388-4695-ad3d-df1bb597f31f", "comment": "Malware payload (TrickBot)", "value": "2d67cd322a5c565c411fa00db3ec2bcaaa795a490e7170afdbc345947bd2315ae86a8c55d9df81bc1d84c7604c9c50c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot97", "colour": "#72A3B6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717370, "uuid": "37fa3a63-5471-4c4a-b41e-e40cdce58e07", "value": "A1C4C042F6E081F1D75228310EEB573EF1B9AA455F308BC79394EE2D9D36492D93A324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717370, "uuid": "0394a08b-a14a-4661-ad1e-afb595e0c1c4", "value": "e0000a9c7cd3e5025595cb8f9725a382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717370, "uuid": "e1009b0a-dc47-4a0f-9144-937b487a5b2f", "value": "12288:WPwlONBStX5U6N8wgVV9NMjOjr84NL4aB:WButX5UzHVVsjU8La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717370, "uuid": "1d4e041d-d8b7-4645-a3d5-69341830b8a8", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717370, "uuid": "c25e69c8-06d4-458d-9f5c-e0d78c7d8fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717370, "uuid": "db0984c0-e4d7-4ce1-8adc-ab3481761535", "value": "78902f4328e653d0f6c069e59d3b39b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136a7c92-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715357, "uuid": "02c12b5d-4b4d-4953-aaf9-ff71645829a7", "comment": "Malware payload (Formbook)", "value": "90dffef1583f93127f8c4ed2c0644b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715357, "uuid": "5c31a622-0933-4a99-a4bd-8065e7bbb20b", "comment": "Malware payload (Formbook)", "value": "754093fbbefe0aa73899f2585ecf31597a40b28611fad870de4c071caaa08685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715357, "uuid": "ba4e5b15-89c6-4708-a4e1-450b7be1e453", "comment": "Malware payload (Formbook)", "value": "09057e346ba65cf00e6edffa9231e319beaa90d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715357, "uuid": "155a8f27-3030-4618-8030-632ce83c94c4", "comment": "Malware payload (Formbook)", "value": "fd28214ba5f674466be3e4f4fd9f9f18fd3bf617dcf5ca4dfe6e6ea17e89355fdbc784d91c901643692651e65cab081a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715357, "uuid": "9db52871-daa6-40d9-ac41-7ea1acbccbcb", "value": "2BF46CEC750464F9D35B5C23A7CF1C0782251274A93BAA0F8B2113BD5A5BE273E399C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715357, "uuid": "7f198d8c-383c-40f9-998c-2e9a5f05c23e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715357, "uuid": "e1deeb2d-9529-4b75-8824-2388a10d6a1d", "value": "12288:goLLoS60/K7yh0Mbz69M3/LMTPVSBTu1Dkm+ztg4N18bBH3mHRnjg8X:goLAMb+9M3/LMTP8ekxhUXkRjg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715357, "uuid": "bccac470-a8d2-4808-9ab3-edfdd3b771fb", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715357, "uuid": "0408ca07-3d7a-4a30-b437-667165815312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715357, "uuid": "881d6636-52f3-4917-a847-d5b15ae8f031", "value": "BANK-ACCOUNT. NUMBER.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c952798a-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620728977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728977, "uuid": "741f9a4c-5a83-4248-9399-083e287f5ed2", "comment": "Malware payload (RemcosRAT)", "value": "e19b56628b57826f061606cd12b169ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728977, "uuid": "f0affaf2-dd62-4ee0-8b88-2e73d464bf1b", "comment": "Malware payload (RemcosRAT)", "value": "7574f25f46740df528cf48f288b684be1653763e009b4cb359796c2e246a88cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728977, "uuid": "6c9e846c-d284-4853-ad9e-b232cbd5261d", "comment": "Malware payload (RemcosRAT)", "value": "35109517afe0684e3286ceab1093df89efe5a5eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728977, "uuid": "32d8a485-84a1-4d1d-bd3f-ade61cca6eec", "comment": "Malware payload (RemcosRAT)", "value": "a2c8186278be9a0e2ca834e67a6e0768360ade68266d10557dc75891e0f2b739a2600b84a3013ee373679038ac1ee97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728977, "uuid": "b9517683-d53d-4f6b-808f-42dab343aa1c", "value": "A04512B1A3700F63DB7D50B9C411528582F39E6A222AEBCD3DE930D921F7BC54B93616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728977, "uuid": "7cb13ead-f319-4371-8899-96bdd1be0e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728977, "uuid": "a077e993-50a8-4a39-854f-3270df775310", "value": "24576:+TERRHbOqx27WSnczpcvrATqRBF8kDl9Hr:QEWCAczqF8kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728977, "uuid": "d3eadc11-100a-4699-8999-2924c392b7c3", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728977, "uuid": "76da2c70-c50d-408f-bb49-0ad3bec2d6d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728977, "uuid": "a6b8c80e-faa2-416c-bb30-7c71c79d9084", "value": "SKBMT_May Statement 00904_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46713523-b1f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620693968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693968, "uuid": "7acf41ac-08b1-4d25-a7e3-67ad0e66984b", "comment": "Malware payload (OskiStealer)", "value": "1903d35890dd11315dcc8f9035baf6f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693968, "uuid": "fa3a328e-a2da-45b0-9a0c-f5779f026f58", "comment": "Malware payload (OskiStealer)", "value": "758353a1ee13e2b4e82bd4ebfa6df47a12a3ac2d488d9602bb89700a4dc6b997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693968, "uuid": "be3e774c-d3d1-4502-9c79-9d53410db2a7", "comment": "Malware payload (OskiStealer)", "value": "f560b9b2d7cd4d2429534579f28ce37b0b9bb8f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693968, "uuid": "4d407efc-9687-4c79-a562-1cab02ae346a", "comment": "Malware payload (OskiStealer)", "value": "a1542eda240ef65d2af92df5542ff88388790cf1ff36867c6fbf7ab672b8cda790a327b476208827c36a5e8da48a0356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693968, "uuid": "d78be8d1-c5a7-4e5b-8d65-1f1f3da7a4ad", "value": "683412560E60FEF3E4B606325DBB8A2FDFC5925810A52B0753644F5EBE139C78B1E281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693968, "uuid": "89ec19c5-d45b-42fe-bd70-ff70c99146cb", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693968, "uuid": "918fb002-7218-49d8-98ae-b9914938e031", "value": "6144:L9X0GgaejoDOW+htlAvwPThVWyizGn5ZlDhT1AYTDFxee++lfttDKpKDyji:l0Va+5tFThV1+G5YUDW3Kfn+KDyji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620693968, "uuid": "397bc06d-d22a-4f7c-a258-7e63239bd42b", "value": 250515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620693968, "uuid": "35d56909-9939-46bf-a924-450626ffd05e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693968, "uuid": "73d5450b-4743-4750-9a95-00720faa9b4a", "value": "P.O# 70058629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7430093-b210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620707042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707042, "uuid": "0e487611-372b-43c9-9650-a9a678aa3139", "comment": "Malware payload (Formbook)", "value": "dc936f3b43526c389255a44d521060f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707042, "uuid": "7b6fd5f9-478a-4657-92f1-4ec28742cb6c", "comment": "Malware payload (Formbook)", "value": "7646ecd567f39c588633d4ee1bdc01e2dc943606156b71453bcc2294a2d885a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707042, "uuid": "fb039dce-6bae-458e-a00c-a7b11c377cf4", "comment": "Malware payload (Formbook)", "value": "b2039b969c7b429de61c45bab40f782e2be9eb40", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707042, "uuid": "eb2f38fe-b95d-412e-ad2d-46f3fb87a6a7", "comment": "Malware payload (Formbook)", "value": "8dbf1e9cd990a6c48f31d2a4822dcc755a468321dad0513891d8651c504e05701243042d7d0148ff27c9a9dbfca3ac9e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707042, "uuid": "24838ae0-e2bb-4bc0-9bb5-0ba2257e26f7", "value": "F914225518DF99A4119E8B9F21627CA20324DD8C3195AAD4B47340B923FBEF3BC399C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707042, "uuid": "ef961f48-fba0-4198-a027-84c383a945fc", "value": "6144:2Loaa5Tgzhduy+16X+2SnbpVBnJUWpXlk7A:2Lza5TehQsedzJUUmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707042, "uuid": "34eeac95-3108-4e46-90fd-3211ec23ccc2", "value": 206539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707042, "uuid": "b7dd76f0-8e59-4e43-b816-25b797689fe8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707042, "uuid": "00d66654-b753-40de-8e38-e1500aec1b5b", "value": "Request for Quotation.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3797cdb2-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620711982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711982, "uuid": "55c45200-9531-4279-a8ff-0b89530ac50f", "comment": "Malware payload (SnakeKeylogger)", "value": "f6a99490b8cf8428cf6cba0f6030e97f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711982, "uuid": "ec21410b-4eb8-49d2-b016-bb68bd674949", "comment": "Malware payload (SnakeKeylogger)", "value": "77b2428f92ea96e759547ce8c801ea67f17ddd60f330690331efe6b9f6ac8770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711982, "uuid": "9e48e09f-8ce5-49fe-ad5e-0059c2007494", "comment": "Malware payload (SnakeKeylogger)", "value": "cd4994c8d210b4a75eeb47e5568a005906c641f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711982, "uuid": "7024bff4-32df-4deb-bec2-44bf71ae9969", "comment": "Malware payload (SnakeKeylogger)", "value": "77aed3d297572e8956b39b71d40f9b197d5b04a2bbb8d3d2bfbf09f7cc746bd03345f3aa252824db19b3384105410aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711982, "uuid": "666a8192-88c9-4845-a0d7-f62e257fde5e", "value": "6FC4CF212358AB60F1BF9B3DD071010453F5FA2BD739EA4DBE9840DD69A2F818762763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711982, "uuid": "ace14ca8-4ba6-4cc2-b7d0-c1dd4c3d34a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711982, "uuid": "8a91d383-bc21-4611-b047-a6ac019e2b12", "value": "12288:m51G+UvXWzeC+o75TG9451Rtxz+cyACoYUyXjgTjq9oaeI5fp2S:602XdEY1RDPXI7jgn+Fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620711982, "uuid": "ee38de7e-cf06-4b14-a534-1e94d86225a9", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620711982, "uuid": "3ccecc04-932a-4d3c-90b3-02707c7c88d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711982, "uuid": "a94789ce-dde2-4718-89d4-ac90c9396514", "value": "order 39305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c34b92-b283-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620756170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756170, "uuid": "910ad92a-cf91-4370-b1e3-6f221effcb5e", "comment": "Malware payload (TrickBot)", "value": "6c904f4bb401ce90aae608a9521dd666", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756170, "uuid": "c50f9dc5-f2f5-467b-9512-4f2701bfd987", "comment": "Malware payload (TrickBot)", "value": "7806c5adbd597c7c21ae08f3ca6c65a98df2ae314f033ad57ae8708c930a4af2", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756170, "uuid": "a76de5e4-eb05-4dc7-ae30-1710dba50d3a", "comment": "Malware payload (TrickBot)", "value": "9c24ffc3beae490a769fc990910b8f136ad3cd67", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756170, "uuid": "d1eca835-b629-45de-ac03-cd7f9789c2e8", "comment": "Malware payload (TrickBot)", "value": "83456c16377208a80bacca2a3164e82015916010446087b861e19da527bf166dcd83a44de43b042dcb381c1b569129c0", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756170, "uuid": "708cbc66-f584-43bb-b610-15ea0b7ec6c3", "value": "8D24120CDAB542BBD3A25538EBFF0D61F5848D4443CDDED3064A5EAB1019ADA3DB7806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756170, "uuid": "0f65ebc9-fc23-4af7-8d40-db953e7f6fd5", "value": "1f6199c52a5d3ffac2a25f6b3601dd22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756170, "uuid": "ed85db54-5aa5-4781-b389-afc27f224808", "value": "6144:GyYsd+wkjwWqp5VJqT0hO10OJGQSpLNCGUG2u7Jh9R:GNHBxqpZDOVEQSp5CGn7JV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756170, "uuid": "0be91acf-eecf-4bb7-a0cb-8dde88ee13ae", "value": 219858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756170, "uuid": "547a59fb-0262-4476-b134-f29ccc727f1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756170, "uuid": "12243e96-4be1-4deb-9ead-7ba6c4637f68", "value": "6c904f4b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1d5677-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620741036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741036, "uuid": "f8bbb025-9248-44a5-baae-243737a1706a", "comment": "Malware payload (RemcosRAT)", "value": "9b2fb0104dbec8aeb75bc432cf538a76", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741036, "uuid": "c3302650-4351-48ca-842c-8f8f56a8ba67", "comment": "Malware payload (RemcosRAT)", "value": "7863e8d94d7f595345e13ed45b8600c86d3a8bea389ca25950dfae8a9d94195a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741036, "uuid": "fb0ae911-2b29-4be5-a902-e79537598fc7", "comment": "Malware payload (RemcosRAT)", "value": "69418022293ebd9900584fff7c510e3f39be9a2b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741036, "uuid": "fcdfd902-6be7-4299-a6b7-8637631a3020", "comment": "Malware payload (RemcosRAT)", "value": "c452b4831457ecdcfe88de2ed9400e4a373b25239b96dab883d2e4e7e3cfbf3f184cc0a69696a2c1836fbbb518fa83d7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741036, "uuid": "31b28951-d18e-40fe-932f-b0603d9962b1", "value": "C625F52162814726F06E3B38D81A72645BE57E3C2DD45366E6B43B4B4B3F2402DE61BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741036, "uuid": "1f47d16b-f8f4-4a6c-8918-595e805058e8", "value": "b64b452434f9b4c79d8cd285903a399f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741036, "uuid": "f8d9168e-e10b-4ae3-af71-69713f50160a", "value": "12288:/AQUdCLsY8iOnhm8q9vvgh8RWvezDm+hz24S0EmwoKtJ7RXXBLuU/Oy/aE:/AB5iGhyR7PlRMlHVXXB6UD/aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741036, "uuid": "7059d991-9c42-4803-b68b-9d75a73eae38", "value": 970352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741036, "uuid": "2b11e49f-05bc-4f09-9640-6f41f3ed114e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741036, "uuid": "ea2f7d82-3bfe-4447-a91d-d7d324d021d0", "value": "Waybill Document 22700456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2d92bb-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709252, "uuid": "38843c4c-d034-4d13-a347-266a5c188172", "comment": "Malware payload (Dridex)", "value": "cfbb90545338e71ac66aca3712358ddb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709252, "uuid": "1ad009d2-82f8-4eed-ae9b-82097d2e10e2", "comment": "Malware payload (Dridex)", "value": "788a3461c634c8cc265db8bc2fa1a84c57ab613c4e257cff8ba4beb7fd2c84dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709252, "uuid": "e93ae0b0-0f8b-4856-a338-ad8ab35e99d6", "comment": "Malware payload (Dridex)", "value": "14e3e01319698b031a5dffa687fd8d0c8f17fcb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709252, "uuid": "beb26084-cf0e-4029-b368-69a9e8152e24", "comment": "Malware payload (Dridex)", "value": "085b95cfbcb3de849c691d483df714e4fa1adb3fb81a9373a1a2aeb3871ec14d8f300e339da944a11de33162d8457099", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709252, "uuid": "ab51e54d-d1f9-4a84-896e-79e3d02b52e5", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709252, "uuid": "472b4d89-661e-4674-b76a-d7b90721ef28", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709252, "uuid": "5d384940-7bac-4534-824c-6eec5ab8be29", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709252, "uuid": "6615200f-42e8-4c82-851b-eb91b6453b7f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709252, "uuid": "baa3b188-c271-4950-94fd-290151a0dca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709252, "uuid": "8dc30aae-19db-496c-b30d-f411cdeac6c8", "value": "cfbb9054_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33859490-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720136, "uuid": "919e5b04-e6b9-486c-b678-7f5ed9d3fb6d", "comment": "Malware payload (Dridex)", "value": "886a023e3dd8e32472328004fc952524", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720136, "uuid": "ff4d9b3b-0243-434c-8fc8-d3cb7e2d5d6e", "comment": "Malware payload (Dridex)", "value": "7894570be7af03b420ed41d789a8be3a760362bd1bed907b6179b3f52753c151", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720136, "uuid": "c4a74c25-cf4d-4159-a66f-f3047b3406a3", "comment": "Malware payload (Dridex)", "value": "453a2958074605ebb5c8d5dd0baf4e3fcb1a29b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720136, "uuid": "acce2601-41e2-4e64-bb50-29cb8aec3b75", "comment": "Malware payload (Dridex)", "value": "c7eecae913ec597e9e20817b1ef04e670f1e1055965fe54edcdb50eb0180949eb2125cdb74445f94ce7e7829734170ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720136, "uuid": "b0e59819-15f6-4807-9770-8dd125c6952b", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720136, "uuid": "d3dc3851-4c23-41e6-ba71-9208b79c1568", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720136, "uuid": "801a13b5-0898-4cd5-90a5-b69b6da242c3", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720136, "uuid": "1d0e30ac-2bd7-4d6f-8320-50be2391e0fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720136, "uuid": "912a24e4-68d1-4056-9f9d-a0ccf6f54905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720136, "uuid": "9f42ed1a-039c-4097-87b4-247f5fed6d9c", "value": "886a023e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aa3cf3-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691284, "uuid": "7af741be-0576-4466-812b-6b8c09be6f6a", "comment": "Malware payload (Dridex)", "value": "89dcdf68e1c3b6e9fe3d79efb1382ca9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691284, "uuid": "1d3a182b-67b0-4a5f-9c41-05b7df697a02", "comment": "Malware payload (Dridex)", "value": "79060ea894397448cc57c90ed1241057b748b38d957f9d05878de7755d99e430", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691284, "uuid": "159aec45-79b7-4610-bfe6-0a7f85e9820d", "comment": "Malware payload (Dridex)", "value": "54895519fcf48859ad1e181b87c1c2e91e855260", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691284, "uuid": "6dfa8e51-28a4-4e47-a542-c229d65a768e", "comment": "Malware payload (Dridex)", "value": "31ed2e08377d263267f836a8535c4c9ac98f555b3c276e5413f3fedfeba98af6fbd35fbdfd0b5ef1bb26f7953cec80c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691284, "uuid": "33f1d4b1-8b6e-492e-9561-21970249f67e", "value": "3DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691284, "uuid": "7c7d4b20-79ef-4146-ac2e-41a5367b62ef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691284, "uuid": "8a73a814-d3a3-4284-90d4-3436844a55eb", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691284, "uuid": "71da094b-eece-4279-aefd-71c252e4ab2b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691284, "uuid": "daf7d40b-5896-4610-bb7c-7519d3e6bfe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691284, "uuid": "f9d28611-2939-4cb0-b77c-ce43882af9c9", "value": "89dcdf68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e127e64d-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620715273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715273, "uuid": "7c47152c-bb43-491f-918e-9c9c38c8c0fa", "comment": "Malware payload (SnakeKeylogger)", "value": "b16b285ee5a98c037e4fd3b5b9fba21f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715273, "uuid": "2cf9b455-f0e7-4c21-ae07-320ad13ec796", "comment": "Malware payload (SnakeKeylogger)", "value": "790fc26d32c2d3e670089bcbe681756dec295cd2e0020b556f022d81e6b98aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715273, "uuid": "43c66bc4-9df7-41f9-9a1c-0d393ca72d93", "comment": "Malware payload (SnakeKeylogger)", "value": "e918c4be8b3854b679be0bbce4c1cddccd52e93b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715273, "uuid": "b3ff155e-1c71-4175-84cd-5579c64acd56", "comment": "Malware payload (SnakeKeylogger)", "value": "dd476bbb5843a791c75f6af7e8aae82d04920cdc71f639946a47635571d49a78e474b0133ef90585fc6a0b7ef9113b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715273, "uuid": "f850afd0-9092-45be-bcd6-4efc8abe379f", "value": "6EE28314EF9942BBDDBD4EB465F242421B74FAA66C72DE0FB9A00109CC276439D03B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715273, "uuid": "45c3e293-7d4c-442a-86a6-5202806acb31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715273, "uuid": "cabcf9d9-d1c9-4f3b-a78a-3d69c8540e5e", "value": "192:DrsA8kM80Cu5c5EnvXVxnsHw7P+zwTZOjAntKM:va8yc5EvTaW+zwTZOjAnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715273, "uuid": "e101cf2d-ec85-47dc-a6f7-45127b44a0cd", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715273, "uuid": "6fc048e8-e13c-4afa-b712-45e029598559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715273, "uuid": "a34f1c00-8e0b-42ca-8975-a0a6ed886f4f", "value": "Purchase Order 002393440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cb5d59-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717261, "uuid": "525732af-8964-49ea-9ec8-ebf968144547", "comment": "Malware payload", "value": "86ab74265ed0cac9e9978bb2d4d6efee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717261, "uuid": "a820d665-ab66-460a-bf70-ae43a9001628", "comment": "Malware payload", "value": "7914d06d514f8c689329368c3b1b3e792b8db7a316df17bc64c30c5c32ce55ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717261, "uuid": "887f8d9d-9603-41d7-b491-bef76aa475c0", "comment": "Malware payload", "value": "610d41d1d2a3ea72d18e81e142e0c76d4a41473c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717261, "uuid": "af2ca2e4-8564-4976-92e0-942da1e3cee2", "comment": "Malware payload", "value": "de0e8b16627422d4eb62b2ed0a54c55e0ae9dc22aba76c303cd34f09acb7bae31187555d77b1e3deeaf2837338840122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717261, "uuid": "6f0266e3-9a7c-4c4d-b06b-9fe2ef039238", "value": "4C82A4F89AEC55FAC52CF63683E0E00C5234ADB706009E1F55C531574CE2BC16AC2AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717261, "uuid": "10e206a0-d702-4666-a806-a3d32dd05997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717261, "uuid": "745c5d1e-5190-479e-ac55-c31d5929decc", "value": "384:MgTz3TDgaBPtlpJCDiYPb9T8A4BEvDlFxjLlLUJfl5rLyLUJfl49:Mg/3PFB5JCDtb9T89yvlGfl9eGfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717261, "uuid": "f269ba13-8442-41b8-92eb-429d442d0aeb", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717261, "uuid": "35ff4fae-f706-4963-8c86-448f6066451f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717261, "uuid": "01f251b4-72d0-4d97-957f-692cac18dd77", "value": "86ab74265ed0cac9e9978bb2d4d6efee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54920e85-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Adwind)", "timestamp": 1620741666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741666, "uuid": "21c68639-a63a-4af9-9d92-708f6f089744", "comment": "Malware payload (Adwind)", "value": "70605d0b7fb8476fc06526a7e3b88f79", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741666, "uuid": "7508bca3-a714-4e22-962c-3ea37434e72f", "comment": "Malware payload (Adwind)", "value": "79b658a1e069004182b8bb55eb1c18078e491e6d2449853278b53f7d81be860d", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741666, "uuid": "34f60653-ddba-4221-825c-de0f85b726e8", "comment": "Malware payload (Adwind)", "value": "f9b03fd58f8a44bf702e97b8698ce8bd718cdda5", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741666, "uuid": "46ab5f4d-88ec-4322-9c17-06d5cad89c3c", "comment": "Malware payload (Adwind)", "value": "b91fcef797bd251c284db0bbdb6d63d6102436cd2879d64d410ee15a7a71959844f155969395a783af7eb739d68bdcd2", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741666, "uuid": "38eb8a88-a04f-4fe5-960e-41f5a33e3648", "value": "3B4423E193A0FE4BE78889BE10255BA8FE46F1CA41532584E1346F95A2F3047778EDC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741666, "uuid": "ae760904-c919-4140-8f0e-9ba5dad25534", "value": "6144:gc9+sB+egwBHku9QYtuNY6avWzdAZOdQL1oUI/Ai8IU/ZJx7W+VS:gA1kdwBHnQXlavuAkdQxoUo0IU/Zb7Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741666, "uuid": "787ea164-f440-4d92-9476-1e32bbefad02", "value": 273818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741666, "uuid": "0c014d7c-f492-4645-9ff3-9d68c76a6cac", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741666, "uuid": "69fd6a45-2454-45cb-855e-ad3f3458101f", "value": "Liste477.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac932e72-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705736, "uuid": "e9520d42-14a7-4a52-a576-70ab27b9779f", "comment": "Malware payload (Dridex)", "value": "ef33c2f2cf8cdc072a3da9a74ccff789", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705736, "uuid": "253bf638-9d2b-4097-9b81-23ebe2a4047e", "comment": "Malware payload (Dridex)", "value": "79b90f5a24c61cd5860644f1505a5f38973bd10379b19dbdb4ace3cca329c620", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705736, "uuid": "7f1cd50a-e789-4487-ba16-438775bdec23", "comment": "Malware payload (Dridex)", "value": "fd843d808a35b4d1d343f6c7f3567ea5a5d7ef39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705736, "uuid": "ff402219-a3be-4ede-8444-1fbe98f78859", "comment": "Malware payload (Dridex)", "value": "877a545eaf7743dabefcac1b40a36e834de774e18b80c385694c93effc1889d1a3567c29f415f960d1e54ce4364916cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705736, "uuid": "3325bc87-f347-4d4a-a550-95ee63aae0aa", "value": "E5F3D0906A9BDF0ED9C13CF96AD6A879B173458D811FDAB4D0CE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705736, "uuid": "137ef297-cd09-47a2-a139-0b3cd2f05f89", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705736, "uuid": "b8e5c61f-6519-4936-b751-ee6a0e96710e", "value": "3072:lesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLpM:B4+VZQpt5hyPsa1ekiEKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705736, "uuid": "c54deb9a-117e-4ec8-b443-d1a83722e7e6", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705736, "uuid": "04258b61-07f4-41f1-8477-08a27013ed65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705736, "uuid": "347d8a36-635f-4831-82e8-737d7f9681a0", "value": "ef33c2f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c324d31-b299-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620765811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765811, "uuid": "f8a0108f-1aec-4204-a3fd-f83e4fd8a455", "comment": "Malware payload (AsyncRAT)", "value": "5dfa698be3649abe2f920e159b4d4b09", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765811, "uuid": "e2712390-844c-440c-8797-14df87600424", "comment": "Malware payload (AsyncRAT)", "value": "79d9bea7099298aba783ac8333e7fc8d0220f7436757ce681b3057614a57ab05", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765811, "uuid": "c4c07830-77db-4691-aa8a-b00619dc2c30", "comment": "Malware payload (AsyncRAT)", "value": "8dc192a77fa53f3faf4889e0d7836293deb559b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620765811, "uuid": "41cce53c-6f36-4d7b-adf0-cecf8ae54611", "comment": "Malware payload (AsyncRAT)", "value": "aff2dc32c29533bcb7030a233f5e178be2de942b5e9002669c0761068830758bf04be26232f19e14f876f74fba85d8f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765811, "uuid": "d688a72f-4482-46bb-ab10-30b100d294d8", "value": "81D44AFC750464F9D35B5C23A3CF1C1682251274AA3B6A0B9B2103BE5A5BD273E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765811, "uuid": "306b7f13-83a4-409e-b068-7e8ec6e8b085", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765811, "uuid": "69bdce2b-6173-4342-b19f-3f34b24d5df2", "value": "12288:YoLLoS60/K7yh0iIotTKCSuZlW7VcCOhXKQ6iZXS8ksGP32T:YoLAiIpP6W7xOVZ6eZGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620765811, "uuid": "e64ee2e8-8f50-4fc2-acfc-e059f6a07b6d", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620765811, "uuid": "8b432dba-3174-47bb-bd6c-282e3e1aad0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620765811, "uuid": "9f843ac6-3684-4435-95fc-afc1d9dc8f7e", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.9450.14249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db8f7de-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717066, "uuid": "dfc519c7-f0d4-4c85-957f-6f7a61f204c0", "comment": "Malware payload", "value": "98c830a57d54781fbecec90d6c30ba40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717066, "uuid": "8358b18e-d955-4c44-9abb-d5da485d0047", "comment": "Malware payload", "value": "7a622ec67b659ae974e535d8c0a089ccd942aec7e03faf3a7695afe02cac94bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717066, "uuid": "7f39609d-764f-47d7-931a-d893e2b5dec4", "comment": "Malware payload", "value": "530ed679a4ca78888669896a6ea27cd253e93046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717066, "uuid": "299caf07-0101-48f8-8a1b-13d1148b3b9e", "comment": "Malware payload", "value": "477824f1c75ec7c47853c79c2c956254fe81c7d61cb9f528a5fcc7e070e26efeaa8850c709ff4e328c2b0e9bb941e55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717066, "uuid": "a73c3e42-830c-4773-a959-61300c827091", "value": "C384DDD9BD888DC0D4B2F2F0E04A86A207A51D55E88C86CC4DF97DBA45754ABED1B03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717066, "uuid": "5c89f4d6-4a3d-48c0-82bb-ae8dd9e5f6c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717066, "uuid": "05915cfa-ee15-4274-aa5d-76cbd6bcdad3", "value": "1536:br2JT5aVn0ATrw3cfxEySVVfrK5c0o6y2IYRqH5c:enaV0ATrGcfHSVVzec0o6y2LRqZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717066, "uuid": "5599d3a6-0ac6-4e23-bb38-044fb772d66d", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717066, "uuid": "f0b5eaba-03d0-4770-9ed8-ded8891d6c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717066, "uuid": "d5653a97-91d0-49a3-a69e-34d3e5c3f94b", "value": "98c830a57d54781fbecec90d6c30ba40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2de488-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715374, "uuid": "c806dc7b-8f7a-4f49-93e6-e73856c1bfd5", "comment": "Malware payload (AgentTesla)", "value": "6e4f305af321fba8dcdea72583c4b057", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715374, "uuid": "04fa051d-2ba7-4c6e-b515-5a4fa296d244", "comment": "Malware payload (AgentTesla)", "value": "7a8e36ae559e57a2692eb06853f2824bf7fcd22a89ec8c039ac6d6223741e719", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715374, "uuid": "9f80c4ac-b1f3-4e38-a0f1-3c187a63dba4", "comment": "Malware payload (AgentTesla)", "value": "01c85e4bf31f97e6da5d15087a8c04a74419c606", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715374, "uuid": "cb5116c4-6549-4cbe-9e98-a400996e74e8", "comment": "Malware payload (AgentTesla)", "value": "b16b9624cbcd8399411fbb8a1361c11a74bdcc0eb840b0fcd7e6f46c65cc1a890074b5c689bd79857d687f1f8d016960", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715374, "uuid": "39256ecc-985d-43a1-815d-0bf8adf22508", "value": "8005220732E4A618F06E47FE5494245183F4B04A6732DBD97F0A44EDA8E7BC5CE52BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715374, "uuid": "9114e26e-7398-42ca-bfaf-602c57088bc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715374, "uuid": "a98ffaf5-7d8a-4ef5-a37c-0a30ef96b6f5", "value": "24576:L27kzXYEUaRa6UMHyvMHz64e82hLBMIct8:OkzXJRa6UP8ebLlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715374, "uuid": "acbff374-e522-4d52-84a6-eb3c1e296345", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715374, "uuid": "1868f580-1ee5-4e13-8b09-2065b6034fe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715374, "uuid": "919c9cce-7243-4d61-8366-391330af0495", "value": "Overdue Invoices scan copies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d2adce-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770501, "uuid": "a48ab26b-ab3b-4edd-af7a-21eb1dea29c0", "comment": "Malware payload", "value": "feb1392f907e1b6316bf720cf7ca8bdb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770501, "uuid": "d0566ac3-0e8c-4d8b-afd1-0a3484867eae", "comment": "Malware payload", "value": "7abd488118a56c186c482f92551edef7b62d6039ccd08df480e82373fd7719c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770501, "uuid": "1d44556a-84c2-42b7-b488-e28402215423", "comment": "Malware payload", "value": "c4ad357f643f9389edcd642159beb7dca8e790c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770501, "uuid": "e77661c2-630d-4ada-8d3c-7424853fff2f", "comment": "Malware payload", "value": "83e4ce87e3c5c557e99a10a9280b9987416899acb084617659769c1401ee97a207fb272f3050766de73b4ba498e45b72", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770501, "uuid": "33e7d9b7-8796-441b-b093-718cb47851db", "value": "49F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770501, "uuid": "4466ca3c-ad67-48a1-a1a9-02a2db77c953", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770501, "uuid": "eb5f54c3-ab2a-4db2-947e-26c7441116ed", "value": "3072:GWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:G42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770501, "uuid": "2b450a56-cd12-4b0d-8709-2a2c6f577a16", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770501, "uuid": "d1b7775a-3173-47d6-ace1-fd040ff29494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770501, "uuid": "27dd38df-73b8-414a-ae26-8031b27a3044", "value": "feb1392f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb415dbf-b233-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620722189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722189, "uuid": "ce41f2f8-a7de-4df9-8d29-b69889579143", "comment": "Malware payload (Dridex)", "value": "ba04e44ca1112d18386d8914b98b85c2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722189, "uuid": "f04a4f92-2b29-477e-b43e-d82105bea635", "comment": "Malware payload (Dridex)", "value": "7ae003d188ae623bc130ac62cea89c3e3d351afaa55e9512b859c944159f38a2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722189, "uuid": "b1c798b9-33ef-4d95-9512-8030a041f05c", "comment": "Malware payload (Dridex)", "value": "9e81d6b0d084a8a07fff562087ef341a87cc3a7f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722189, "uuid": "f8bc9914-9187-474c-9466-5279a374e3de", "comment": "Malware payload (Dridex)", "value": "544a97872526e4f6b4e6ed9f0825b39d0d0d2776df99bebcab62ba6d011a561bd229492db8d94df8404fce3c4ed087fd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722189, "uuid": "53a96d37-0548-4b73-8aaa-41eb894816f2", "value": "E2F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722189, "uuid": "ea772453-557e-4227-b3ad-f9e42b69b1e5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722189, "uuid": "8eb007fc-2dec-4b9e-b3b2-69ee6e9e71ec", "value": "3072:XWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:X42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620722189, "uuid": "57cb3350-d28c-4dff-ae69-f2533fafa293", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620722189, "uuid": "a22b74f7-e372-40fe-8e6d-91b301e3dc83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722189, "uuid": "aee203a1-4786-45bb-bc0e-500cc2cd4424", "value": "7ae003d188ae623bc130ac62cea89c3e3d351afaa55e9512b859c944159f38a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12bb780-b221-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620714307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714307, "uuid": "e43b3fad-779b-490e-88fc-4a075b6d2dc8", "comment": "Malware payload (STRRAT)", "value": "3025deb4a8f51cc463b3784961b00b9d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714307, "uuid": "5ab38275-581a-4ea6-b98e-45ad675e2204", "comment": "Malware payload (STRRAT)", "value": "7b252e149c75956c0f103a1b019aee20004e8c5b8ec5011becc283aca581507a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714307, "uuid": "24e03a9b-1075-4cd7-a578-208636e7f3da", "comment": "Malware payload (STRRAT)", "value": "693fcc0e8c4ce1a62d79ed490e8cbdfbb52d3346", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714307, "uuid": "e3951949-e90e-4dd8-8ade-504167b9f221", "comment": "Malware payload (STRRAT)", "value": "d8f31f03bb1aaceae94b0cf250e9f0ce302e979cedd766a37ff4417b1a9d2e8d8c7d4e64cebe643912f9cffbbb38dd6b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714307, "uuid": "1313b202-8cfa-4aa8-a9cf-116837178493", "value": "ABC3122456767A29C1BC09F50C06745FA9F7D40C6B623BCBB7CED0837C4B2A9C9469A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714307, "uuid": "6f52feac-c5fd-4c38-bea0-bc59fe58a295", "value": "3072:JuK2QE9nNXrn0X/aU1YEkyTK4eukvBtj8JaiWgGcXl1487VG+iSPrP:Ten10XSU1Y6TK4WBilWglXoCPrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714307, "uuid": "f307c480-ba26-4a75-ad2c-737f7e8ad06a", "value": 121806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714307, "uuid": "72fc9201-fe92-470a-9406-9dbfea919e87", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714307, "uuid": "3d34dc26-5516-4c85-b76c-a44d917130f8", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884caf2b-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715983, "uuid": "7e2bd85e-82dc-4b71-8555-d0d2822fd357", "comment": "Malware payload (AgentTesla)", "value": "247070104c9108ba8a07c7e03973c658", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715983, "uuid": "d44831e2-ddd9-4076-9016-46077fe7d30d", "comment": "Malware payload (AgentTesla)", "value": "7b268ec1b9c913c9ef94a925343053f20d055457aa719d8e18dcace35e3e097b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715983, "uuid": "f61ef905-8e06-4fd8-aa18-22f77bee7442", "comment": "Malware payload (AgentTesla)", "value": "fdb90c04896d90b5c360033a97eab115a041378c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715983, "uuid": "118b5113-1162-4cb7-bce1-933f6bfa45d3", "comment": "Malware payload (AgentTesla)", "value": "edb401fdd9c92460648dda5b5ae405852477e74a83e63c2eae224582216d2246fe118408527811079c0e233e9f8e121c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715983, "uuid": "b1620b4d-d45d-49fd-8f15-f99773322e62", "value": "98F47CEC751464F9E35B5C23A3CF1C0682241270A93F6A0B9B6113BE5A5BE173E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715983, "uuid": "f4b9b3aa-dd6b-4c8b-96a0-a56234a6439a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715983, "uuid": "9a0a3ebc-aaa0-4261-8ef3-750b565834a6", "value": "12288:9oLLoS60/K7yh0rYTaV97mMAeNCyUj6PdtdmMA3ARADnOtA3LMLzjstScctbat:9oLArsaLJ8fj61tDMAWftScc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715983, "uuid": "10f6ba64-52cb-4c81-8f88-4029ff3924f8", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715983, "uuid": "6005c498-b0b7-4230-b7cb-dd2ce9d68828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715983, "uuid": "67da07a4-6662-4cd0-822f-0e5fecd41166", "value": "Factura comercial................................pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fe2c5b-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715385, "uuid": "e6d9189d-e1fe-4abe-9c81-505da17916d4", "comment": "Malware payload", "value": "2f8acdd2e0c5501f27be96ed29a090eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715385, "uuid": "1410d607-eafe-4ab1-a914-50dfe4d999fa", "comment": "Malware payload", "value": "7b3395c594789515c3f42e558478069d709ae415f988419364c82bc502bc3278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715385, "uuid": "9b10e297-746a-47f7-9ea3-1241f7fa73df", "comment": "Malware payload", "value": "caee54e77888687c654c0b89daf24c7a2e7b94fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715385, "uuid": "6ce89d8f-86cd-4fe6-b6c2-e0cdefd4c2a8", "comment": "Malware payload", "value": "b96826c7c129d9d13851f9c3c5d4e0832043ca63f5c2a08fca46464d33d9c32d0f1edd0f9cda5b89ccb83a1cb3c650dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715385, "uuid": "3368964a-d1ae-4fdf-a57f-62416e454464", "value": "1365E0BCB55468F0D34B5C23A3CF1C1782651274B93B6A0A9B6003BE5A57E273E39D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715385, "uuid": "95ae9d39-c3f1-420a-b87a-5f93f252bdb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715385, "uuid": "6342ad9c-1ce2-405a-a116-aee8f3bf93c7", "value": "24576:1oLAGOlrsPlH0TNQZyyc6r3A63B1/sgMIV6RYpipNqZE8Of6/aJ:YOZseNgy9y10gMI8Rv8ZVOeaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715385, "uuid": "1dfdca29-8d87-41bb-9886-b08a3bae5844", "value": 1524224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715385, "uuid": "e63a463a-eb5e-4b5d-9dcc-f20382850f3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715385, "uuid": "8cc3c59d-5acb-4b33-9354-ffe5f4eacfaf", "value": "please find attached the receipt of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713681d8-b254-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620736131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736131, "uuid": "bb057414-e44d-4cf9-9875-281fe0455365", "comment": "Malware payload (AgentTesla)", "value": "295b078a224bfe38d0a8fed921ed744e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736131, "uuid": "aceadb16-fa93-4698-955e-04281a363f93", "comment": "Malware payload (AgentTesla)", "value": "7bc6a25d60011a784a488b24aef18f3352edacc5a9b81ce5f2410e9c4448e208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736131, "uuid": "f34c24aa-8edc-4003-9383-1dc432056b6f", "comment": "Malware payload (AgentTesla)", "value": "e053703028052259eeb6f7aab186500d93898ba0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736131, "uuid": "8fc00f7d-4850-4d5f-a6cd-93cbd5098b58", "comment": "Malware payload (AgentTesla)", "value": "e228d90b70c894bb6efd6001f87fa38b9071925125cf866ab2c8133519e7c43d5ac7c295f42f2595cc587e3ceda61253", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736131, "uuid": "1c449802-d4e7-40cf-a806-c8741b06af2c", "value": "A425023433681FA3E27EA77C9465218403F8A51AF722E69CBD9834CE6811F818773F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736131, "uuid": "4c45532f-5d8e-46ef-8485-a0a1f9603044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736131, "uuid": "2cf81ec5-638e-482f-8130-df8e8cc68982", "value": "24576:26Q/9K3tKFW57FY/UEO1NqOV3tZjLaFrMU:2S3tKW1NVDjLaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620736131, "uuid": "ea6619d6-fd59-45c7-9d9a-c3b633c195a0", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620736131, "uuid": "c8bef892-8358-4ea7-b7dc-8d88bcc8064d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736131, "uuid": "b997f279-449e-4ff0-9329-5a7e70b88d4d", "value": "HSBC payment advice EGHKEB0C01725410-T02-pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce1bd7b-b249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731238, "uuid": "093d5162-4d87-49bb-a388-dc172aa0461f", "comment": "Malware payload (Dridex)", "value": "a9d72a4724769d51db73a7f10e388e84", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731238, "uuid": "ec557a08-ea35-4be2-a615-b269b9fcaae6", "comment": "Malware payload (Dridex)", "value": "7c816f35173c65d6ea431eeaeed89bb328e3e7b543c877c1c278d00bf394f839", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731238, "uuid": "2727fedf-fbbe-4f7f-84cc-9fb6506d433a", "comment": "Malware payload (Dridex)", "value": "1b0da41b7c7f18412763ca1a9da26af3eecb3ce2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731238, "uuid": "f52cebeb-41a7-42cb-a355-4102a585a530", "comment": "Malware payload (Dridex)", "value": "4076749444e154ba34b3862a69e09a9f3a991f4b0e4ecbe9fe2144506c8d8ad7d436a7cf4fcbc8cfca42899245ff6435", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731238, "uuid": "b02b3ac2-8504-44d0-9170-412d64ddb58d", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731238, "uuid": "b437087b-609d-4147-98b1-5f51dd798149", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731238, "uuid": "43fddb89-72b3-4c3b-a18c-86c336b3671c", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731238, "uuid": "4bfb76b2-565e-4840-9c93-e5842556b749", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731238, "uuid": "acf5555f-6084-4a9f-a0c1-ca7c338676dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731238, "uuid": "2a91f5bb-a9c4-4bfd-96f0-9a8fe2b4b90e", "value": "a9d72a47_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3442dfb-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620712163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712163, "uuid": "43e220f3-ae3c-4d0f-8a69-99e7efc86f6a", "comment": "Malware payload", "value": "d50fac66bfaec232a5a6abfda15dc717", "object_relation": "md5", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712163, "uuid": "80cd9142-0866-498b-8bcd-8942c4d281bb", "comment": "Malware payload", "value": "7d531c8cc064bb1f9e7de49bf9c3b4d2119e8e36306240f460e351af07263a6f", "object_relation": "sha256", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712163, "uuid": "e65de75e-aa5f-4ca7-b66c-1f533a2bb0a4", "comment": "Malware payload", "value": "edbabb1b83eeb2c350a0a0d03165b5f78b52a905", "object_relation": "sha1", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712163, "uuid": "8b290f23-7f7a-4f6f-974a-f387d8016844", "comment": "Malware payload", "value": "470e03a49b846ef862a3f1360b7a3dbc8823c58cf48e23a6da765ee4d2cc40709dd5fdf66bfceadfa86380c73041f70e", "object_relation": "sha3-384", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712163, "uuid": "d691f529-ed41-42bf-88e9-7d564f439df6", "value": "90358D68719065E1D32B5E726BCBDC3143122E746426E50E8BD03FFB3967F13293998A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712163, "uuid": "1e790c81-436c-43d2-81e1-945aecd4bb9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712163, "uuid": "0a756840-9bab-4549-ae1e-d951aa0b7156", "value": "24576:0lSBqooLAixa1RPI4o7yDmf3a7urMfT4zjA8++++4+++++++0+++++++:09xa1OemyuM4Xh++++4+++++++0++++6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712163, "uuid": "8d7cbe86-15d1-436e-b1f8-a87b41c822b3", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712163, "uuid": "e119791c-65a6-4461-816d-7889d62339ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712163, "uuid": "0d5b563e-51a7-4edf-a6d6-79c8b6e83f0a", "value": "Ningbo-Bank Details.exe.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0428fd78-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691280, "uuid": "d2474e5b-ac56-4d3b-9e10-cd781baaa2e2", "comment": "Malware payload (Dridex)", "value": "486b27eb0f877e173d43f905178dd60f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691280, "uuid": "cc261e05-99fa-4535-92d8-d3990da57afc", "comment": "Malware payload (Dridex)", "value": "7d84ba28f2d4b8261e06f36c4c1ea61a752f95f8e879b89a508d639a930fd941", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691280, "uuid": "4fca2880-11bb-43a4-bdfc-70f7b62eff59", "comment": "Malware payload (Dridex)", "value": "ad877b340a1a632b5712dc2faf724e31e1867812", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691280, "uuid": "aa1d1324-0251-4f21-8fb0-54e249ef98c4", "comment": "Malware payload (Dridex)", "value": "5d7c69eb2aeb93305c59743244b1d0f910f25d7b8071f58d73fbbc023109431f076d8cb320735e3cbe7db5be2f946551", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691280, "uuid": "b8a34b7b-69ab-4d90-8d0c-6998ea634214", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691280, "uuid": "f74cb084-e881-41c0-bdab-5fcf84c970b9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691280, "uuid": "87d435b8-a889-4f0d-bda7-3a472d575780", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691280, "uuid": "f7480e0b-7241-4389-bc0d-726dbc9e55bd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691280, "uuid": "607f62ca-c952-4c80-b52c-502cee3035ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691280, "uuid": "78fd6427-d0d6-414c-8f74-c946d44eadcd", "value": "486b27eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c11b4d-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620727523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727523, "uuid": "50c7cc34-806b-4bd9-8cae-5829d5b02392", "comment": "Malware payload (Dridex)", "value": "8e757edfcdca9321c7368bfd9c9d9cf6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727523, "uuid": "dedfdc45-4259-46f5-b519-32a07c083d54", "comment": "Malware payload (Dridex)", "value": "7dfda1ec78c20a4b1112c2e59cb0d97d724c7df91dfcbfa8ecfe749ed20a50ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727523, "uuid": "6d1a8655-17db-4c21-8b4f-7163242585cc", "comment": "Malware payload (Dridex)", "value": "f5ef3b1b0a6b0235ff53c45b55a5b61afeefa994", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727523, "uuid": "e5a133e6-f6de-416c-9c60-7181bdef2d5e", "comment": "Malware payload (Dridex)", "value": "690919d58f6f7891551d34ca75bfaa9a76a87be28db3c039751e748da8a590d816593c6d6a37f7b76c01be0b6983b663", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727523, "uuid": "2226ca47-c221-4a94-92f9-3645133b5cd0", "value": "46F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727523, "uuid": "3c90e035-2254-43bf-b515-e7af8c0da46d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727523, "uuid": "84272497-6657-4109-8b04-c29ddac21efc", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727523, "uuid": "a1baabd0-4abc-4eb9-a3fe-f1ab9a31305c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727523, "uuid": "e3dbf8b5-3ac4-420e-b318-2c33fc4f3035", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727523, "uuid": "f91f2474-520d-4b5e-b71f-18063efa59a4", "value": "8e757edf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804d49a2-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694924, "uuid": "1b200458-0ce6-469a-9dee-fa629794b429", "comment": "Malware payload (Dridex)", "value": "3a8381e98c1336a183e3f92995f5c1ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694924, "uuid": "eb0e7ff8-156e-405e-82a2-e0ccddbbe0a6", "comment": "Malware payload (Dridex)", "value": "7e47eb0bfd91e408a74f257f2971e47a6fdc0e018753ca95029da8ed56a84340", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694924, "uuid": "e72f14d8-71ff-4ad8-9909-3cefb65459ba", "comment": "Malware payload (Dridex)", "value": "bc14027f824f9c45fad34f95f8798895d496a24d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694924, "uuid": "a6c239da-5d20-4d66-834e-b4ca3a329039", "comment": "Malware payload (Dridex)", "value": "452fd2515338780752872944caa6a282a927456bccafc29417a5d498a39f7ec268bf86f5cd060b24650f57af4985fb28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694924, "uuid": "ad2339ff-0e35-40cd-ac74-e918c133428c", "value": "C9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694924, "uuid": "4b17eea2-c424-410e-a2da-6a11f59313f4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694924, "uuid": "fc87e8c9-e502-4f73-9e16-51e0fc5aac20", "value": "3072:8lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:8lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694924, "uuid": "26a30158-91b8-4083-80e1-6ed8c1af7c19", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694924, "uuid": "0ff493cf-0beb-4194-9df0-5d6246d54b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694924, "uuid": "ff043b79-4ea4-4a0b-aff5-b61eca2c3de2", "value": "3a8381e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa22b52-b233-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620722188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722188, "uuid": "1d1396e0-06bf-455d-b712-f4da48f63f84", "comment": "Malware payload (Dridex)", "value": "4ab23ac085cd8bba9e92c4d16907944a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722188, "uuid": "2de56bd5-e603-425f-854b-299966377ba2", "comment": "Malware payload (Dridex)", "value": "7e4ac63a9585d7aff1231b9e4fc0c7d6d37b5ef30521d6629b75fa20df361329", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722188, "uuid": "4952ba43-c294-43e8-a061-15df6f1b4dd1", "comment": "Malware payload (Dridex)", "value": "b9fcd5b7a26988acfae7f530ef924ea4f6d6af07", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722188, "uuid": "9bb094bc-c846-4732-95c6-3a997f3cd010", "comment": "Malware payload (Dridex)", "value": "524aeb0d2ed8bc57e3a3670617d989082d1e297e1ee9f9f32d3d57abb90b38218ed18cf31350bcf18a7278712fe435ac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722188, "uuid": "e7f04b4d-591c-43c1-8243-ee9e8885b74d", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722188, "uuid": "ca8fe619-7785-4f92-a981-d6075c78352d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722188, "uuid": "e53e5509-a14d-4bb5-b396-72122c02b107", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620722188, "uuid": "44db74c7-aae3-432e-a9c2-2a3fe87095d6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620722188, "uuid": "7a152900-88f2-4161-816a-0b235b762137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722188, "uuid": "a86fc7c4-57da-4d68-b0a8-cb48b6d30cb0", "value": "7e4ac63a9585d7aff1231b9e4fc0c7d6d37b5ef30521d6629b75fa20df361329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d66e00-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712949, "uuid": "e77d9706-68dd-4bd8-a42f-f728d896375c", "comment": "Malware payload (Dridex)", "value": "69be6df3e8d978a6ba417e73768798d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712949, "uuid": "62524608-43aa-4d98-8ac7-dd3e0567c743", "comment": "Malware payload (Dridex)", "value": "7ed46a15a3281b773c8e15d8b08b62adcc0d2ebf58f8913fe67150384b35253f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712949, "uuid": "ed9f5b76-d14a-4567-a49f-3dee8b065622", "comment": "Malware payload (Dridex)", "value": "ae469f0265d0638feca49c0c1fc1c572c5e89f6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712949, "uuid": "fc3471f7-dac2-4516-af88-856c735eb2c1", "comment": "Malware payload (Dridex)", "value": "d7341726176e8227532261be0717255085f283623a6f927c9e4fe39133ada694ebf06512cc12ec9aba856fc3b3ca74dc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712949, "uuid": "5da4a1e6-6b19-4bb4-b545-80b69f34a0fe", "value": "56F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712949, "uuid": "798bf7c2-4c23-4fdf-b463-78b403a5200f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712949, "uuid": "e7000768-e171-49b2-996e-9426ea31a533", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712949, "uuid": "dd1e8b2a-6d92-444f-8297-17c56140430a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712949, "uuid": "5c6e632c-8f8d-47ef-a226-47708b45631c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712949, "uuid": "9eacd6ab-559c-4549-9ca6-c38a95777234", "value": "69be6df3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a578587-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705705, "uuid": "6238a7c5-970d-4834-9712-3b5361ed54cf", "comment": "Malware payload (Dridex)", "value": "13db60cf5c337d15e3fccefb1fc6361b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705705, "uuid": "d97549ff-0193-42de-8991-01890103266c", "comment": "Malware payload (Dridex)", "value": "7ee8ac006fee2a8253b917e56317d217e53afd26e655d47bd454b0bb9d9dd325", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705705, "uuid": "86473619-f36b-4f04-b892-4edc38d9610a", "comment": "Malware payload (Dridex)", "value": "ce603d8f6f49dc126b65631397fd1c6e7985fb7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705705, "uuid": "7eb3e189-ebd6-4966-acab-9c72db015be0", "comment": "Malware payload (Dridex)", "value": "822ae58762b6768b75b5ae734ad97176c307eb3017eb967c3ae7c0817a3301f975ee73486714d764f8286899361e0f68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705705, "uuid": "6f602c29-094a-4e11-b567-256f91b4127a", "value": "B8F3D0906A9BDF0ED9C13CF96A96A879B173458C821FD5B4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705705, "uuid": "25ce0262-1490-459f-9636-e5cfebafc93b", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705705, "uuid": "fd90d4ff-49bd-4ee4-9e40-b5aa0697658b", "value": "3072:9esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLUO:J4+VZQpt5hyPsa1ekiEnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705705, "uuid": "45bf5a6a-df59-413b-b545-7dc32c2400e3", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705705, "uuid": "991ee293-51cf-4206-8977-4d3531ec1824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705705, "uuid": "d2e7805e-01ee-4775-ba84-ee7691e969c9", "value": "13db60cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ef1736-b239-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620724587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724587, "uuid": "2c999ef8-6857-4f74-82c3-ba7ca13ee51c", "comment": "Malware payload (AgentTesla)", "value": "551959b052a519efe0423cabf7d929aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724587, "uuid": "c57758e7-e3b5-4d3a-b54f-ecdfdd25de79", "comment": "Malware payload (AgentTesla)", "value": "7f046625d94dd2d644426aa367b9dd655094a6eeb17a71554a8aa485ea74d6be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724587, "uuid": "2c26be70-d90a-44b8-8389-9e76ca9bd9a3", "comment": "Malware payload (AgentTesla)", "value": "49f73dedd4798c7932e16ecaefb5a4c05a44c012", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724587, "uuid": "c41cab97-9296-4c64-85c1-ca0dcbf21cdc", "comment": "Malware payload (AgentTesla)", "value": "b25bebb0eca84178f30b52410b98c0d8588cc6595f1c3b3bb61c1bc0a6e362620d4e7624807499b64259ace45bf398f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724587, "uuid": "0d8b61cf-15b3-4d18-a8b3-56f4ed436ab2", "value": "E7D4E02C3AE89A45E6BE57BC90B1122047F9B5176917FB5D4FA030FC2C77320DA11A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724587, "uuid": "1a074a57-4b9c-4d05-8e48-eca49dcfe06b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724587, "uuid": "e9a6c3d8-7273-4d8f-8519-12415e7d1012", "value": "12288:QqfO8AjDCO7qSfN3UiOCgEDKSVb5m6AWzSbZEC8f7PQdrRsWUgU:AFLN3ohEVVb5m6QB8jPQrRZUgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724587, "uuid": "6dfec763-c91a-4ec0-8f8f-23bae85a5cdc", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724587, "uuid": "9341b4ea-7f12-4611-bd1b-4ec320d14823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724587, "uuid": "1deea4ae-da76-4dac-b072-540c14f94492", "value": "Required Purchase Order refe 73892000181901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba0733e-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716418, "uuid": "ea64e34a-e097-44df-9efa-db2a2d2d30b1", "comment": "Malware payload (AgentTesla)", "value": "af8570c9aa16ae96f3c07bd869a3b959", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716418, "uuid": "67094304-3b79-4525-8b7f-f8dd00831c3d", "comment": "Malware payload (AgentTesla)", "value": "7f5c98e2ea25f0b9664eacbcf9387734ee409386a95b4b15cbed16a3fa5171e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716418, "uuid": "a50ee919-621e-46f5-a24c-3d743b08d205", "comment": "Malware payload (AgentTesla)", "value": "8e17a4152827ca4ab16ce6534a70eca771667235", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716418, "uuid": "9c4437b7-efa0-40fd-a58f-c74c8eb4d679", "comment": "Malware payload (AgentTesla)", "value": "adb7beac32ceb432ffd9cbe79d6e1ea473e65540188d29f1e63aa63364433379b80191c47b5273b1a6937e461b4a487d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716418, "uuid": "36ae8711-803d-42c7-bfe4-4e839fcec9b7", "value": "DC05230722E89B0CC0BE7F7542521A1116F5F406CA29EADDBE4424ECACE77E5C346BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716418, "uuid": "fb313acd-2965-4d32-acc6-68481f2ee50d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716418, "uuid": "ff6ef530-76fc-41aa-bbe8-78618d4b7ce9", "value": "24576:/mNuudDrrZsKw/D9vDd5T6M0t+2AxiYuMC:/mNaKw/Jz6fErxlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716418, "uuid": "e3c7de35-7961-4dc9-8e15-fb55ddfc2361", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716418, "uuid": "c26e4478-e8d6-458d-b661-99ed32bc0d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716418, "uuid": "11371852-5f4c-4e81-b339-45da83ce42bb", "value": "SEFCD_20210510_082736 OVERSEAS IMPORT QUOTE REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6061e55c-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620727512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727512, "uuid": "23f3bc4e-8879-43e4-bc26-a05ea0091f8b", "comment": "Malware payload (Loki)", "value": "5c67d88f6e0d9a814ca812637c2355df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727512, "uuid": "217ea143-4630-4467-9605-b8be25118acb", "comment": "Malware payload (Loki)", "value": "7fe3cf53819cc62bd4c5812de2db482e05c0a77fbfb42413863c4967596458df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727512, "uuid": "820316c1-b399-40e2-ade4-30210c5c3d3e", "comment": "Malware payload (Loki)", "value": "2cbc7f5c8dbe68e94755ffa33b3d53d7f0e2c439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727512, "uuid": "14049006-3acc-4d3e-a8e8-18f6ad36f51b", "comment": "Malware payload (Loki)", "value": "509b7229818d14d979ec7373877f8ec8123868c5269f8f3644de3b8b40371bd7841891476a817e8a0dc69722d5bca701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727512, "uuid": "fb981b37-61c0-48ea-9b66-0ec00465d14b", "value": "FD05F13532A8AFE1EA3ED77D1860005893F5A90AE321E75E7DE805DE0865F818773F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727512, "uuid": "84337d54-5025-4952-bf0f-4eee3bbb05c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727512, "uuid": "cbad546d-c6fc-4383-8f81-017140ba58fd", "value": "12288:uoaj+fEz44OVOda/eXlZFT0DmBrWCDr4KjHThUibimq32M3WA9rhFJ4COk3rKmeE:uIKvh6N3dfFJ4COZ+xr9/JRBhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727512, "uuid": "d0a4f99c-9269-4b42-a2e5-8b8a3f765555", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727512, "uuid": "22f44499-df24-40b0-9c56-65a5ec0dfdbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727512, "uuid": "428d6bf9-cd96-49cd-85fd-0d1a08350e20", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1aecdd-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735832, "uuid": "0793bf06-2e4f-40d4-beb1-5b5613333750", "comment": "Malware payload (AgentTesla)", "value": "3c054d423412a05d9ecf037c6220ef86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735832, "uuid": "4f853f41-db65-4b8e-af2f-ee14a306c14a", "comment": "Malware payload (AgentTesla)", "value": "804879b5f78a4dfc5ecda6c01e3ff45f487785d73cb70dfce4f46e35f639db3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735832, "uuid": "6f750761-1b54-4647-b118-28bb03ab07aa", "comment": "Malware payload (AgentTesla)", "value": "cbeaca0e5d6d4005e471fb8f3fc8e3228ac924ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735832, "uuid": "5abf4564-97ca-4afe-893b-78312d24ae0d", "comment": "Malware payload (AgentTesla)", "value": "34378d233c87c0f21effe840734093d1f933c4e9dd9db4297e8bc4c53fee786a56b19c09b492e3c23e78af51b3f72b8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735832, "uuid": "861d6b6c-769b-43af-a3f2-6781eb9e4dca", "value": "390523661A33B458BEE018D6CD3047338E6A4FE3C4645E645FB4A390AFBE61912739D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735832, "uuid": "73684a5e-20a1-4a68-a6b5-41ce9c9f6c1e", "value": "24576:RS/YX9YB67T0jPbeMfcP4BvSubfhL2LIE6:RSQR7SFe2SyAsE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735832, "uuid": "b55109f4-b251-43eb-a5e8-6036b8da67ea", "value": 825178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735832, "uuid": "e5a71b82-c278-48ed-8bed-b1b72d18d9d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735832, "uuid": "eb30883c-1fb1-485b-8551-d0e978ba5cb8", "value": "Swift Copy.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234d27ce-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620714955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714955, "uuid": "d638c9b8-6e97-4570-b5bb-3727b1b7051b", "comment": "Malware payload (NanoCore)", "value": "f5a572c1cff5536bef9519979cf2ac9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714955, "uuid": "d25fdeb5-e9e5-4bbe-9e59-a98c17f51edf", "comment": "Malware payload (NanoCore)", "value": "809faef964e5b1e958fadd4f04781f8f02795a0836fb8e2cda60a7f369ecd6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714955, "uuid": "1eb198ab-6f86-4ab9-8b46-1f72f08567d8", "comment": "Malware payload (NanoCore)", "value": "8c3b72b66d2afb2a0cf9921948ad28519ad38d42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714955, "uuid": "494f9944-5f2c-4335-9fb0-cecd676f402c", "comment": "Malware payload (NanoCore)", "value": "212c7d5112ab28a4caf1671ee0d8bc315b0d6699110efcfc70169dda1d327db688ad094a960cb7ca59daadd5ed23aff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714955, "uuid": "cc2dc916-8058-466e-a0c7-bae29e31353d", "value": "3A35AD2262988924D57B63748162C53947F67E13E672D31DAEE87CDB3B332C0DA67213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714955, "uuid": "f4b72d6d-6657-4647-9da4-94e56366de14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714955, "uuid": "24e2301c-0213-4e5e-a8b0-28a8e84279c7", "value": "12288:+EyNh/9no1/GKD1cyXmG444Dl2lRmAifuAxzpIx2o1MoM:+rQ/pZcO47D4PmtnKL1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714955, "uuid": "e50b1f79-4c9b-41c2-849c-09d1b967d757", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714955, "uuid": "fc089eee-93c7-4258-91bb-43c3ae36a804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714955, "uuid": "a4a277d7-0d3f-44c8-804f-c7806e43b684", "value": "f5a572c1cff5536bef9519979cf2ac9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f39e11-b241-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620728086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728086, "uuid": "adc15cc5-fef6-48ff-b119-96755cb1494e", "comment": "Malware payload (Formbook)", "value": "141631f69786dc0c8dab76a0d46c08df", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728086, "uuid": "1607887d-40a4-4e37-a655-4ad71d56f760", "comment": "Malware payload (Formbook)", "value": "811e72ee55befef366b4235c604f107aad70c9eee031c15514a663efabdf2b8a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728086, "uuid": "5d629a38-0f56-46c9-ad03-d1d27f87cd2c", "comment": "Malware payload (Formbook)", "value": "d7f57c25f8cfcd8668627b6e59c811bd0a55773c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728086, "uuid": "7b9cad46-a1fb-4c1e-b428-f903ce9a74dc", "comment": "Malware payload (Formbook)", "value": "22322eb3f4e2a5ea6e230e9d90b96c16937badedf9b3ce82f9f9f2011a81d017f10e5adbb63b9af33ebd4dd577544e9a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728086, "uuid": "5237d357-9fd5-4c1a-991e-76bdae8961ae", "value": "98D4DF21234CAFA4E17EA73D9071011493F5F41BE33ADA5DFD9900DD79A6F428A62B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728086, "uuid": "35dae0c1-e328-41e5-9806-0c326cbd1c59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728086, "uuid": "ffd45f80-600a-42d2-a788-827593ce927e", "value": "12288:ANh651N5U/jyUVHMVgms1UyesE6sQav9NMHjzFs:TeeoHM01TeZpFe/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728086, "uuid": "c173c85d-a9da-43d2-b15e-61b1ca6a00a1", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728086, "uuid": "f6b5186c-0c6f-4a51-8edb-f05c6ce38a99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728086, "uuid": "bf661ec7-e319-41c1-93cb-bbdfde53f071", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dd6279-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712575, "uuid": "69aab162-7866-46fa-8981-4657189a928e", "comment": "Malware payload (AgentTesla)", "value": "05f276b29a8b43b0671885d03674bb63", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712575, "uuid": "af67e5a7-c3d6-405b-b077-7d64422c68e3", "comment": "Malware payload (AgentTesla)", "value": "8141f594eaad598e051418a59ce165a9fdf2bd3fb4f446a0db0dd14b88c615c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712575, "uuid": "86ff6577-5c06-4614-860d-14d3e1b74584", "comment": "Malware payload (AgentTesla)", "value": "4d78e7335c87c8f29abdf05681e51a54b867789a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712575, "uuid": "a9299068-c4e8-4240-82f0-f8409bd3e8a3", "comment": "Malware payload (AgentTesla)", "value": "4995e22795c1b620968087680dbcc7c11d2daf6e1ab8192891e2e1f583d962321721fdb007b18b2ba254b3f901967018", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712575, "uuid": "e6feef98-5823-4a42-8e9d-df68ec3c1426", "value": "4AF423B05CF3452D6854121EAA6CE7207850E92CC6EA0EF55DB7531AAF7918C43CBFA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712575, "uuid": "15bf9b69-de40-460f-92e0-90c8261b7649", "value": "12288:0RJvsNJWtpOh5SPZLjdt42i/ujtTDDoHgoRktf7+D6umh+D2PR0PN5jh12:Owh5SRnw2I8d9aktj6mh1R0PVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712575, "uuid": "682c4ef2-4aee-4d26-8d32-abe4816655e6", "value": 792780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712575, "uuid": "a3c858cc-1ba9-4df5-a786-ed665ed7ec17", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712575, "uuid": "db7fff2a-270b-4fd4-8486-c623316b96e5", "value": "Request for Quotation-4505527156.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53cb445-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709267, "uuid": "40042a4e-9ad7-4a80-9654-eb3b7e3dd25d", "comment": "Malware payload (Dridex)", "value": "03844db8282ea1dadc1b3f05b64c7989", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709267, "uuid": "c105ae1b-eef4-46a1-b542-9adc628b3868", "comment": "Malware payload (Dridex)", "value": "8171a0e98205681a48f671db474e5cfaeea9abb61c879af51c24aee2e14fb92c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709267, "uuid": "1516b044-0fef-44ad-aa32-8bcb54b15cba", "comment": "Malware payload (Dridex)", "value": "4d9956f1f44a4bf7335fbe49858c88bff5bd2a3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709267, "uuid": "cbd48b36-5ff6-4212-850d-5dc467ca53ee", "comment": "Malware payload (Dridex)", "value": "3fdad642e19321df0098c89dbf0621be4b1509522420a2a8e6d7d121e2fce2ebcd734191fbb8c51710244b0a09628816", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709267, "uuid": "d8f88871-7d92-4c04-937d-4e27e1387497", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709267, "uuid": "676dd895-afb8-4512-9171-aad42b37f340", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709267, "uuid": "0a8646f6-2568-4757-a59d-7a7b415dc257", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709267, "uuid": "9eb4dede-9cb0-4ed2-9fcb-46ecf92f387a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709267, "uuid": "e089f138-2f7f-41d3-a84f-32e4d03e5d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709267, "uuid": "29e3838e-cb5b-41ae-9b87-b1418e1651cc", "value": "03844db8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e935acc6-b23c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620726024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726024, "uuid": "65efe7d8-9659-40b0-8ee5-235ab2ecfba0", "comment": "Malware payload (Gozi)", "value": "c4c0b19091c6edd5fd46867caf99026d", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726024, "uuid": "4743a7d1-7e55-423a-ae83-5b171676168e", "comment": "Malware payload (Gozi)", "value": "821f1b68c207b41e21b519610931ce46719307d99e3e8aeb397ac720d870b476", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726024, "uuid": "28c85d06-3481-4e73-bf92-5afbf4596311", "comment": "Malware payload (Gozi)", "value": "5b1dbdbab64ebcb665e91d442a847cc3a9552a38", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620726024, "uuid": "bf66a2a0-dc00-457e-a9d2-0e35e9a0f2bd", "comment": "Malware payload (Gozi)", "value": "51f1e3c7d72c0705f495eb7995ef096f2bad34a03f8fe2f7a9e788bb708ec760341ef2ccba7242d4d4d10a5eab48cfcb", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726024, "uuid": "4dbdc1c9-2357-4b95-98e0-a9ed2c82e7a8", "value": "4C53E1927810D8A6D70F9177372D32DA92FF4380016B49F613213EA97BDD88AE4FE455", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726024, "uuid": "0fc4a115-e832-4051-a2c9-2487b00d94f0", "value": "6e9163c62b29a1ccabed40ce8621a95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726024, "uuid": "11a6f428-f7d0-4266-a550-cbfe5d0dd9b3", "value": "768:JmKbkq07vrxPpdGvmlwblv4NZx+ab03qTwlVaj1eYqFN35zLRUfAf:JmKbn0vJpdUmwb+NfwrIcYqFJ5zLRUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620726024, "uuid": "2f57888b-60ee-4144-9087-7c0edbf4b9e4", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620726024, "uuid": "205ff04d-8b54-49db-bffe-051ab52fbe9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620726024, "uuid": "f2f882e2-aa24-43ff-a0c4-c6c9145c1999", "value": "821f1b68c207b41e21b519610931ce46719307d99e3e8aeb397ac720d870b476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec739b43-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709279, "uuid": "864fc132-56c3-4147-ba0e-f685a78ba885", "comment": "Malware payload (Dridex)", "value": "95f81d874f06cf02522ac54acbb185fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709279, "uuid": "5b91988e-d156-454e-9536-809fa881c585", "comment": "Malware payload (Dridex)", "value": "825662db727d20dd655965a10c2288a5eaad4febc13d50d3e3f45681928bcd31", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709279, "uuid": "d4e19437-51f4-47af-8f66-f6f53a0af2c9", "comment": "Malware payload (Dridex)", "value": "c991d840fbb9c9edbd885c784015fa29b2e42b16", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709279, "uuid": "e87a4518-41f4-48f9-a09d-588cc9955469", "comment": "Malware payload (Dridex)", "value": "e42937a21eb1350904863f8e50b7cd265299ad7c31b885cf6ed09d57c5b5caea3073e030628b2c45dde0bfa03094c5f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709279, "uuid": "b77eb68b-23a1-4a3b-89f9-aaff5b7d4670", "value": "B4F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709279, "uuid": "7ca8f47d-1ada-4656-b744-a2b7c7eb67b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709279, "uuid": "170d161c-833e-45f6-bab4-dbc26101c817", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709279, "uuid": "01e8db6c-af77-45a7-a5ad-e66522feeabd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709279, "uuid": "776b821b-b8bd-4a37-a154-c2055bf9574c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709279, "uuid": "473177b8-129c-4cb1-b453-8c8e2a1cedc9", "value": "95f81d87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85d363-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709308, "uuid": "4d4445f0-f4e1-4e42-9815-3b1dd7606642", "comment": "Malware payload (Dridex)", "value": "15e799a87a3498885862e85b78c0238e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709308, "uuid": "7e65a819-83be-4028-bb66-7d5b0046d6c9", "comment": "Malware payload (Dridex)", "value": "827d674b37757aeec82c314cdd1e88e86f5d77602b4236f9140025bedae0345d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709308, "uuid": "4c6a6052-2c1c-4e77-8284-9b437d4ed983", "comment": "Malware payload (Dridex)", "value": "aea8691d28b6f2bfd9e45ba413b817ec8e4ea357", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709308, "uuid": "f0aa7100-e205-470b-ac09-5a1825ec778e", "comment": "Malware payload (Dridex)", "value": "9fe399676b1e96362edb5e3ea230aed878b28c65e873e68e561e4caa4380391d921edb3651b1438f22c685d85f4e84e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709308, "uuid": "f80311ad-27da-4ac1-a5c4-7f580ebc91b6", "value": "40F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709308, "uuid": "47d0b465-b707-4095-8a75-3392f37462c9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709308, "uuid": "24e5490b-7593-4c82-8bdd-b2961ea458ad", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709308, "uuid": "908dd23f-6bae-4dc2-a084-04d9c0acba85", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709308, "uuid": "774a5918-a50e-4c64-8e67-dcce1ce590d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709308, "uuid": "6c68d5a9-0211-41af-8102-0fd42571de1b", "value": "15e799a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5066ee5-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620741828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741828, "uuid": "900b3065-0575-4383-9e75-5871139cbc98", "comment": "Malware payload (RemcosRAT)", "value": "54e6466b6f8d028feb6dcd07b4a7483f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741828, "uuid": "bd3e1639-1358-4926-8e74-b5dce0ff3a3e", "comment": "Malware payload (RemcosRAT)", "value": "82841cba794d492b3ef10da112d051aa272dc55879d82d0a73a67809679dc77a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741828, "uuid": "3d90aab6-bc07-4d71-ab74-4c84e89dcd5f", "comment": "Malware payload (RemcosRAT)", "value": "9d00818e8d488113158a4b19c2309f7a5d56b05b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741828, "uuid": "da13b6b9-55a3-4e64-b9a4-8224c3f38e2e", "comment": "Malware payload (RemcosRAT)", "value": "59f4ec459c234fba1afea1cb5249ad82f907e0d2bdeff228e5c0099917e2677c65a154f39666c8f25018cc8e1e1ef269", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741828, "uuid": "2cbcd720-5295-4954-b989-979c51b6a18e", "value": "79F49E20E7E24433D46F2E7C6C6AFB7A5C25FE022DE8144A5BF86D085F396C139192D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741828, "uuid": "d76723a1-96eb-4cdc-b3d6-141361e7086c", "value": "b124d6d7906bfbfc346167632abb74ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741828, "uuid": "c9e9625a-ba9e-41c5-a1ec-02a1c93132b8", "value": "12288:pL4F9NDkBISBvY6gjo1gsUM6fZdLya7FC3OuU/Oy/H:pUF/SS6bqsxKB/FCjUD/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741828, "uuid": "f72dde11-3af9-43e6-b278-ef312ef45fe2", "value": 736408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741828, "uuid": "143460c2-e017-40f0-856e-0fd4abdbfd4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741828, "uuid": "cfaf0ca0-a0f6-4572-af56-a0e2268e60f2", "value": "Laufquen PO7878T6267626,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c2578b-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712942, "uuid": "4734d142-2913-4b94-8340-123886b1e3d8", "comment": "Malware payload (Dridex)", "value": "258d93687ee5d150505e4af18100de88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712942, "uuid": "4c1fd5f4-deeb-4256-8bae-86cc03598e80", "comment": "Malware payload (Dridex)", "value": "82b6313b8c91f7b52b75215d72a38c8474409834f9819511edbea903b72d2bba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712942, "uuid": "a3ea49af-eb66-4070-92bc-8a6c9de9fbcb", "comment": "Malware payload (Dridex)", "value": "a94cc8dcc65a10e9136fb6cdbbb89e023a73eb10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712942, "uuid": "22e09e4e-f416-49b1-a244-fc436e0b8393", "comment": "Malware payload (Dridex)", "value": "d73facff225285a1af7d58911f31c350ba1ff2058becc6713031adc56bb7e6d4c6f5f4f888dd2ce7dcbb766a87542668", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712942, "uuid": "e61df213-d40c-46d8-951c-0316cd99b9e0", "value": "49F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712942, "uuid": "1f2f8f59-7a0c-41e5-9472-aa4fb3dde1f8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712942, "uuid": "c5773144-9856-464e-9e0a-0e80ae64ea38", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712942, "uuid": "5e4901c7-c2aa-4723-83e5-88b421f1a789", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712942, "uuid": "f2ca7bbf-3902-4505-9235-2014674b2304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712942, "uuid": "1421c190-dafa-48e3-814f-11a6472db951", "value": "258d9368_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d14485-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691301, "uuid": "3299120e-9e50-4719-89a4-93ae976beade", "comment": "Malware payload (Dridex)", "value": "8f39b1cd38d788e1e23fa2701d14abe1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691301, "uuid": "e50ebf1f-6e74-4ee4-a5b7-dd0698aa5a4a", "comment": "Malware payload (Dridex)", "value": "83179556cac06771cf618b84103093a22ddc637d7a5701c0d2dd05edcdda172b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691301, "uuid": "c82aad18-5509-4475-9296-9136577824f9", "comment": "Malware payload (Dridex)", "value": "305fc2845ca45f0f63c588a6b3161e0fbdfd7a19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691301, "uuid": "5164e68a-2e75-44b6-ab97-7827f0d08839", "comment": "Malware payload (Dridex)", "value": "108d00d3f60cb769d4cd46217b8a422b7b28cdc840b717b327f60892a3405e500c3d1f4d84f83a5c3e767d78701742ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691301, "uuid": "7b7f9713-958d-4ddd-97a2-78e3189e2e0d", "value": "79F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691301, "uuid": "0a5d4f8e-2d45-4ea7-b6ad-1d0c73d79f80", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691301, "uuid": "c21d5ac4-be14-41c6-9236-f02fe962906b", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691301, "uuid": "03910c74-c0bd-4ab6-86a0-16ac1c2a6774", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691301, "uuid": "a2a6fe25-5b45-48e5-9f8d-a3ad3b9d0bd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691301, "uuid": "a2577c9d-c21d-44a0-852a-207b2cff2ef1", "value": "8f39b1cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658e5a1f-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716784, "uuid": "3c549d7f-da6c-4e3c-829b-3581cf13ef2d", "comment": "Malware payload (Dridex)", "value": "de315885583aa499049dd369c02d270a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716784, "uuid": "2a307a38-d45a-4ce5-a078-b6a297cd23d9", "comment": "Malware payload (Dridex)", "value": "8350602b07c7bd0f8de5f83b094778e5b7ea1c74cf8cbd4ca8a8deab23a7ef88", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716784, "uuid": "d249b30a-396f-4a37-9c49-a9df7ae48852", "comment": "Malware payload (Dridex)", "value": "8830c53f1ecebd6f87e3d9c1a3a2cc71b24fa091", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716784, "uuid": "901b7f56-5862-4920-abff-962cca9cd756", "comment": "Malware payload (Dridex)", "value": "369a329366f4cfd602a12227edfdcfd16d1bb80d699afe1f8b14e2e9d3c79b81dac6886da7c3606f2613d8e99d67bffd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716784, "uuid": "a2172d96-9f29-407a-b0f1-94a606346a79", "value": "C9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716784, "uuid": "e6960182-a2ec-4546-a57c-17098f87973c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716784, "uuid": "e3e98ad7-f79c-4f54-baee-723ffe0441e7", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716784, "uuid": "b86417b9-1c4a-4341-9e08-34330c5252e9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716784, "uuid": "822a9d5d-1408-4ff9-ba32-d1c2965c52d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716784, "uuid": "4883e0f8-4d9b-45dd-8b0d-13c5ab4dd6f9", "value": "de315885_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce9becb-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620717172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717172, "uuid": "e8f55d9a-4f1e-48f8-bd66-ddd9bd328e8a", "comment": "Malware payload (TrickBot)", "value": "3bebcce1e78d963d90820acdf905afad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717172, "uuid": "c09267e0-b6bd-4b4a-9d53-29d372a043d6", "comment": "Malware payload (TrickBot)", "value": "8366ec12a0a566dd36e60c387942b054865d2ee8d9aba3fd502b34068514bc64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717172, "uuid": "1f6ed93a-f0d7-4bc3-bb47-aa71cdfd13f0", "comment": "Malware payload (TrickBot)", "value": "9d240207825f9d9f4d8bdeb9101955590df4b269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717172, "uuid": "a1a0f80c-84e9-464e-9e71-7a4c87a29600", "comment": "Malware payload (TrickBot)", "value": "100f5dbb38a3764116cfaff4771d877d100e6412c7456d5392b0e3f1191c42b5a68a082341faa883fd6c6ea250984826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717172, "uuid": "3b0a323a-4d10-47ee-ab7c-a8860e3d034d", "value": "91C4C042F6E081F1D75228310EEB573EF1B9AA455F308BC79394EE2D9D36492D93A324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717172, "uuid": "0f6ac465-59d5-4aa3-9ba5-96d301412dcb", "value": "e0000a9c7cd3e5025595cb8f9725a382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717172, "uuid": "3b1b6986-0b83-42a0-8680-e7603e310b1a", "value": "12288:WPwlONBStX5U6N8wtVV9NMjOjr84NL4aB:WButX5Uz6VVsjU8La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717172, "uuid": "ebfbd566-1990-4899-b42c-dda69c033736", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717172, "uuid": "0f0c95a7-4505-4433-9b0e-d0552445cb6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717172, "uuid": "3c37b4e2-6490-428a-9e4f-03f4179cb173", "value": "3bebcce1e78d963d90820acdf905afad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e30bf0-b256-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737127, "uuid": "8bbf386e-262b-47c5-bb61-d75ec6be6711", "comment": "Malware payload (AgentTesla)", "value": "a3d83561dfbe5040966053844b20d68b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737127, "uuid": "17b2df8a-fcf4-4df1-b9f6-6c0d7f38e21a", "comment": "Malware payload (AgentTesla)", "value": "8468cc08571c3290982083780878df02735e8dd243dc8fa606741e499303d97e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737127, "uuid": "b4e56683-8753-4286-be90-321d28ceadf3", "comment": "Malware payload (AgentTesla)", "value": "02de62dee6785a08b2025fa21ecc8619bd6dcd35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737127, "uuid": "975f3ce9-7cb0-45d4-beaa-7c8a778392a4", "comment": "Malware payload (AgentTesla)", "value": "02983476f87354217d00c796fbb6f74b1d69777a9356b82a4f6394e8bfc24b9fa5deb08a2a1056298b11ae5957036ad4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737127, "uuid": "ac254e9c-e81e-4a7c-a1f7-530cd88c003f", "value": "74F47CFC761464F9D35B5C23A3CF1C1682241274A93B6A1B8B2103BD5A5BE273E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737127, "uuid": "7aa773e2-7d87-4277-806d-362ae00d5ebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737127, "uuid": "9a5e360c-0856-4e64-8c17-a118169b1f38", "value": "12288:CoLLoS60/K7yh07MGutSG7JE1qvk2tAx72a4E3WVxEVFb52RImBdyLd:CoLA7MG5G70qvk2tg7/4EGMfbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737127, "uuid": "848b9962-8b3f-40fa-b893-83c3f311b77a", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737127, "uuid": "a285379a-e4ac-4036-b6dc-27f69e07b337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737127, "uuid": "0a0c9dbf-033e-4354-9a1d-3b31d42ea660", "value": "QTY-3322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29995bc2-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702080, "uuid": "b832db33-8ee0-4d54-b688-7152fed7b60b", "comment": "Malware payload (Dridex)", "value": "64012af19b00e033dc25f9ff4c951be6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702080, "uuid": "38852253-a982-43f2-a46d-081b1b09a52b", "comment": "Malware payload (Dridex)", "value": "8493f110a3030ad7c00ff40a6ebaaa9637513f7900013957a76b6c68e5de96b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702080, "uuid": "da1715e8-a5d8-4912-8d6c-da18ff14cb19", "comment": "Malware payload (Dridex)", "value": "a2aa76b194419406f9615b1953f137e3b7d4fa1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702080, "uuid": "fc500407-c970-4337-91f6-66894102d90e", "comment": "Malware payload (Dridex)", "value": "1cd2eceb9c0994c95b498fa2d9d6e69046ad8cdf09fed472d70edca709733b85938f3649ebbb968d013992077341fee3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702080, "uuid": "6d096114-ff38-41b0-9761-1300e6a45bde", "value": "A7F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702080, "uuid": "3c13ee1e-4e30-437a-b766-da9c6edb3883", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702080, "uuid": "18c9e5c0-8f74-4fc5-8261-826d7bcce967", "value": "3072:/WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:/42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702080, "uuid": "0e36c966-ca3e-4f91-812a-0642bbbda260", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702080, "uuid": "ab3182cf-ef00-4226-b069-c23cbd5cadd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702080, "uuid": "efda20bf-059f-4a42-9000-ee9983947a4f", "value": "64012af1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3f45b3-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717122, "uuid": "97e00621-ab30-4e34-80aa-f85bd3a12ad8", "comment": "Malware payload", "value": "517ad3b7e85ad8c18990d2156f27626c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717122, "uuid": "1e65bb1e-c87b-40a4-b62c-9669822624f1", "comment": "Malware payload", "value": "849b592ed81e3e1c82f4c379f410a971679231dcec718c2dc674c1e9ee4a347a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717122, "uuid": "261a8e54-1f92-4d11-aa00-f39fe76760ae", "comment": "Malware payload", "value": "4397121f35c05c8c5b59971d7edceefc2ac0e0de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717122, "uuid": "cf19b69d-b8d5-4c2f-a0c2-a9580f4228f1", "comment": "Malware payload", "value": "49fd3dce1c846d166c59ed45dd0c8532bbbb08545ce0745aa0980c1b6064b8744d34803ac52497fe74fab39a25e8d651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717122, "uuid": "8f24f3b5-99a3-4e16-9fad-c9d0edd60156", "value": "8153DDF280731973D7871E75AB1E79DC2FACAA5358F2F2B0809C9950599160CC42FEE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717122, "uuid": "af0b0cb1-13ce-4951-a87a-e26fc71754d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717122, "uuid": "8a02900c-fbc9-4c04-bb9b-bc31252731a1", "value": "768:lN58KREKxP2kVFX2MI3NH0kJifVSny8AHZ0n:BdREw2kVFXo3NH0SnyT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717122, "uuid": "beadcf96-2f72-49c6-94f4-d49775b40ace", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717122, "uuid": "b32a4567-e9ab-4e18-a293-fd9abbc66cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717122, "uuid": "18c034c5-b4cb-4382-8fa5-bec2dfbaedc9", "value": "517ad3b7e85ad8c18990d2156f27626c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd6f936-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716689, "uuid": "7ab0f2f4-958a-4e9e-9ebc-45865b49f74d", "comment": "Malware payload (Dridex)", "value": "80cca4b22845fa922e5d2711b7dcface", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716689, "uuid": "c47c4891-1717-481b-a4bd-d4bce2bb9bde", "comment": "Malware payload (Dridex)", "value": "84a09b3277d659f74928cdc4eee32dea11dfb268fc1dc015b3ad4fe4426c6f24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716689, "uuid": "e867b386-6f65-4af6-8c30-e9bb9a254d23", "comment": "Malware payload (Dridex)", "value": "e237ea261d9ca49fed1871b79f3b77d46635b6d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716689, "uuid": "9480c061-c6b0-4647-9f2b-7e4b8456af87", "comment": "Malware payload (Dridex)", "value": "e97c2560fc73fa8a5491985c6089bd9d630b2d1f4f992ce3d66d0532ca0b7e7b76c31dd44a2e914aa1f12faacd4fba87", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716689, "uuid": "a60a28ba-7652-41b7-a0f0-8905cfa23203", "value": "DCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716689, "uuid": "6a7f06f6-1e0b-456e-82b5-add98f1b5592", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716689, "uuid": "416ff859-3058-4868-8213-0a781bbaca35", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716689, "uuid": "95b03c0e-1f0b-454a-8cfa-524cec07df36", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716689, "uuid": "704cc377-5d20-4652-a475-08d8b0b4e0ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716689, "uuid": "b835c4ce-1d21-425d-a640-9a81817b2593", "value": "80cca4b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3cb50e-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714780, "uuid": "92bedfc5-29ff-4165-a3c8-f2a3b9ab4edd", "comment": "Malware payload (AgentTesla)", "value": "d5904c6e86e6d4954e899eff5e0c2b18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714780, "uuid": "a083dab4-d614-4e7c-948e-d2202d33bb52", "comment": "Malware payload (AgentTesla)", "value": "84aff154ff6475dfe98c65e5650ed5e63a219d4af2c0cad67daae9d4ad014878", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714780, "uuid": "bff76bad-c63c-40dc-babe-fe85896095cc", "comment": "Malware payload (AgentTesla)", "value": "fe20e47d4c764d61193eb26b763a3223966d3757", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714780, "uuid": "04cd7e22-0e81-4eee-ab27-703df76c74ab", "comment": "Malware payload (AgentTesla)", "value": "7799981989c1878196d6061893135b5f13b62852ba1f45422f64e20269918db86b53f50958cd8e17fb6570cbf02c3a68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714780, "uuid": "eb4c5c5f-cd70-456c-8269-ce86671a1f1c", "value": "F105231332A4A624D1BE23F8106675110BF0F1897764EB4DBE98A8FC1897BD44FC97E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714780, "uuid": "22c2d937-c9fc-4263-bf00-9c360d58d450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714780, "uuid": "dfd7da8d-3f39-4905-9cf7-b719aba3fdba", "value": "12288:YE8yiNQKnwqoWin5WgR3jEpuiy63ymHE4I2Z2euFJPov16Uql/CwFVDUlu1YZO2g:Cwq5HpID2Z2rPF5l/CuVDC9ZOob7cL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714780, "uuid": "ead7526d-3a04-496b-bb4e-b7adf7781747", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714780, "uuid": "54b7490f-f55e-4f6f-ac52-3a75b364e2be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714780, "uuid": "099e726e-6375-4905-aa6e-f91515349d7d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c2f18d-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620720200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720200, "uuid": "ee85fa0b-9c0a-43ed-bca7-4de00104014e", "comment": "Malware payload (RemcosRAT)", "value": "e9c370b5c15c2151cc5deada44abf283", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720200, "uuid": "5a16f9ac-9c91-4edc-ba39-39a452fa7342", "comment": "Malware payload (RemcosRAT)", "value": "84f6d1faa1279e27ecee6d3def3b0c9e253300ebb9a740413118394658ca2699", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720200, "uuid": "dfd48650-808b-4443-b830-0a57d96f6897", "comment": "Malware payload (RemcosRAT)", "value": "4e3254d64b89d89965378582df8866a4a339ef06", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720200, "uuid": "9ceda5ac-cf1b-45c1-9f26-2ee7f9acf2bf", "comment": "Malware payload (RemcosRAT)", "value": "42aee2c89e71ba7ca73a7cb5749e91ff9096ec8098571982f7437da106ae08e25f2033cff22d25bfc69eae178b64acb7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720200, "uuid": "2717babc-d1cb-4cd4-9794-0dfa283afe9b", "value": "60D423D7904E2C20CA3D6D5B6F40A0D8D451BFB3B55E7C061BB2BA3951B1CDB24A3AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720200, "uuid": "1bb3d9f2-4e0a-466f-a57e-5fee1d64a4a7", "value": "12288:R6PP2SbW6rmmJrC5270mwBy6l+0WcUik2ORiRNwTc4B7U:RwtbW6rJJrr70mwn+JLeORcwcoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720200, "uuid": "dd886987-9331-40c8-a9ec-829ace779dc7", "value": 632724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720200, "uuid": "d099c6b8-36fb-4d7b-a660-193d2db09622", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720200, "uuid": "22d1eefb-18f4-4937-ab40-4820a740a106", "value": "e9c370b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffa9187-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620720130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720130, "uuid": "054adce2-9b4e-4a31-b3a6-153a9ad23f00", "comment": "Malware payload", "value": "c5b8db70cef00705f9d4b1129801674a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720130, "uuid": "f89d0619-02b3-46e5-abc1-f368640f17f4", "comment": "Malware payload", "value": "8599a992ba9e1b80e8d6d3ec1fc37167e4c81beb06a8b9764d9abe7b72cdf56c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720130, "uuid": "946747ad-00b1-4d5f-a3c0-13b4f61e530f", "comment": "Malware payload", "value": "026a32bcf5ac233cdaaab2f34bc6252a9d961762", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720130, "uuid": "47664e3a-9034-4cc3-b7e4-0335450252cb", "comment": "Malware payload", "value": "fd0d51c80883519f11cf5938931769419676fb6e2341d4f734a9b7d034717588ceca99e1c472b4730e6211723640bd1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720130, "uuid": "1332a81c-101e-40ae-8def-93bf0f1d69f2", "value": "37323B5CAA744BCCCF99A3F50B7AEA1901CD7E6C338904F57AAC76A36F586390306494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720130, "uuid": "a3650dce-096e-4ae7-9f2a-dfc840a91aa4", "value": "192:MGxDIsMQ5BgUF4mRuvApfqm/cDtXGZ+1CVStvWXrQl1N9tqYFc6vIU5hESWfEMAa:MGxDIsMQCQRJZcDBGZuhT+ygE/Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720130, "uuid": "d6875940-51f8-4eec-b6fa-c3a2374ef327", "value": 11734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720130, "uuid": "7aafdba4-d61e-4a47-8b1a-461df06cf6d8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720130, "uuid": "d37a8799-6335-4aa5-b0eb-19c9b9c312aa", "value": "c5b8db70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f6161f-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702039, "uuid": "aaaa64a8-2744-413b-bc78-3ed84b55ef85", "comment": "Malware payload (Dridex)", "value": "446cde8ac4cc06301793bb9b418fc719", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702039, "uuid": "a7adfe1b-3826-48ad-aefe-087b982912fb", "comment": "Malware payload (Dridex)", "value": "86163d9ea34e99a5fdfc11728668fdaf3c0130139a64cabcfd5f7727a8bbd86a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702039, "uuid": "4c24ede8-6a9d-46db-8f17-c819ba58dbb5", "comment": "Malware payload (Dridex)", "value": "8ae6fefdbb97bbcc4000d6443926f59f695fc6e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702039, "uuid": "b7001c28-e30a-4c81-af77-84398dde4bbe", "comment": "Malware payload (Dridex)", "value": "fc7548477f54e82bb8fdb78ae52baeafc0a4225ed48f33808327aef7a0e94828ec7bbd43056d3e14e647312f3d3d453c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702039, "uuid": "8d77ad52-a8c5-4226-87b0-67b40307fc98", "value": "5EF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702039, "uuid": "656a8054-ef19-4d99-bfa8-e1d5d875bc9d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702039, "uuid": "75775801-026d-41e1-aad9-66410756f5f3", "value": "3072:nWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:n42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702039, "uuid": "53c1c7b0-f7d4-4f7d-a30d-e1861f5d85c6", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702039, "uuid": "29fcadf5-0b1d-47c9-a940-0a1be7b37588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702039, "uuid": "0997a5f8-5197-4362-828e-580ef4671d71", "value": "446cde8a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ebf202-b1f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620693966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693966, "uuid": "4ce15570-0ae5-4d6d-aaa5-8b06e6168eb9", "comment": "Malware payload (njrat)", "value": "c1469a12632633165a486fc1559cc8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693966, "uuid": "3428588b-0066-4728-9516-571a47e55d77", "comment": "Malware payload (njrat)", "value": "86c98f0c13c94c4c4e9c5eeb3cdf0684815528eff9078d06f1c32d1e9c5f6929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693966, "uuid": "54577c9a-2f03-4d48-ac48-b10c6963d103", "comment": "Malware payload (njrat)", "value": "c247e7e4f5467dda32de32ba57adf20041bf71ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620693966, "uuid": "d44e4699-3609-4d84-8582-c50e8b008bda", "comment": "Malware payload (njrat)", "value": "f654b7cf7f843ada26ac174decac855beff9dcf74dacf1172caad2887cbb7179b0898f1efef7fb55a3560fdedadd974c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693966, "uuid": "5057f56f-d2e2-469c-94e2-17e0dd711143", "value": "2EB21A4E3FA98866C56C17748AB5965003B091870423EF2FCDC564CBAFB37D92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693966, "uuid": "25f1250a-0cca-40a9-a572-6d73a73ce349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693966, "uuid": "e8aa74f9-0ea0-4b56-91d7-ab85df7ab189", "value": "384:UluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZqO:DOmhtIiRpcnuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620693966, "uuid": "e793cc2b-7d92-413f-81f0-1a91e0b2a2c6", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620693966, "uuid": "81c7218a-eb6b-4fb3-a318-c3c3d0de6c3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620693966, "uuid": "82b58f34-c3da-461e-b5e8-b27e06e6eece", "value": "C1469A12632633165A486FC1559CC8B8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81db4bd9-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716402, "uuid": "1404fdf3-b1e3-4cf6-b5c8-aa0b1977202a", "comment": "Malware payload (AgentTesla)", "value": "e2c6abe876115570cd35b3f093ff5b38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716402, "uuid": "d1ad6c5d-b878-4054-b792-a107ceed5065", "comment": "Malware payload (AgentTesla)", "value": "86d2cfb0556b0cbf827ecd36ce781aed27e68d25c63ea17215a40f4a22fbb066", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716402, "uuid": "8e3b2f77-1dc9-41a6-9cf8-dd1cc93c6853", "comment": "Malware payload (AgentTesla)", "value": "d7fcacc5b8bc34a9b93a94727d2279e4955b7c0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716402, "uuid": "1156652c-d559-4245-98c5-1a517f730a15", "comment": "Malware payload (AgentTesla)", "value": "f1ca04f6b76dac427ca4c7e3378bab6983106b3450052b396a1c7960a9e8f3da56e48bcbe40b22ea306bff0368ef6c67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716402, "uuid": "280dae55-d2d7-44b0-8a52-613c30ca11a4", "value": "BA05230773FCA3A8F0BE1BB2541146805BF1F58891E7E74D3E8815DC24E76988A46BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716402, "uuid": "1c902fbc-b0d1-4770-a6eb-4ff606725761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716402, "uuid": "e0320fc1-6cb2-4fa0-83a5-2eb5681cbe3f", "value": "24576:kaKkRol0NLAuDq63nsaXonwcucgwJpRq4P06:kaHU0NsuDxssonwALL9Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716402, "uuid": "607c033c-fd5e-4fcb-ad10-b5e98286b46c", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716402, "uuid": "c2dd7ee4-4cda-439b-82e7-d5e664e39f5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716402, "uuid": "85a09d83-c5bf-41da-bb2c-5515c4d02a3a", "value": "\uad6c\ub9e4 \uc8fc\ubb38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bac9a97-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694890, "uuid": "824c1a94-915a-4d04-947f-97256eaaf385", "comment": "Malware payload (Dridex)", "value": "f2d0c5cfbf797b740418fd1c4968633a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694890, "uuid": "74dfec66-b1ef-42aa-9b87-4f4c8ea1613c", "comment": "Malware payload (Dridex)", "value": "87211228f3e9d7ac2c9cd359f4e589bbf47d93355e5628d2e0654aafc090d748", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694890, "uuid": "2f96b274-786d-46d6-ad60-d4ccd0810365", "comment": "Malware payload (Dridex)", "value": "d6db229b73ab46d53f760f8bd1bd74e6e98a69ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694890, "uuid": "1be6c0ef-4870-4eca-ba0b-3bd25deb89c2", "comment": "Malware payload (Dridex)", "value": "68ece541fb9b69c9669bb0cc87c85decdc68fade8e3a2fd5545ba854b53cdd43e1a70b56c5778adee6d2d6927b8374bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694890, "uuid": "fa9caec5-976a-42c8-aebd-f0c328ee714c", "value": "E4F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694890, "uuid": "3604453e-b9aa-49df-9d92-3fcc2e5c7e54", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694890, "uuid": "c3e1e73e-ce25-45aa-aa19-3a3ca41e0739", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694890, "uuid": "a06d6452-f653-4c5b-aa8c-cf23133f31a1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694890, "uuid": "0340a0a6-d223-4355-8fae-768a31291d7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694890, "uuid": "f6d154b4-0140-4da2-9435-50b16b237670", "value": "f2d0c5cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb9b6e0-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702057, "uuid": "b3f4ced9-9d6f-4577-ac0d-5871b929833d", "comment": "Malware payload (Dridex)", "value": "404962cad84c853ccc752f47b4f9aec3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702057, "uuid": "f0d4a5b8-d896-483b-adde-b35065fc7419", "comment": "Malware payload (Dridex)", "value": "8736e97e4e9a1d6d6f0fb9b298e5f2331f7a283bf50d96b088b9dad085081bc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702057, "uuid": "cab67edc-4f5a-443d-b168-4db1174e5594", "comment": "Malware payload (Dridex)", "value": "0a12e2bd53cf09a37d27a219088ccb9a679cc15f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702057, "uuid": "1306e7bb-9d3b-4260-82fe-e78718d674fc", "comment": "Malware payload (Dridex)", "value": "f1ff320235ea3d26762a3d267880c39bbeb5786d94b172ffaf2035f3c6ba2207ce282f40cdfe9062a01fb25456bae477", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702057, "uuid": "f1557691-639a-4222-90a4-d04a7c5a85d2", "value": "1EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702057, "uuid": "7dc90e13-73b8-46ae-bd2e-e8d6746866ea", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702057, "uuid": "936ec88b-c3fb-4d20-934b-bb71c6b8d64c", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702057, "uuid": "d7feefc9-a2b3-4bd5-a620-1efbb9956bd7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702057, "uuid": "08d5dcbc-cb0e-48cb-b543-6312e1c70c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702057, "uuid": "02feb412-1430-49e8-a462-39e33ab92421", "value": "404962ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd7dcae-b249-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620731270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731270, "uuid": "9cea0c52-f59b-4cc5-831e-39e0859c218e", "comment": "Malware payload", "value": "eda23f12ac07a99fb6e164ad5c53ea4a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731270, "uuid": "8728c907-2995-4325-b6a9-d5756dd8a1f0", "comment": "Malware payload", "value": "874791b8d674976a87e59f843245a5e113f294cc2137369088d85921df26e2c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731270, "uuid": "341fbc25-f016-4131-a371-dd1effbdb068", "comment": "Malware payload", "value": "5732167dc8f21c7ca7c0054b6d5dc88cd61468b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731270, "uuid": "54be1909-88dc-42d8-a2cd-6e4011f1d69a", "comment": "Malware payload", "value": "23dc56f162d97a8d65b916eb1c7efa5aee3017c7a58bb35805f7778fa2d9ddf64bdf42e84d8ae2ef402926cbc6f3dd3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731270, "uuid": "535f1db6-10ae-4078-bd48-f9917b3a69f3", "value": "754623AFA51B739DC11B7435436B48A2690D706784AED74F3BCC6F605A831CB8A8D07E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731270, "uuid": "bb6db81d-206c-4376-b8a4-ea3c82315bc3", "value": "98304:MiIiq/Sd2K8pTVqcFaa2w5xcSM/jH4MOT+29I67Lb1Gz/2yeEYrW9g:MxZS0Tkcd2Sl45Mrvb1GCX3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731270, "uuid": "bb2f314d-4352-4a5a-a877-a4bfe61af8d8", "value": 5783278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731270, "uuid": "2a62a2a0-6a21-4186-bcc0-f2506c7b2622", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731270, "uuid": "89358656-3344-43a8-81ab-af90710334ba", "value": "eda23f12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073d181f-b216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709324, "uuid": "a3a67f76-5cb3-4946-bbfb-4a06efdbf19f", "comment": "Malware payload (Dridex)", "value": "d0ac707ea9d27b068d14daf58394cd9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709324, "uuid": "c8e57e11-87f7-4872-a43d-32b66cf9460d", "comment": "Malware payload (Dridex)", "value": "87574ef887075676ff993c07fc9b96cf8180e94d520ca2c75d1229fabcaee72b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709324, "uuid": "fdc8bbf1-ee58-4c15-9f22-d36aa3ecc119", "comment": "Malware payload (Dridex)", "value": "8ba4583bbd69ea883511463d77f91ef3f4f111f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709324, "uuid": "98720bbb-8c2e-4578-b277-3e4ab402f707", "comment": "Malware payload (Dridex)", "value": "17f11e58ec105d8a85e573927807d043e3ee4e6f5613f652b9a255c6f809eacbc85d27fbf1e5311f41c3eb07ea35b063", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709324, "uuid": "2af34507-76ab-4c59-869e-b93f3c872722", "value": "FAF3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709324, "uuid": "f2dc366c-7114-4da9-82da-172a1bf6eae1", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709324, "uuid": "7e54ca7f-c9ae-43a6-8f76-be25949f918d", "value": "3072:buFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:b0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709324, "uuid": "b1796aed-3c74-4954-825e-4af2d1690858", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709324, "uuid": "d287c8e3-e0c2-406a-b5cd-904fc26263c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709324, "uuid": "9fda038b-2718-415f-aa06-c72d520b2e10", "value": "d0ac707e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d579cca4-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698503, "uuid": "368bfb14-d823-448a-b5df-faab0c556dac", "comment": "Malware payload (Dridex)", "value": "0d93f052d7a7373391dc9552d85db13f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698503, "uuid": "caa245a3-6a0e-41b9-bde4-740e48fa23ef", "comment": "Malware payload (Dridex)", "value": "876b17abc41d41b04bedf9d50a700d862ee6683c4c9695a1ed25b4d8ab25f80d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698503, "uuid": "f72b9b6f-02eb-4a16-a9ce-d5e60491a28f", "comment": "Malware payload (Dridex)", "value": "674b3459f4ad286399d90180ae184eb50485c99e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698503, "uuid": "5d108d8c-8e10-4431-a496-d5b98074a8fc", "comment": "Malware payload (Dridex)", "value": "265c3db4576a77d7ddabaf1fc89a56c2e3420a1299ad835ac8b90112f41f6716e1132e118d14ec7dbc4bff05870db655", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698503, "uuid": "8e9cee28-3da7-4f0e-b9bc-20b29d64d580", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698503, "uuid": "3be073bf-d948-4af8-9907-486514a443b9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698503, "uuid": "8bb9a0f4-5595-4205-8173-e5fe4794ed2a", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698503, "uuid": "8d01c312-14d8-4412-ad9d-4299af51993a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698503, "uuid": "43074341-5c8a-443b-91a5-381801df9dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698503, "uuid": "81875725-798e-44a5-adeb-1de0fe737ef0", "value": "0d93f052_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765568fa-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712946, "uuid": "c5257bde-e566-4e4b-88c5-ac7efbb0884f", "comment": "Malware payload (Dridex)", "value": "ef6735d46c2e113de16d8468587560c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712946, "uuid": "c97071fc-46bd-45c8-a2e7-38faec2ec7ad", "comment": "Malware payload (Dridex)", "value": "88226563fabcfdc4b82d104f72ab01a35e207042f5d0a8e015f2963a84d9b324", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712946, "uuid": "809412d7-17ca-4966-a4f2-6592931b4d3a", "comment": "Malware payload (Dridex)", "value": "07fcf125bafe6eacca7139e0242a6cf1233cd46c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712946, "uuid": "8dff4d7c-0936-4db7-8e4c-750ef0974890", "comment": "Malware payload (Dridex)", "value": "016b02460a83f09b7aef73c65bd682fd8cb0b977e8260d4a57215acf9de5bd403ddb0b58022dab429ea99925f0665ec7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712946, "uuid": "ae5f81a5-74d0-41dc-9499-057d71d0f5f4", "value": "AAF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712946, "uuid": "77045d1c-edcf-4b68-b648-180ccbbea5da", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712946, "uuid": "15448905-277b-47cd-92e5-10e776bf8fca", "value": "3072:LWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:L42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712946, "uuid": "f700f384-c85a-4546-b2c5-e2596226af53", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712946, "uuid": "a47cec9a-4efa-4c12-be69-78b1a1ece1f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712946, "uuid": "2d4d6227-1c4f-4cd5-ae34-811d00b1cb71", "value": "ef6735d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aca5a2b-b28b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620759742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759742, "uuid": "53cdc381-e013-4d62-80b8-5e1347653251", "comment": "Malware payload (Quakbot)", "value": "756a6d0de4b43f0f986ae97d85e02870", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759742, "uuid": "e5a3c0e1-2b84-47fa-a8b0-2045bd652959", "comment": "Malware payload (Quakbot)", "value": "8829193147b9cfd845af5c3905765b7f750f0f4592938cd341cf57ca384c0818", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759742, "uuid": "ccd0bfd6-764d-46bd-82a1-de3bbd74fa77", "comment": "Malware payload (Quakbot)", "value": "9a181c8c1d8755fdf2dcf34b8f8f4a11a9e3cd9a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759742, "uuid": "f9ed9d63-7de6-4883-8b7f-c5096bd8dd85", "comment": "Malware payload (Quakbot)", "value": "7c28b5ab3d594471f27a833b5bc72d6b7384b98138fcfc3744683c4b33a26765cc059bc7ed0b98ad0ff3cf0067fe5825", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759742, "uuid": "3479e130-c90d-44fc-b512-51507310ebc2", "value": "D924BFB271D391B1C0724132B2CB5A6B8FFE73641221D49BE7881946BF6594AE7303DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759742, "uuid": "42cd28e5-e06e-432e-b65b-da8c462ce5ff", "value": "182b61d2f1c5c52273fb34b2bc366785", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759742, "uuid": "114d4f40-4b72-4dfc-924a-5fa58d2f4ac5", "value": "6144:fqT5KksaWccDTuyGJwvB2TBJtjwsLOBNh:fo5K8WcdxwvB2T/tj5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620759742, "uuid": "44b2e8a1-2a5a-4de9-8a99-aee34fc68e54", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620759742, "uuid": "3d76ad95-b4ea-400e-8958-9c979c041235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759742, "uuid": "b8cbfba2-d756-447c-8970-bf044d86bfdf", "value": "756a6d0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127e325e-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702041, "uuid": "08db61b9-7a2b-4c31-849f-27905d83d807", "comment": "Malware payload (Dridex)", "value": "8616739f27723383d2e7bcf167a8f91f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702041, "uuid": "8a0261b8-63ce-4da6-8306-8f19f0e0e8c0", "comment": "Malware payload (Dridex)", "value": "8888cd7ca3c0197fd801a5da043bb2021f85725f7182241097a38478fff6942c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702041, "uuid": "46993445-ab95-4377-b446-0727cd7d4765", "comment": "Malware payload (Dridex)", "value": "35a0ce218cea0483817a983dfe484b9c9da470c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702041, "uuid": "de8f9220-f92a-4134-8ced-4bf378ceb325", "comment": "Malware payload (Dridex)", "value": "8b3295317d328f4de06988811725adef8fd865d2d5e24ea0d2997433eb1536ca6a8c02c441da115397c52077102f0511", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702041, "uuid": "1591e198-410e-4b34-9b95-795cf39c946b", "value": "BBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702041, "uuid": "5b4c48e5-a43a-4e36-ae5c-487d5764b9f5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702041, "uuid": "f5261fff-d5c5-4c21-909b-dde01f1ef5d2", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702041, "uuid": "87a0bf86-caa1-42d4-873f-0c53119513ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702041, "uuid": "1dda2023-098e-4057-a22f-4746890c48a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702041, "uuid": "f62ce908-718a-4a9f-8488-e70db8e98c99", "value": "8616739f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321fb192-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620720133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720133, "uuid": "6eb8d887-cd36-4954-8eb8-ece2fceb753e", "comment": "Malware payload (AgentTesla)", "value": "01217a79d1d0ad6e766382c46679a479", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720133, "uuid": "3a0f7c2a-5273-448f-9122-dc40234af4d1", "comment": "Malware payload (AgentTesla)", "value": "8895f05f07d168eb225dff4d63bf2f5c0eef9bafba5fa87e745add460a9b0b9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720133, "uuid": "90b1b376-573b-4b4f-bca1-39ec3f72501b", "comment": "Malware payload (AgentTesla)", "value": "5f54f5a933124516f0089dba9ac6458cf2171910", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720133, "uuid": "6711db85-a788-4549-b2e6-9eb28a6f95f6", "comment": "Malware payload (AgentTesla)", "value": "c95f5f8a4252b40224d123e1f0c0f44c6b3d612aa9e451782905a1075dbb4e3eaab7d35584e22f87ade41ee56860b97a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720133, "uuid": "8cf9a243-5858-49b1-9bef-fc13b7ac7a3b", "value": "27852F548B48E26CF4FE7FE151E1BCD382AEFFB53B75299458883A4846B21E30A44771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720133, "uuid": "64229205-54a4-41ed-ad03-4e73203f14ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720133, "uuid": "05e53c92-db0b-4339-9611-8fca6774cf3a", "value": "3072:vuEakkR+ruuBJeuMgpfu3m9A49uEUmc00pUkluiTafKubfuVu4uOFDd+MuQBqnuT:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720133, "uuid": "642019a5-62a5-43f1-b0b0-1e889054989b", "value": 1866240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720133, "uuid": "a1583aa0-240e-4174-8e8f-ce9619b83aff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720133, "uuid": "3a8214b2-7c07-49a9-aa14-6079f41b3c65", "value": "01217a79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b95546-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694903, "uuid": "1d8f78f1-4971-4f4b-a37c-3db124e77fb2", "comment": "Malware payload (Dridex)", "value": "df7cdb3df4dcac78f2a669c5401110d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694903, "uuid": "c44c4e90-89ec-426c-ac50-7941d16d34a3", "comment": "Malware payload (Dridex)", "value": "88df8e31133644e2f05a21f382016eb85102496359df0ead23fb8b77c23c55c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694903, "uuid": "3ef7c629-2ec7-47f4-ad0d-48e4a47a75c4", "comment": "Malware payload (Dridex)", "value": "70ce66582a81776668b09b5c4ef85356113388ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694903, "uuid": "bb5775df-d693-42fa-8335-1cffd2a0b580", "comment": "Malware payload (Dridex)", "value": "1eb09d10e9c73d811cd7f9b7ca5b7c47f938b28b4efac8638227b53b89ae6678e694c1a314a55160533b43d9b52bdf89", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694903, "uuid": "c59414e0-853b-4bde-a2e1-307fcc3c0777", "value": "8DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694903, "uuid": "00f65ec7-070e-4f5f-95f0-6e907ec6c027", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694903, "uuid": "231acd66-ffb3-451d-adcb-223365ecc692", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694903, "uuid": "8be96496-5e88-4519-a268-36583bf77a86", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694903, "uuid": "80bde26e-deb1-4e65-890a-6b664b2619ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694903, "uuid": "f94b591b-8893-4b5d-b120-e270cadae7a1", "value": "df7cdb3d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1f908f-b250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620734515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734515, "uuid": "cafbfe6f-012f-44f3-9d14-d739b05ff966", "comment": "Malware payload (Dridex)", "value": "591ea5226833bbaa07070c785fbd4592", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734515, "uuid": "6274546c-864a-4c7c-8869-3e30c2295d3e", "comment": "Malware payload (Dridex)", "value": "891a1bd4c0d38de2dfa5e68e2510db81064c0cbe5bf2560e06759e19787a5997", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734515, "uuid": "ffc34386-4000-4de7-ac73-dbbe297e6d00", "comment": "Malware payload (Dridex)", "value": "1d833ab27b816841805fff132738164f4865fe2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734515, "uuid": "decbc9ba-6ac1-40ec-9038-9c02b082bbf1", "comment": "Malware payload (Dridex)", "value": "40ffe7b4d1df34c84323c8923b3f800f1ad301d0fb0a1fa1faeb4102b80d2fc1c367f893786b8cfb099b88d6b881380c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734515, "uuid": "94ec56ca-b6f8-400a-b53d-d106d1e82f1d", "value": "2FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734515, "uuid": "2d9a6899-dc62-40ab-bc63-6808519585eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734515, "uuid": "1c4c18e5-173d-48dc-adf1-9368614c66bb", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734515, "uuid": "cb9b1ecf-553e-42b0-add8-a8a92e7b6c1f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734515, "uuid": "fd48735c-ef29-4daa-9dbb-00c62ad55bd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734515, "uuid": "60b5a5bb-b453-4f32-8dfc-08efa133738f", "value": "591ea522_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93837e7-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770665, "uuid": "9bdaf17e-582a-4c87-ab6e-368cd26d12e0", "comment": "Malware payload", "value": "066f630ec14f46ccff4855495ae885d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770665, "uuid": "e2f3a402-a128-4855-b23a-90b8f664589f", "comment": "Malware payload", "value": "894739120dc2ac27f887e343cd34ead635f8f7af92143758aa89710ae638197b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770665, "uuid": "cf12afec-d8b4-4843-98fc-19e6b68dae86", "comment": "Malware payload", "value": "1a487f538c4451517853b515ccfe7e4f706ad703", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770665, "uuid": "f8132f61-763f-4251-a962-5a6e895db301", "comment": "Malware payload", "value": "d9b7856cd4d8e052535cc6d1982c2725a431f8337a77a9af7d8763a8b4af5b7d4fea6105b0062fe0e62c60524b966469", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770665, "uuid": "340613a0-1656-457f-92e7-bb23ef6c20df", "value": "EFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770665, "uuid": "4c3786aa-ecb1-4404-a7f7-ac9f84e09c69", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770665, "uuid": "0a56afb5-08b7-4166-a380-a6433bdb0c34", "value": "3072:AiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:reAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770665, "uuid": "c2b41364-2316-4ce9-9ef0-93bf956192c3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770665, "uuid": "583ba075-c339-43d7-874c-ae7831cbfb1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770665, "uuid": "bcb617e5-e994-49dc-9645-551a168f1205", "value": "066f630e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc3de4e-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705661, "uuid": "2f4e08e7-2438-46d3-9e88-f83d82bc895d", "comment": "Malware payload (Dridex)", "value": "5ada33cc5e39cfac171d9259d8abe680", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705661, "uuid": "aa9f8499-0fc2-4ff1-a754-bfbf0bb2968d", "comment": "Malware payload (Dridex)", "value": "89858242f0711cbaa3bc8684cf73b4325c51a9860c4e0ec8d3172422efaa2a26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705661, "uuid": "5ff4afc5-a540-4fab-94eb-59c7d9ea7447", "comment": "Malware payload (Dridex)", "value": "657cdccf085cdd5143398bf17a3658782988c6b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705661, "uuid": "dea75867-2517-407d-89de-3717e2358a9b", "comment": "Malware payload (Dridex)", "value": "4c676941940072e9f8ba79a0fc71866dcbeb14debe4d43f1a9d49f05649a89e12aba7d2387409c322da155df79f6179e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705661, "uuid": "f1d324fb-f519-495c-bab5-c072ed52111d", "value": "64F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705661, "uuid": "c7464d5a-9a5a-433e-ab5f-8b4e922f73f9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705661, "uuid": "39195e67-3d4e-411b-b255-ca97d8ac75ec", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705661, "uuid": "e6f2ac3e-5a95-40f2-bcf2-ecda373f7cbe", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705661, "uuid": "17b85cec-1172-4a1d-b2f8-0ba97b8981c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705661, "uuid": "21fd472e-d0da-4610-b2a8-6a9a060f8d91", "value": "5ada33cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cc6648-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712409, "uuid": "34d82773-6bbc-4d11-9d4d-9a17bd3e8ead", "comment": "Malware payload (AgentTesla)", "value": "17f339e350dd340fd677f63ea0e969da", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712409, "uuid": "c888523c-13ce-4ee6-ba1d-01f64744d833", "comment": "Malware payload (AgentTesla)", "value": "89e71ec5e62da140577ac2e98336f6b3138d31a4c39e40231bc815172f64e66c", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712409, "uuid": "0c12d37a-7934-45b0-9fda-2d0c14cd971a", "comment": "Malware payload (AgentTesla)", "value": "c8889535f745d8413c52b754dc5b9729a0710532", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712409, "uuid": "d6c72855-7c59-411d-a3c6-d6c9dfc740f6", "comment": "Malware payload (AgentTesla)", "value": "439980249af0930957f3758b13690af1374786bb2e8fe7b8223951065a2712cccecc763c0c08d8cd5721f023b18c88fe", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712409, "uuid": "ec99b71f-8269-482a-bbba-2b845394fa59", "value": "85358D68719065E1D32B5E726BCBDC3143122E746426E50E8BD03FFB3967F13293998A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712409, "uuid": "8e402be7-b125-4cc6-8da3-7072ca4c813b", "value": "24576:JlSBqooLAixa1RPI4o7yDmf3a7urMfT4zjA8++++4+++++++0+++++++:J9xa1OemyuM4Xh++++4+++++++0++++6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712409, "uuid": "b17b8063-cfc9-4206-b1b2-8f277e1c24bb", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712409, "uuid": "e3d9f24a-e41d-49fb-863b-4c7f7d0e3e2a", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712409, "uuid": "485841b1-49f9-4258-a9e7-acc4f0af0944", "value": "PURCHASE ORDER.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b48abdf-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620735772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735772, "uuid": "49eceee9-ea89-41b5-b13c-257d523700a4", "comment": "Malware payload", "value": "7b6cde2e76975491da209318939e3b9d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735772, "uuid": "fe63a75c-7a5c-4c4f-bfe9-bd1281dda047", "comment": "Malware payload", "value": "8a6bf241e93cc723cfc52fb1e0519e3b503f6df84556975fe351015ed46115b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735772, "uuid": "9ea2cdc4-3e05-4d01-9eda-0a9f86ed48fb", "comment": "Malware payload", "value": "86e2d907f2c1192624508eb9fa05b8af5d68583e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735772, "uuid": "ef89f426-7353-4db4-afab-bcc61c39c090", "comment": "Malware payload", "value": "486a8f67d28f0f1f77864ffe7e840e2f0a2d0dd894d93ceab344f1a0a43aeaba867fca9af432d755ea6841670520faf5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735772, "uuid": "7c51baf6-e857-4d33-971b-4a2c74ad7b3d", "value": "818454856916883AD65A4F33B0EE4DFC5BB2ED41860F8A573E4AF30C9F75340A6136C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735772, "uuid": "1427ccaf-5c0b-4eb5-b8f8-909cb53d576a", "value": "3072:uwmVXbxt/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/I/T/ZPbCPQWwV4acr2Hr/ZcgXQr:VmXt6Uqa5DPdG9uS9QLFV4agNRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735772, "uuid": "7609f0a3-5b0d-42e8-986c-70807e489d65", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735772, "uuid": "2609dcf9-99d0-48b7-bcad-428cb09e3329", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735772, "uuid": "9a17b10e-7152-4a78-8b75-57ce795672c1", "value": "statistic-1893612545.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef2eca9-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620712236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712236, "uuid": "bc6f046a-a0c4-4857-8bb7-ab0babace6c0", "comment": "Malware payload (RedLineStealer)", "value": "2f4bcc44bf320f3cd7e8961802ffe3e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712236, "uuid": "849616bf-d863-4831-b0b6-001ba387444f", "comment": "Malware payload (RedLineStealer)", "value": "8b80872d81924c99b79ae840ae227d46dc0010b368cea1e54074dd46890074bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712236, "uuid": "732b1f6d-4aba-4892-9201-60a78c6d1d86", "comment": "Malware payload (RedLineStealer)", "value": "3072e70fb694e505973ca3ed8f8fa2b827d10f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712236, "uuid": "d1a01771-253d-42dc-889b-77a079001d44", "comment": "Malware payload (RedLineStealer)", "value": "0952d2d2f5cf15d8ec8589f683a55f6438afaa5e0b56e4a1cca6e5bf51bb56368456e5cf4d80576c8fe8e61501ea0346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712236, "uuid": "4dcc9453-af16-4034-b44b-4ffc7d81b467", "value": "F5E5D5B523DE2AA0BABE6F0AA7AD73F5500337F6DE724200834614642381DD5D97CBB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712236, "uuid": "aac44440-4572-4423-929f-3ae34deb2872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712236, "uuid": "825015ba-6bba-4b4e-ba76-05369fea5dd3", "value": "12288:5xLyXq546thkhfOJZ31kqLa3cPcCB6KbcYc+Lc5wRc9NVUc8Xc5Mo+ZHydYc+tyB:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712236, "uuid": "fc64da17-a16b-4b2c-92ed-9bcbabfcf235", "value": 3022768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712236, "uuid": "cc72c271-3ab7-4c79-b9e9-d04ddfeca964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712236, "uuid": "ff4fe036-5afa-4120-8186-9c3dacbcf41b", "value": "2f4bcc44bf320f3cd7e8961802ffe3e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60472bf-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712624, "uuid": "abab8e8f-6879-4b0c-9ac9-776837bc355d", "comment": "Malware payload (AgentTesla)", "value": "2acd9faa9de2810917f1ff84d403ab35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712624, "uuid": "f4e2417e-4947-4891-8711-6a36ba728b79", "comment": "Malware payload (AgentTesla)", "value": "8baee3c8e290e4e0bb5ba09c8cca8d6962df61c2d2e265004fa04ed4d96b3353", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712624, "uuid": "6d4325b6-0f28-4934-93fe-23f10b7d35b9", "comment": "Malware payload (AgentTesla)", "value": "6e7686ebdc5382569b48d0052c71908f2fed6dd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712624, "uuid": "81bc0361-4cdd-4190-a5de-d82f8e3a5b62", "comment": "Malware payload (AgentTesla)", "value": "fe48765e774f8e0dd6496afc929f300d3f1bbc220224193435fa6aadc1c6eb977443697aacaa4c6de9753b04ed0e874f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712624, "uuid": "865a5613-f543-4df3-99d2-6a9c02d11347", "value": "72259DECB50464E8D35B5C32A7CF0C1682152E70A53B690F9B6133BE5A7BD133E39989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712624, "uuid": "a9cac89b-35b5-4be2-8995-107c9398bf2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712624, "uuid": "dd98d026-6bc1-4f8f-88d1-f4cfaf6b5fd8", "value": "24576:8GoLATMxeXMK7jsLHvsjffnUn75DS+rta2M5:8GlXMGQLHvie5lrLM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712624, "uuid": "e1139d56-494b-4188-9cd5-e9dfc80bfdbe", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712624, "uuid": "a65bcca9-ceee-4a52-93cf-99ab46859011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712624, "uuid": "41ba71c8-b59a-4bda-8769-7aa6fd85bbea", "value": "SOA.exe.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add17f02-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620741816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741816, "uuid": "2df2ed56-0601-45bb-812e-f5dc84573bb8", "comment": "Malware payload (Dridex)", "value": "898ecfe778fdeca19770acf0226227b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741816, "uuid": "42eb344e-a360-4e9f-8950-8a635f38e0e2", "comment": "Malware payload (Dridex)", "value": "8bdf5fb58cadee50bb0d1679c917d535c4c7bda8e238083a94d4317afaa72e5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741816, "uuid": "825f1f7b-c328-4cbf-a13e-c5808559428b", "comment": "Malware payload (Dridex)", "value": "1b4694d1fa5963ae5546031b7a8c8f01b893a89a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741816, "uuid": "699ffd52-41cc-4113-a092-b2866e7daf52", "comment": "Malware payload (Dridex)", "value": "14f99a47beb672895e08ab7cf225cb32d8cfd2cc00cbbdc6c6eb898cfd278197247b79d0acb98154487fa298dfee4efd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741816, "uuid": "b706cf12-c0e3-422c-9cdf-a0cb58f9e004", "value": "E2F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741816, "uuid": "5ca8e6b1-9477-44ef-ba31-596d58e43d66", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741816, "uuid": "c3aa2f5b-fd7a-4c52-9035-74bb21e31fe3", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741816, "uuid": "28d6d0fa-09fc-4d03-829c-12b68db54b1c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741816, "uuid": "eac69e9d-592b-48da-b919-08fc09934abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741816, "uuid": "9131176b-235b-4457-803b-16af903d1487", "value": "898ecfe7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7897372e-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694911, "uuid": "e0ddaec1-a163-4441-bfd9-6e6525d98cb1", "comment": "Malware payload (Dridex)", "value": "7210b9fbed5e9967c9b08c95f53463cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694911, "uuid": "ac2a7b1e-5a04-4c81-a32a-1a9afb6d7525", "comment": "Malware payload (Dridex)", "value": "8c622d32a792d3fcef21f7c91ce846576583aeeb5bf1e86817198687dd55ae05", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694911, "uuid": "c00fe7ea-363b-4625-b925-34d434253ca3", "comment": "Malware payload (Dridex)", "value": "084b7684602ba4dd0e7fcee5bc70c8e441fc91a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694911, "uuid": "190eed2b-c937-425a-9a72-74faa838eb3e", "comment": "Malware payload (Dridex)", "value": "a043a9ee23ab118d4edb78a41ea32233dd58d668cf0d0e2c36be7c75054ec5f597c815a3e4d3084d197d598e2701dc1c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694911, "uuid": "871a3de9-6421-4e0b-a545-884b91f6378f", "value": "66F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694911, "uuid": "540b03dc-19b7-4ee2-a825-d30b9b0d566a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694911, "uuid": "df51644c-79be-433e-8a35-fc28c53d8a14", "value": "3072:5iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:qeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694911, "uuid": "15629a4e-828a-4ca3-b566-9f5e87609b4b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694911, "uuid": "288054e0-b48e-40c6-857f-d192aa3a904b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694911, "uuid": "2db4ff12-9b80-4733-b7cc-5c3d045a3ddf", "value": "7210b9fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14769373-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728674, "uuid": "3a5122a1-b3b6-4440-8e73-fdf47168925f", "comment": "Malware payload (AgentTesla)", "value": "0c44a9fa4ce2184c319d7d2b1dc6e319", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728674, "uuid": "02ef3862-44e7-4093-9dff-789cedce5f42", "comment": "Malware payload (AgentTesla)", "value": "8c7d8fc2a97430056c231bcc2e3601fd27718e08c105171175789a6d86921cea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728674, "uuid": "dae670cb-8e18-45ad-a717-4dd24112ebf9", "comment": "Malware payload (AgentTesla)", "value": "fb24049452c8a31eab37ef00099b0604bd40cd95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728674, "uuid": "428a8635-b77f-429b-871d-b813c1e50b1c", "comment": "Malware payload (AgentTesla)", "value": "10021f5cf14d22c37fc7e64241f8f3bfebb1f025c16036b4120774032a134522c69f7b617c8c9e3e64c83132fc614a1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728674, "uuid": "fc164bf2-b863-456f-9d1e-cf8f727f021c", "value": "41752326BDCA6BAAC16E247355F0C432906EDE51A246C9F17319B72CF3B603D06D734A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728674, "uuid": "28cad41f-012d-459b-a1ed-851cb29ae71c", "value": "49152:cWLSVtlhcq3stxpYUfoZiRV6fFSsRlcv+:F+zaqMfuZrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728674, "uuid": "6f6b6619-307c-457b-a31f-9fe4d0afb70d", "value": 1625592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728674, "uuid": "0cd08325-1f56-43e0-b78e-09e701bb7064", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728674, "uuid": "bef69134-47ef-4756-aef9-156e94b1074a", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8342b0e-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620752678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752678, "uuid": "02bbf70d-9e6f-454c-9c8c-db03faa3a2a7", "comment": "Malware payload", "value": "168f2d581332853ca46efd0d377bd976", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752678, "uuid": "0e5b3137-6173-4157-bcd6-f38e1fe5b23c", "comment": "Malware payload", "value": "8ce437b22df609ef044e937d4fcb5b711d2d5af31e0ef919ba20851dfae9fa57", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752678, "uuid": "597f9eae-09a7-40a9-b88c-1985fed4eb25", "comment": "Malware payload", "value": "0a462328680cf1d37d138f28799903806991281a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752678, "uuid": "8030f8f6-494e-4cb1-b928-bc8df539c6bc", "comment": "Malware payload", "value": "69f44de0b10d37f19f794b3e5fe3b6b2daadfffe078755078655adbe7fcf8b6a122f9ed2e599d75634b4dd543c145083", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752678, "uuid": "bed1f6f7-088f-42c5-8420-a920cbf16abe", "value": "EA33F11131CD1AF19AE2D11F2F60524BCE4E3B9CAAE28945DE6E27049F8146583F3BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752678, "uuid": "8dbe6066-086a-49db-81a9-87321917cbfe", "value": "1536:rOZ6jkOgRmtPHH7piM+VmhWwvdW4ZVFW8i7:rOZQOi7pAG9PVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752678, "uuid": "de461511-a438-4baa-875d-078e272c49fa", "value": 50870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752678, "uuid": "9f6c940e-035f-4327-bd1c-40d8a1ffc377", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752678, "uuid": "16a2d0cd-cd2c-4e98-988d-5117d6667407", "value": "168f2d58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9696ed-b22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620718089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620718089, "uuid": "be03c386-3fac-47d6-934b-17ea05d0467d", "comment": "Malware payload", "value": "483014fd59a7cd5f1c93831ed03e6352", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620718089, "uuid": "2a782f04-e911-48d5-839e-99757a6203e4", "comment": "Malware payload", "value": "8d631d337278f0386be236e7dedddeb42712fe096612bad7291327993c9dcf82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620718089, "uuid": "b5713444-e23e-4bcb-904e-d4daf7363cd5", "comment": "Malware payload", "value": "2371ed301f27a1fc0b908c71e99c4efe7608b4a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620718089, "uuid": "2a1e23dd-3e7a-4075-8da6-e1509bf4f4cc", "comment": "Malware payload", "value": "364031a9d15da7aa5c915552a9cec9b0fdfbfa96e3a91a8ac0130fd4a6ab232e91b889d32ac3851ee5b1808865c8c77d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620718089, "uuid": "5ea5d57d-1ff3-427b-8b49-44612803209b", "value": "25B5336A825189D9D2DD417B285BE372C1707D200716EBE616ECFE3E3681C2A3C75CE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620718089, "uuid": "ec677083-9717-4b2d-a7a5-edb1dfa04f93", "value": "502a9a18063f9134a7956cfb7497722a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620718089, "uuid": "96358959-b9d9-4d3b-b379-d2b84d8efb49", "value": "49152:GTEsswCElNadQJ+ZpWLnYbvaNmIFfaHE6TfU5fKugfS0IEa7Ec7IM:rs1C88Y+ZpUwAXCHE68SMxXw8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620718089, "uuid": "30cb4f44-f6c7-4892-a5a0-7cab816c0c0b", "value": 2482796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620718089, "uuid": "e8469bb2-b62e-4b2e-9436-8bdbf90e24dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620718089, "uuid": "5a867237-78f0-47eb-a5b9-08273589c504", "value": "main.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75b7a75-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620714747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714747, "uuid": "7a15da00-02cb-4e11-8ca2-328f64f41e21", "comment": "Malware payload", "value": "80b3365808440838596864bd6d492c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714747, "uuid": "a1dc9d72-be97-4b3c-b466-6e8291368326", "comment": "Malware payload", "value": "8d6f73da5150cd26789a9a0e0643f69b520306680523d91cb21438ad2e6fa80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714747, "uuid": "5d56f961-1cf7-48b7-a2de-9463783aa17f", "comment": "Malware payload", "value": "ea14e621d263a3754234a65bc76cff61bf9eceab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714747, "uuid": "cdb4791d-9267-4300-b0cb-37248668b95b", "comment": "Malware payload", "value": "87671ebae94798e2f6355351705f8c95551bb580924820a3459d0b0735c74f9c947a0bbbc5e3d9607fcd1b3e2444904d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714747, "uuid": "648504f9-6f98-4a6d-9189-f64678562869", "value": "7024C946B780FA11E53D9A755BA3066E405BBE300C4EA907C142375A2775EC3C73BAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714747, "uuid": "ebed6243-ab71-415f-a1c9-845dd4659b81", "value": "263c7af0bbeabd79b6d008518dc45217", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714747, "uuid": "e5d3076b-dbd8-4011-92ae-83f31fa1851d", "value": "768:OAXQMQNI4JuxzJ4j7gazx8RazCmE9ejxvZZHlPbUlmFZ2/5Pj3KZhmOwk/Z2ZOqk:HQE67XsaGeBnVYlmO/tKZcnOYaUHfwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714747, "uuid": "ed463cc8-4540-4c33-a875-5c4726fca8f2", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714747, "uuid": "a957ea77-9c16-4824-90fc-395c4e82018e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714747, "uuid": "37fe57a7-5645-48c9-9225-ee2f7f764910", "value": "POLITICALLY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86312065-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717268, "uuid": "0992155d-2c19-40c9-87a4-1dd50ed0432d", "comment": "Malware payload", "value": "539398c1554ebc30f458925d425d16dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717268, "uuid": "bf3d0fca-21a0-4df1-85a0-3423c1d620fe", "comment": "Malware payload", "value": "8ea0c7e99067c4f9169b505c5072df49270b46129e1aee1e78e4236472a7c382", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717268, "uuid": "3637fc1a-e40c-4fda-b945-7babbb2cf7e6", "comment": "Malware payload", "value": "c37e1efc01fa39f240e4dcdbbcab12fdf2c187be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717268, "uuid": "b96efbe6-1eba-4239-b596-3b3549590fcf", "comment": "Malware payload", "value": "617d3d2202a556dd54421e625499794c037a7fa37bad55e5f5209f8b240d16887cec63e797e85702217610400e7e628d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717268, "uuid": "a860ac62-0bfd-40af-a467-cc074770a41b", "value": "23329E0327EA064CB2B6AA49823714350B77BE96A53DC70D01CC795D9FF39485C6ABE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717268, "uuid": "f29c390b-2ffe-4714-a42e-6ee4d62402ab", "value": "192:3kfGH3wjGBfLqOohGHUaNwj2BMeSHTf/yH5Fu:3iGH8GHYj2BMeSHTf/yHbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717268, "uuid": "58608f71-5a4c-458e-82c3-7ee40f353465", "value": 11682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717268, "uuid": "6f2b62a6-c9ac-4c8b-a1e8-fe9d39572a17", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717268, "uuid": "10055116-c8a8-41fa-b08d-d1a9a1ea81da", "value": "hqsmgrbj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d24a2cf-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620720125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720125, "uuid": "503bf48e-f557-47e1-8e23-9e310989041f", "comment": "Malware payload (AZORult)", "value": "3b0c07c41b797f2b0ffcae966cc9a82d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720125, "uuid": "fc39e2bf-f59e-45ee-a045-d91388c6284a", "comment": "Malware payload (AZORult)", "value": "8ef2d30adee7c780cf545fa682c0b3d5fe6888b98aa44a672a6aee0ba177f550", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720125, "uuid": "38bcd2c0-4c5a-4212-a287-4d4b3af23218", "comment": "Malware payload (AZORult)", "value": "b672f397332baea3f71459132820c2d95af8d2b4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720125, "uuid": "4f92b1e7-547d-4927-a5d3-0da658ae8bd5", "comment": "Malware payload (AZORult)", "value": "11e34e9460d24a51ba3f54164f1465835e2239263419a8c10f851fe41fa716c8c5251dc6c0bf3d51f7284f00575994e8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720125, "uuid": "79829d39-694d-474f-ad5a-5d834a99b4df", "value": "0404E0B6B2D9DC89C98903764DE6C1D76663FD62AF12924B3389F30E1F756C0884271B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720125, "uuid": "f26eb2b4-f07d-4386-bec6-3e3f36cb79b7", "value": "3072:tk3hOdsylKlgryzc4bNhZFGzE+cL2knAQkqIrBXuHlU1GEha7rdrligZtYnJ3TSL:tk3hOdsylKlgryzc4bNhZF+E+W2knAB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720125, "uuid": "3ead2349-f2ce-4363-9258-ff7bbf0b6edf", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720125, "uuid": "947a3d8f-cb7e-4c0c-83d2-3040471e4d15", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720125, "uuid": "34d20bf2-54e1-45db-bd17-5ff1e9deb9e2", "value": "3b0c07c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e82dbac-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694868, "uuid": "1e34c164-1987-4e48-bd1b-527b79090862", "comment": "Malware payload (Dridex)", "value": "d860165ad901619ddcfd981e3d673bbb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694868, "uuid": "df250cba-8f8a-4ed7-879d-24e0b350aa2e", "comment": "Malware payload (Dridex)", "value": "8f515a0497e5097d21ddaa0e1605f382f2ccfdd0675f07041d42ed3f1684c63b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694868, "uuid": "d177a80c-a5fc-4124-8abe-a5bda8df352b", "comment": "Malware payload (Dridex)", "value": "5e67522df9cfd86ddd4af489c7ea346a89821dca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694868, "uuid": "7f79e957-131d-4230-b26b-ff641ccb5a5c", "comment": "Malware payload (Dridex)", "value": "e4298474ee3b55002701403b569964418f1f1848a7edd8ef94c8dee83280e0f9b6a2d023a320fafa45f0cc64bdfe34fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694868, "uuid": "83b7d275-064d-44bc-ba98-da2bb6486811", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694868, "uuid": "d6133ebf-79b1-4a6d-8c64-d5651bf68fc5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694868, "uuid": "df090327-693e-4e7b-93ee-3ed52a3f4d06", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694868, "uuid": "a61717dc-84ef-42f6-9983-60231207e02c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694868, "uuid": "d9388cb5-1783-4df5-93e4-39cd48c84961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694868, "uuid": "3c231e2c-92e2-4a34-98fb-9430bbbc3349", "value": "d860165a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5d9617-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728928, "uuid": "2e8546b1-f4d2-4d3b-a1b6-c040f5da399b", "comment": "Malware payload (AgentTesla)", "value": "478df22800176813fad74c3dee12c8c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728928, "uuid": "190c8592-0e1b-482b-be5f-0cc4a750dcf3", "comment": "Malware payload (AgentTesla)", "value": "9115557e99de157473228d93416040638506bd166128351196200f424128a93f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728928, "uuid": "b9619cff-2ad7-4c48-8245-e4d1ffc1e211", "comment": "Malware payload (AgentTesla)", "value": "03ba205b6e92d763dea64ccc7fa9cb95b6e68536", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728928, "uuid": "907e6dcf-a634-407e-9764-b45f5670209a", "comment": "Malware payload (AgentTesla)", "value": "477319d58d75c0b3d0c554a6bd11bfbe71fd0fadd90d45ae94b77a15e814f8cc9da40ef851605d8e58d692a5cea4324d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728928, "uuid": "5d143663-dd7d-48a1-9ed4-35ddfd5d3382", "value": "F21538802666A19DD0713EBDA13134E003B8EE27F9E54DD7429C7B22FDFB9111FA2925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728928, "uuid": "2005df61-eaa6-4b28-bdf7-0b4bba20c24e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728928, "uuid": "e2503c56-e7df-4832-85da-2eaffad176f3", "value": "12288:aCKxeayECYp0Q/L778ddkiC9ZGFbvVuVYqyHMva+wPDbsicTPheaR:9IeaE+Eddg9Zcd6YfuGbETheaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728928, "uuid": "83376f03-434d-4a53-8547-cc9e2b1984de", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728928, "uuid": "16b60f11-6683-4ce7-8062-5d0d371d65da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728928, "uuid": "90efa174-2d0a-4f66-ac62-750b006fa281", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f57c6f3-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620712478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712478, "uuid": "7e74fe7b-d487-4fed-833c-aa93f3ffb364", "comment": "Malware payload", "value": "b1173640684a255ed82509ca24ce208d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712478, "uuid": "04998d03-2ad1-4834-91cc-09f9c3a31f8d", "comment": "Malware payload", "value": "9150f3883b58dcfb9d0785132f084152b5ece3783a16c73ad9413d6cd5662455", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712478, "uuid": "5602670d-ac0c-4be7-969b-87b2cff1f923", "comment": "Malware payload", "value": "fcb50566f6172fab17c3c7c49f14444d9bf35c90", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712478, "uuid": "efaedf7a-d4da-4ae2-b470-d4572945b34c", "comment": "Malware payload", "value": "95b77afc7b38d09d339600bf98cf3842199731446f90fa0e762d61dbfcaecf529282c2342eaa64b367973778e0d34e92", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712478, "uuid": "2b636af6-27e6-4d07-b9a2-350e4c730a06", "value": "AA03D057837B8024D75F03728C8C2D2CE616B5A61B437A253736CC0DA6F6633796B636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712478, "uuid": "41ac605d-a75f-4e7e-bf6c-90734a0e5e19", "value": "768:KL7cAx4dTVuspEbjrTiLV4fzJsf7/Ov8T/POQQXIGA9+OlQU1ixW:LVuXfY4fz0dHOcMyr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712478, "uuid": "182f8a9f-35d2-4e9d-9892-e3e0274b0c29", "value": 38453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712478, "uuid": "a31e6116-df72-49a1-8d7f-c3126b48330e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712478, "uuid": "480656f6-3ca8-4b3a-bf17-e493ee7aed14", "value": "PO#014532.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0662268f-b229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620717483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717483, "uuid": "e4e1e6ee-d03e-4ef7-9bd1-3dddfb724515", "comment": "Malware payload (Formbook)", "value": "fcbe097d79c7051e75b2e5049bef5999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717483, "uuid": "e35474c6-f946-4263-b86c-09c2ca8a1dd3", "comment": "Malware payload (Formbook)", "value": "9171cd06885b2fba3cd37d0b3651c90dc787d6f2e432e4a1b13defb0efb36df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717483, "uuid": "abe40048-7331-4724-93bc-d989ce20fc93", "comment": "Malware payload (Formbook)", "value": "c7ddfa799bf4668c240f33e6e117647ba1028163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717483, "uuid": "b1649db7-9e15-43b3-b591-346cd56b575e", "comment": "Malware payload (Formbook)", "value": "0d66243d8e7e1d5689f23bfc3be5f83c2bdc9b60112eb1f71173c7af2c36c6c76f58da580ec1aa6e5b9fcdbf92a57fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717483, "uuid": "a9760352-b749-4e0b-a81a-e5f71a85aad9", "value": "5FD4E0313358AB94E0BEA73980B1850457F1FA1BD335DA8DFE9940DC7966F808692F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717483, "uuid": "f41d1af5-8a57-499f-bb39-e612d9fef74d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717483, "uuid": "b977cb1b-d2f2-4f48-98a8-ecb84b2e63bf", "value": "12288:xx1w/L8rYOLUYQLDnvio4kTnckHdzT+Sb3YUj6cjwPLPwSOBsK9KXb:DQCYASLDnv4MHdz6SkW6OwPLPwSOF9Kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717483, "uuid": "cd64a7bb-8715-45d8-875b-2514ce448b8d", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717483, "uuid": "196b6e75-aba7-475a-bfde-5a690a609a8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717483, "uuid": "fef14f88-abf8-4c10-91b2-770a13263dbf", "value": "fcbe097d79c7051e75b2e5049bef5999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0e13f1-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720095, "uuid": "3108b60c-ccd3-4556-be25-659bfb40f4c6", "comment": "Malware payload (Dridex)", "value": "8f78461bd00743b6f40272e587e16630", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720095, "uuid": "ae9e8a64-fef2-4bec-a267-74d4cabc6152", "comment": "Malware payload (Dridex)", "value": "922d6df4a71ea6ce64b26a50428db0197ca6a92c503c26e59aa3a16a87241c2b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720095, "uuid": "d6c51b84-4361-4f3a-a5ac-22dd498bb6ac", "comment": "Malware payload (Dridex)", "value": "ce826491cc248183f20fca02ad03875b278ddfeb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720095, "uuid": "a1cafe26-5ec0-4855-b175-0d14e0365e2d", "comment": "Malware payload (Dridex)", "value": "accc5349972e3770c0fedac7e516f340c0367d998d5cbf7d8b8aa011d14bd1e67906d60b49e37c10431eac7bd4a52343", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720095, "uuid": "496461f6-9eb2-4bfd-bb0b-328d50a496a6", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720095, "uuid": "9ad7c275-6463-449d-b1a9-1ab303d8d1c8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720095, "uuid": "93cf3dac-0e7e-4705-8997-f31953a19fe4", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720095, "uuid": "6b8929a9-2867-40ee-8648-6b52b10f541d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720095, "uuid": "68e992a5-02d7-4adc-90cd-4d2df76fb60c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720095, "uuid": "8ee7484e-4ab8-41d3-8e73-5e9221858811", "value": "922d6df4a71ea6ce64b26a50428db0197ca6a92c503c26e59aa3a16a87241c2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caa4753-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705709, "uuid": "8f676671-f258-41d0-80b7-5441d4d73a21", "comment": "Malware payload (Dridex)", "value": "881a51a1f05135dc7f5bd9f74a110929", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705709, "uuid": "1d97fb10-5ce9-446f-987b-bb6d016be906", "comment": "Malware payload (Dridex)", "value": "93220dc24a8abcccf01efb4c13eda92835b7e7f9fbf54ba762be1c58f78170bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705709, "uuid": "48d4341b-6cf3-4e9f-a53e-c80be39dab77", "comment": "Malware payload (Dridex)", "value": "246ed710f46f7c4e12f8308ef2d24c804f3c9488", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705709, "uuid": "be535297-6a63-4009-a2cf-4cdb22d42bfa", "comment": "Malware payload (Dridex)", "value": "9a448dd9ffd58200c677f1d308a86dda715d89b98a24f46fd136d028895618d87ffdb1efe1b233e51bdfe0c83ed14493", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705709, "uuid": "2f246579-29c7-4bdc-af34-0ee9dc43e7c5", "value": "58F3D0906A9BDF0ED9C13CF96A96A879B173458C821FD5B4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705709, "uuid": "a17a2c0e-e94b-4089-8d3e-7200187f12db", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705709, "uuid": "5d09b74e-41df-42d3-b265-531194baa9c0", "value": "3072:Iesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLUO:C4+VZQpt5hyPsa1ekiEnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705709, "uuid": "6c36eeed-7caa-4f8f-a6a9-91b646d21b99", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705709, "uuid": "8d5481d4-859c-40a7-b6e4-2feb7a6a7536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705709, "uuid": "c93ec6c4-e5dc-499a-8f67-c430036aa065", "value": "881a51a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f845a7-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702054, "uuid": "6a26e06f-87ce-486f-ab97-d4c3a6891b14", "comment": "Malware payload (Dridex)", "value": "9e0a18e2858a7a54be1faf405f39d2e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702054, "uuid": "f405fd43-8fc0-4351-8777-2deacc28fad5", "comment": "Malware payload (Dridex)", "value": "943cc5c20dc0a80505a6572e334e47eaf7a679ee1062d415b4cf7e21dd883763", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702054, "uuid": "57877e18-9195-4507-aa56-d9b87be7ec42", "comment": "Malware payload (Dridex)", "value": "b3f7f144e628cffb7ee98dc37e7b686812c1676d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702054, "uuid": "c1cbce61-68d1-4184-b357-8095a6cf34e3", "comment": "Malware payload (Dridex)", "value": "3ddf24c8822c66d05eb0763b63c4a676ac7c28fd2328aa2dacba44b7eeee89075a4f16860d4d742d8b4b021c5e11459f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702054, "uuid": "ced746ca-bce3-47b3-bf4b-fee95286fb92", "value": "C5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702054, "uuid": "5cbdf0bb-2c02-4f18-b51b-3e4ae7617872", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702054, "uuid": "91f550a5-de1c-4fe6-af4d-ad93596b4e77", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702054, "uuid": "ad89eef4-c7cd-4a0e-9318-61e3f465e867", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702054, "uuid": "5e266bb8-90e9-4d77-bc21-0d122725f788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702054, "uuid": "9a59e2f0-3df6-4818-92ca-36c72837385c", "value": "9e0a18e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd37f749-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735882, "uuid": "9b955207-fc23-45ef-b463-bfaf98674bff", "comment": "Malware payload (AgentTesla)", "value": "83f6e4e71f9a6638f9caedb14934e3e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735882, "uuid": "713bc211-79e8-4fc1-b461-eab5995e12a0", "comment": "Malware payload (AgentTesla)", "value": "94c45cc52e1fdbdf80a9d376ddbbd316a81d58acc1fa677a09b755e4cff17182", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735882, "uuid": "f6f9e6f5-2e25-46c3-b041-cc4144ffbc00", "comment": "Malware payload (AgentTesla)", "value": "f7b05b5d187510060c810229155f290393fc3482", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735882, "uuid": "89a07e20-7c04-449e-8383-83cf4cc176ed", "comment": "Malware payload (AgentTesla)", "value": "88bf7ef17c7f3c41b91093d38e4b25ab861c287ff3fa2a8342a9f58c3e2afb6f7ef12618a92b34b19ccc125ce620085a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735882, "uuid": "59780766-e143-413a-b696-fa1984b4643d", "value": "6E15013133689FE2F57EDB3D98610148A3F9A906E321E64E7DE509DE0855F8187A3F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735882, "uuid": "9682fe1d-4435-4c3c-bcdd-faa609167ddc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735882, "uuid": "57d33292-61e2-4ddd-82b8-438f13936823", "value": "24576:X+0rOT/RZ0Pf5jN7aBA16DaAd+4LrH+Ytg10CvbtAIK:XG05jNeBA6Dn+meYu+QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735882, "uuid": "d192ebb4-ca46-46ff-8bb8-1eccc76cde38", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735882, "uuid": "cf9e5f1c-94da-4f46-86de-8db79c2ee868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735882, "uuid": "3c01fe72-00d1-4dcd-ba34-7bd3e0f76e53", "value": "po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c26a98-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729000, "uuid": "c9465ca7-8245-4339-a56a-aaa553f98444", "comment": "Malware payload (AgentTesla)", "value": "94516e4ff491086bc06be869293b8ae0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729000, "uuid": "1707eb2c-4671-4e42-b360-d5b4f42f0d03", "comment": "Malware payload (AgentTesla)", "value": "94f41c1050c0fcbc26b11fd97f17a1120ad5f0eab527e86fc9920de437a53e8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729000, "uuid": "b8d36c86-3122-4dc1-8bc3-f52be9afc30f", "comment": "Malware payload (AgentTesla)", "value": "0aa49c9744e22a94537d6caf83af803aa41b10d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729000, "uuid": "3db3a3fd-fc6f-43ec-8b62-da454345f02c", "comment": "Malware payload (AgentTesla)", "value": "402d9249ebd346ace4cf272547288be09440f78bf2e99eb1a70610b87477f7c3173f6cc58aa8ec32aa82942f7ed8a63c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729000, "uuid": "f6a6f212-7892-4d4c-a4c1-516b2dbeeccc", "value": "9A15F1F063A10F67C7BD557AE001D34596F5A60323A2FAC8BDE910D850D2BF24BB295E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729000, "uuid": "59ac8735-6435-4b14-a516-0c4c920f1785", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729000, "uuid": "d27a3536-d1ee-4212-a6ca-82d855013d81", "value": "12288:Lvh310cPSK5SUMain0h71as2vO4PINNd++zMcCXlKwHAZ1LbOQtf/:zh3qcT5SRaingh2vO+IHxCXlKwgbbOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729000, "uuid": "12a3db16-2c9b-4dc9-ad96-dd0d6eb5f5f9", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729000, "uuid": "2e077078-63e2-4c06-8697-c3537c97fc71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729000, "uuid": "cb17ebdb-59d9-4b49-91e4-363eddf68ca4", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0006b55b-b216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709312, "uuid": "f466c1ab-6d10-4114-a057-f3a5990b04d1", "comment": "Malware payload (Dridex)", "value": "75f786e9d5e8c444c2fa5c42e2154876", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709312, "uuid": "e8472c09-bf0e-4b12-ac5a-26a28ef26d9a", "comment": "Malware payload (Dridex)", "value": "95ed3176fa210abe3a5c6e16e95fd50c734977f6204031baca03ea41c7e2f76b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709312, "uuid": "a593c514-d4a0-4987-8bd9-5466e221c304", "comment": "Malware payload (Dridex)", "value": "f8234b826e234562094872e8e224cc9b875f954e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709312, "uuid": "80a31091-b358-462a-98da-09c8a8f997c3", "comment": "Malware payload (Dridex)", "value": "dab252cb4255a6aaa6e1c3e727a1c09036d275f07caadac934d9318d465bc97b6305a606b6f9bc5062c2987a60e6895d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709312, "uuid": "c189be27-e43a-4161-b737-ced5569992cb", "value": "4DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709312, "uuid": "1ced92c0-dfb0-41a3-ac28-431ec6061fa4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709312, "uuid": "822f28e0-63ee-484f-a307-26af5448f58d", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709312, "uuid": "ce1c6b1f-1a69-461c-ada5-9372a8531537", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709312, "uuid": "cb85070b-d243-4af2-ac0e-20c3557ef083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709312, "uuid": "bd345670-94d6-451c-a83f-3256d583ede6", "value": "75f786e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de976b8-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691296, "uuid": "ff4caf76-d9d4-422c-ab6c-4a006b3351a9", "comment": "Malware payload (Dridex)", "value": "6d0fc040517aee9062ea98b7dc7e5015", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691296, "uuid": "c9664216-4d9c-4063-8e57-126ced5e9173", "comment": "Malware payload (Dridex)", "value": "96357af73c57215e2172f81ba412db9f1cf9a584e931741e216769f9c070a476", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691296, "uuid": "4a54cdf3-b8d3-4eaa-afa2-05db4aa57f6a", "comment": "Malware payload (Dridex)", "value": "de950d80169cf61beb803ba7f77d1779bed3672c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691296, "uuid": "7d571e1b-3433-4e66-870a-e56c18f72dab", "comment": "Malware payload (Dridex)", "value": "78ef269b82142f3fadb4d75338c21d54fa8e33f3abb7cd2f723b68dc9d13e8e23edbee2e80a900e29efe91b9242f988d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691296, "uuid": "01b9a154-a360-4b85-8805-b806bdb32b46", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691296, "uuid": "71c68129-1647-4643-92d2-5a9afd247f49", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691296, "uuid": "43ab06a1-6421-4adc-b776-c0e51b7dbe3f", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691296, "uuid": "b4407184-db26-4d6f-a3a7-40455e448e14", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691296, "uuid": "1fde9da5-1f86-46aa-a2fb-03d51ea2ffa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691296, "uuid": "1fc4cf03-fb27-41f6-9397-c1579fbe3aff", "value": "6d0fc040_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb68ed19-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620752683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752683, "uuid": "63ff3b0b-e9f3-4042-993a-db4944eac45d", "comment": "Malware payload (Dridex)", "value": "025448bfa9659c682428ca2fa838ffaa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752683, "uuid": "62b83d1e-5b25-47f4-a41b-482a2ac1b9ea", "comment": "Malware payload (Dridex)", "value": "963f0d0c67573f300f0e38119e6c0545462f472264a8b02a9b10c2dea78e30c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752683, "uuid": "36ef5815-58f1-446d-8015-c637b59ab4af", "comment": "Malware payload (Dridex)", "value": "5929e7f8aaa593b28cc3fedfbc9a31eef86c1dc6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752683, "uuid": "e9b70aed-9ec7-4fe2-8e9f-97cf937444db", "comment": "Malware payload (Dridex)", "value": "ddc0c4c3c91e7332718982cfb8e1e4a0cd7f59923cdfec9a76bcdc209c1ff00f76abe2bd84909c1d93de1f8a19e4edda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752683, "uuid": "500c838d-6779-4354-aef1-733bc537edfa", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752683, "uuid": "d2e38986-ac45-443d-8d27-9860b768b08f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752683, "uuid": "b7921799-f9d5-4e84-96c5-5f9a52a04b91", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752683, "uuid": "0449693b-fa5e-4a55-b628-83a4b2b033b0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752683, "uuid": "a435b358-bb45-47c0-8441-d26537ba2dc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752683, "uuid": "91ae996c-3325-4412-9efb-b59afaf82e6a", "value": "025448bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61d1812-b230-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720892, "uuid": "d0a931fd-c6fc-4e73-88de-4cc7b346521f", "comment": "Malware payload (Dridex)", "value": "0965520fea64675634c97a104068ee90", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720892, "uuid": "6ff0fedf-54ea-48b0-a6c4-07333fc5577e", "comment": "Malware payload (Dridex)", "value": "96433fc794e2e3e2c4bff0eac6b4a1de53651ea8a3789a07ab27ab78c35fae92", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720892, "uuid": "8b85cbe8-768f-40e7-88c0-967a74c1d2ae", "comment": "Malware payload (Dridex)", "value": "111e526da4f7a8ebd326d63d2d9bff6d694ad777", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720892, "uuid": "44d05628-f1cf-4e4d-b125-3f5b131c9425", "comment": "Malware payload (Dridex)", "value": "bf378d4e983e01ca3c206f40041e37c890754dba85bf65cef0ec1ce0b01e4bd525e984cdeb9844bacf4393af702fd651", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720892, "uuid": "3cd69783-288a-4910-897d-41e876bac67d", "value": "8EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720892, "uuid": "9571bc84-b425-4d13-94b8-5b8454392a08", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720892, "uuid": "095c21a8-aae7-46eb-bc43-8e5982fe2acf", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720892, "uuid": "deccfb63-c3c9-48c9-bd18-933678bb6161", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720892, "uuid": "6d432436-25b4-4090-b7d2-c2eafa2b9d5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720892, "uuid": "39a908b4-14ee-4cd7-96ed-15c3d91e428e", "value": "96433fc794e2e3e2c4bff0eac6b4a1de53651ea8a3789a07ab27ab78c35fae92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d797c07-b294-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620763478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763478, "uuid": "80a86b5a-cbc8-420c-8d2b-a2597e530e4f", "comment": "Malware payload", "value": "521b739e9067d9ea113a5bfaf82f4796", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763478, "uuid": "5b5596a8-85dc-42e6-8e44-45aaed308266", "comment": "Malware payload", "value": "96778c7a07e231f2be94bfdcd00b0ba78c2938e3c75fd616f1f4200a8bdef40b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763478, "uuid": "70bb75de-0796-46d4-9cbb-a516003090aa", "comment": "Malware payload", "value": "0631b2cff1c6090df2a03202c7484de1d1b3443d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763478, "uuid": "1877aa7e-4e3f-4788-b6a4-f54d9882b418", "comment": "Malware payload", "value": "4f8162e32f6b2d0606b7235fe23fa175d109b47649e81134c37756f7a5767cb6616c6aca38c20a204ed5ee4961a707d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763478, "uuid": "b65305ec-d13a-4671-8da9-788d492c8e9d", "value": "4BF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763478, "uuid": "a0bb8b3e-3cb5-408c-91c9-4c18265c4b82", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763478, "uuid": "d65ecab3-25db-4872-a18d-d630930b9ec1", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620763478, "uuid": "8dcae427-55fb-4181-aff2-5a437c68c989", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620763478, "uuid": "7e8081b6-a53d-47bb-bc97-905dc48da5fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763478, "uuid": "6cdab8c2-f2c4-4371-91c1-0312266a9da6", "value": "521b739e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef83fb1-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716665, "uuid": "86a24195-ac56-4321-aa51-c10a849b27ee", "comment": "Malware payload (Dridex)", "value": "49c554c9262ca72414598b8579c62454", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716665, "uuid": "ff7c80bb-b69b-4639-908f-31255bf71491", "comment": "Malware payload (Dridex)", "value": "9682d80de06f11c76da89fd6215f7014ebca083dff71e932a0721d2e475d1142", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716665, "uuid": "748678d0-9ab6-473c-baed-b2715559f8b7", "comment": "Malware payload (Dridex)", "value": "07421d4eb0a39642e67fcc4320d4434899b62687", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716665, "uuid": "56d305ec-5965-4d5e-81da-788039ffdf1d", "comment": "Malware payload (Dridex)", "value": "0793d28916cd8afb465e803f89a2b1c2002b6e17903e4b23f2ee163041872f8b93c30ca83815e5ac2cf63a928c40e80a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716665, "uuid": "3b2a614e-b0cb-4b0c-9918-03fdbb5c902d", "value": "48F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716665, "uuid": "48f813ca-fa0c-416f-9c3d-745832627ebe", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716665, "uuid": "fbdbd321-aab0-46f9-811a-68054112e5e2", "value": "3072:yWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:y42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716665, "uuid": "ad6266fb-7b0a-4b8c-91e6-07d2df29b449", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716665, "uuid": "5264ca51-3bb9-4663-8cce-841b17c05718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716665, "uuid": "96bb97b0-3ac9-4414-a481-0fadd46d50bb", "value": "49c554c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b15321-b230-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720753, "uuid": "77648100-5a04-4b5f-b1dd-0326e1e016be", "comment": "Malware payload (Dridex)", "value": "194a7797c0c2d72fe454c5233ac33777", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720753, "uuid": "9c79b2b6-c786-4ef6-8802-090d9ecf4562", "comment": "Malware payload (Dridex)", "value": "96a9e6a87deffeda0adbe6f0dfc6b84b3550f03409b10520d97dee2c230698f0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720753, "uuid": "06b9aed9-41d1-4ed7-9418-276be055fb2f", "comment": "Malware payload (Dridex)", "value": "17e2f620ad0fbff4f16f62ab672208e8533552d1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720753, "uuid": "2cd74c04-1ab2-4f7d-ac3a-e1618b04c5f9", "comment": "Malware payload (Dridex)", "value": "4f10bd1d8d1c27ccba0be91774542d77c523d30f1fb1ed378a549829fbb99b0fb8ccbe7f6463e8401871a8d3bdd5588e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720753, "uuid": "309235b8-2239-4a11-9377-873ba5d1ca9d", "value": "8EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720753, "uuid": "dad104f5-a582-404c-a616-1da5f3784c7c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720753, "uuid": "cee0117a-27f3-4081-887a-2c8775a7b814", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720753, "uuid": "015d627d-e2a7-4ba5-a7b8-f8a14a7857ae", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720753, "uuid": "9a04d756-d77e-448f-b078-fc056d7e18f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720753, "uuid": "ae67e856-a09f-4a4c-ac38-02ac627b2ae2", "value": "96a9e6a87deffeda0adbe6f0dfc6b84b3550f03409b10520d97dee2c230698f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e48fe4e-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620740877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740877, "uuid": "5119fe5e-1ef0-4dca-ae83-b8898f648cb4", "comment": "Malware payload (AgentTesla)", "value": "0266f5352db7db41d66942cb8fea548e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740877, "uuid": "2af6d5cc-f669-42d8-8299-dde668ae225b", "comment": "Malware payload (AgentTesla)", "value": "9719ef0c13fb328372e4037db03bb12d16cc226e2a0a8c15e0622e2d610ff017", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740877, "uuid": "435d3d27-f4a9-47f9-ad67-287690fc6eaf", "comment": "Malware payload (AgentTesla)", "value": "94facfb7e00854ef5ebb5578f2931f97e1e3afbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740877, "uuid": "917cd32d-c5af-4ffe-9889-c2ea698c2cc6", "comment": "Malware payload (AgentTesla)", "value": "fae2da5024c9b7233baae37cea6a1da624f562dab6161da34003b647dc7261fbf74902e69eadfce8f7f7164bc550268f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740877, "uuid": "851708b0-2460-4824-b33f-994ae485d2f8", "value": "F71507FC71D0E1F8C606493267CA3C3143F40970D936A90A9BADE7F98626D672F3558A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740877, "uuid": "b82b9f2c-cdc0-4107-a435-0b06227bb238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740877, "uuid": "683a10dc-1de7-4c63-ac57-01bc32593370", "value": "12288:/oLLoS60/K7yh0PSQaTgfK7Sux763BFSWcS2BG3014Gjnixzbktq2f4yJPIlkbTX:/oLAPkDmQ76fJ01ZixfOq2fXJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740877, "uuid": "d57eddb0-a1af-4d67-ad34-d6110a454346", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740877, "uuid": "2af0dc43-e5b3-402f-883b-82987149178e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740877, "uuid": "1b943ecb-3abb-4552-b3a4-1c3f18afdaa5", "value": "ABSA POP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17275f1-b210-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620707113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707113, "uuid": "e74e0a84-43f0-49a2-a40a-43695aae95de", "comment": "Malware payload (DarkSide)", "value": "78d080e27c4e75fbd8945af34a338958", "object_relation": "md5", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707113, "uuid": "db57bd5a-39f1-46ad-b67e-182ae33dde6d", "comment": "Malware payload (DarkSide)", "value": "973dfafc3051d8c2849f62c556ab8057da706f15d1ffd8871de894ae3a24d86b", "object_relation": "sha256", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707113, "uuid": "41c6b10f-23a9-4cef-b47a-c441f3ec6d07", "comment": "Malware payload (DarkSide)", "value": "dfc4f8f01c18e8b9979ea1d5f67a2165a9de1e5d", "object_relation": "sha1", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707113, "uuid": "7399c309-ef37-49fd-bd63-bdb04cf9fc7b", "comment": "Malware payload (DarkSide)", "value": "e77c134ae50b1cd6e87b5509b36b38c4bc629976f0236f976fd153763b55e3cd0ccfd52d8be56dbc46fb7a55cc870aa3", "object_relation": "sha3-384", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707113, "uuid": "dc21c907-69a8-413c-afce-5e89fb583143", "value": "57037C898659E273DF5412FA6EAC7BE3665D2DF1C627905B06240F64A4348B3DF0073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707113, "uuid": "436a2568-e780-4af4-8e4c-d8c490334101", "value": "b9eff3ef84e2c498e581399154cc6576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707113, "uuid": "7eab0acf-c60e-4a3d-9c8c-7c4379934c10", "value": "384:royzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIt:ro4EpThIpEdauX3hS/sj5kGudUj9Vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707113, "uuid": "0dd96331-94b2-4761-bc5e-a42905ac68ff", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707113, "uuid": "1b785812-4680-40ba-90e3-44741dfb8feb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707113, "uuid": "c0fea458-7bbf-46e2-bd93-664b780bbfae", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cd2f90-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620712248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712248, "uuid": "1d4c8047-0f0e-4832-8148-8116f240d214", "comment": "Malware payload (Formbook)", "value": "474eebe540c78d46f08364862a541153", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712248, "uuid": "4619f1a8-d7e6-49a2-81ad-fd6166ee7131", "comment": "Malware payload (Formbook)", "value": "975d26e2e3cbc36e78c184a98bff54686261c65bba363d93391076b6a248b486", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712248, "uuid": "3352b3c5-fc44-43a3-b972-99c1c9f13c97", "comment": "Malware payload (Formbook)", "value": "14e4864a5085a64c0cd475d6f758b987e57397b2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712248, "uuid": "b1e23f73-7035-4867-b001-bb111c8d7895", "comment": "Malware payload (Formbook)", "value": "7066c2a536fa4c68cdaa5714046f1c438597194bae2f8da30ccf947a3ddccfe51b0baa898fff8881b217545dc5178ed6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712248, "uuid": "fc0452b7-d7bd-4cc3-ab03-dcd82bd7233d", "value": "2A340192EAD099D2E96101F00EB7BF57AB955F54806E9B5B57F8BC02FC336C2041EC29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712248, "uuid": "97570ebd-1ac4-4bea-ac33-4cfef9c1b0d4", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712248, "uuid": "709c19da-3087-47cb-b129-63eea3fba6e5", "value": "6144:O9X0G9W7qKqm7suDLODdIuMfIi1y+kyiETu7cuiRDQme8KPQ:g0O0q+suHYddi1y+RiD7c7ZQTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712248, "uuid": "cad6d35b-4e19-4875-8ba8-9c05efd43792", "value": 249594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712248, "uuid": "006aa103-c7ed-4c6e-b386-2fc11e570c67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712248, "uuid": "783a29dc-4d0c-4ea0-9967-746a657a8812", "value": "BORMAR SA_Cotizaci\u00f3n de producto doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13775ec-b2a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620772343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620772343, "uuid": "4412a0cb-382d-441e-84a1-36c4b136a02b", "comment": "Malware payload (Dridex)", "value": "bcb5f8c6da6103a5bbd4891095f807af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620772343, "uuid": "4646d805-d53a-4b7e-9162-a4afddef4327", "comment": "Malware payload (Dridex)", "value": "9872498872843b5aae813d390df3e46ae02a4cc994ade723e4f5ba2973043fb7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620772343, "uuid": "b85b85d6-ca9e-496b-9ef4-390220eeb0d8", "comment": "Malware payload (Dridex)", "value": "fccc0e19a042d3da003bc4184b32c784ca5dfd14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620772343, "uuid": "7270770a-bef5-48c9-8825-df345d91d5bf", "comment": "Malware payload (Dridex)", "value": "812fe4793e97afd3729faf2284c93183d5c906de75caa55def51aae40496f91937db6f90e9e1745b18629bb576a394ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620772343, "uuid": "1e237a16-7aa1-4ce5-92f3-9f483cca3d0c", "value": "6383F16E4B10C4AFC66A4579D65C9193218D11D21826F0AF30A07F5DBB4BACB1FBF0E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620772343, "uuid": "060fafd3-0d30-466c-a3e5-90bebd66d6f5", "value": "1536:yE7pyuK4Ys4xTYNlME78wVvVlf7u03IxTFLVSSu8KW5W7YQfH:ycK4YBkmIlXsFLg18KuwYQfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620772343, "uuid": "1b168f78-3c3f-4605-a67b-cdf37b7365bf", "value": 84073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620772343, "uuid": "eb1fe5fd-07b2-4a24-83f3-fbd25d811019", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620772343, "uuid": "d6c68bef-5703-4f33-b700-36c0bb8c5c9a", "value": "9872498872843b5aae813d390df3e46ae02a4cc994ade723e4f5ba2973043fb7.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9b1830-b231-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620720953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720953, "uuid": "ec9bdfc7-5f8f-4e70-b5b6-5e013542c5a2", "comment": "Malware payload (AZORult)", "value": "c427138d70d3fa5efce7f21360d231ed", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720953, "uuid": "6b1b615c-c9b8-4ed0-8d64-53b7ab6deea0", "comment": "Malware payload (AZORult)", "value": "98c71b2a09aac619e6216958b003368bb896f8c7f18affe28a5756e0442f1096", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720953, "uuid": "3a8fc74f-0e2b-4528-99bc-24e5ee149144", "comment": "Malware payload (AZORult)", "value": "29b88c56300b7bb856e51baca7f2a7504f3d7291", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720953, "uuid": "8f0449c5-d956-43be-9ae0-ae94e56cd89f", "comment": "Malware payload (AZORult)", "value": "8cc88278c0f759d896bef0563e2a6d667a290c1bd63f5d010059688d80af3515b8d7100ccad445cd4cf2cfc4a43a970f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720953, "uuid": "4a29876c-25eb-48f7-bafb-3a5cab64a40f", "value": "4DB3197AF6C19672E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720953, "uuid": "76aaf453-95c2-4985-9c27-1162a938510b", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720953, "uuid": "e2983415-a4ca-44a6-9bfe-a682eac547de", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/oxg/:Zzx7ZApszolIo7lf/ipT/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720953, "uuid": "fbba5650-8555-4574-a0eb-742ba4049b9c", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720953, "uuid": "c5a6642e-8e4e-4aaa-ac12-88e1a276d2a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720953, "uuid": "38cdea12-fdab-4b73-a3b8-c803a2711e03", "value": "c427138d70d3fa5efce7f21360d231ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef2ff1a-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712907, "uuid": "2aece819-ba9c-4680-82b0-05106b5dd8af", "comment": "Malware payload (Dridex)", "value": "0976b5f84353263127dd971b26d3e06f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712907, "uuid": "3b786ab3-85a1-4145-861d-2e77271bf66b", "comment": "Malware payload (Dridex)", "value": "996c59d2864443f47e2fe8093913377f01c20aab9b6c03d609205237064e39c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712907, "uuid": "15cedaee-1ad3-4e63-915d-b9bec0e364bc", "comment": "Malware payload (Dridex)", "value": "5a628e4b6387b510bc5b256e570d9efa9268bb70", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712907, "uuid": "8ffd863d-430e-48a8-992f-5f9fa1bd722f", "comment": "Malware payload (Dridex)", "value": "611889ee4c160e1533b26cfa30d1c2a043d776d99c379dece20fdc2d7b006afba3e108c9c053c07709fa8e7f8635eddb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712907, "uuid": "c44924c9-3b57-4324-9320-60bb5c2b6f9b", "value": "B3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712907, "uuid": "c4cdbdff-d59a-4f3f-bb3c-e85c2683ada2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712907, "uuid": "f8dad572-f3ac-4087-9bb2-3d7f6bc7ea27", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712907, "uuid": "c330b547-51ea-4f45-be07-aa1d42bb7280", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712907, "uuid": "76977e4b-d2cc-4a73-bb75-e9afaa5e4479", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712907, "uuid": "23ee39f5-7d58-4c03-95db-f7438fb6b627", "value": "0976b5f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05087aa4-b254-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620735949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735949, "uuid": "d97f5752-21d1-4dcc-98d8-d5b12dbd5b9f", "comment": "Malware payload (SnakeKeylogger)", "value": "dac3ac141a3e0abb27839284a1df864c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735949, "uuid": "93bd0cae-9861-4b8d-8090-82919775e917", "comment": "Malware payload (SnakeKeylogger)", "value": "9af68d42d1d36c20d81306679715a6f7e3d427d8c039344653f4ec6b43cd7ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735949, "uuid": "76b77edf-3787-4f77-baad-64a9f8f40873", "comment": "Malware payload (SnakeKeylogger)", "value": "8802717f07d933b2478b0cae6f410cce79b9f0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735949, "uuid": "492d6bbb-52b4-4d17-b21c-233f9ce1afdf", "comment": "Malware payload (SnakeKeylogger)", "value": "8cd7839deda019f9d1e02898fce2d502ac883520c063b9461e6614ba93e9f31a55eb83df90735e4743caf9bd4bab9644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735949, "uuid": "5b7461e8-55de-4cfd-81b6-1a4c5c3b211c", "value": "29E28218BF8A42BBDDB94FB825F243821A34FEB668739A0F75F04509DC1B2879D03614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735949, "uuid": "a956b5d4-f43f-4c71-9cbf-ae75c01ed779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735949, "uuid": "cee58d5a-37f9-4a24-90c0-6a5ba3b1c705", "value": "192:E9Viq8E/DO7EB7p+N7sHw7P+zwTZOjAn96M:G18ka7EB72uW+zwTZOjAn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735949, "uuid": "fb5170f7-cc4c-448b-b20d-efe49a13a4a6", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735949, "uuid": "a930e3ca-29a4-4093-87e7-0e0e13162afa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735949, "uuid": "bea46ac8-940e-4353-8155-10777a518827", "value": "PURCHASE ORDER E3007921.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a901789-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705652, "uuid": "47dee334-4d40-4d2d-871d-31c72143468c", "comment": "Malware payload (Dridex)", "value": "4222aac06daf1e18b42af26f8db73c3a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705652, "uuid": "3f7b9df8-6225-4496-b126-546f65473f81", "comment": "Malware payload (Dridex)", "value": "9b817c0a93a1738df4fc442b160310bed25d33f27d722edb3936d4a93414cd27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705652, "uuid": "f619cd3b-3ec7-422f-848c-40e99be9169b", "comment": "Malware payload (Dridex)", "value": "65b8055f13b3892585c1cccc42e2ef3cc52a335d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705652, "uuid": "3cb3ed23-cc70-49ba-a07b-3ae94fa2faf7", "comment": "Malware payload (Dridex)", "value": "7c0f53faa8ef7b89ff0007ad681f82ccb38976df8f8f60cfdca25992d7d9a2cd7ef5b8d53c9c65f993e85a4c5ca1c805", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705652, "uuid": "03e25bef-2162-4280-9b1a-59ab98eb3eed", "value": "39F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705652, "uuid": "17559922-dae7-4d34-ad0b-221d0037e0fb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705652, "uuid": "2c36e7cf-56db-4718-8f5e-0ce5eb974620", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705652, "uuid": "4e9759ba-ae8c-4d05-90e6-ffd21a7a341e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705652, "uuid": "51042338-0197-4c56-8f28-d78570947d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705652, "uuid": "3a416f6e-0742-4a7d-a00c-a4162c01aa88", "value": "4222aac0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1b8df3-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717119, "uuid": "e411a240-ba17-4eae-a6d5-d16a9d0c36d0", "comment": "Malware payload", "value": "d3deecf84a70cad64bea1644f7e435e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717119, "uuid": "53216b01-930a-459a-842c-fc990d5ffc87", "comment": "Malware payload", "value": "9beeda684cf6092a503201b377390054699050a6d8918ff82ba816f7fe4b4169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717119, "uuid": "f8c02573-58a0-4a4f-ab0e-5469c5ea5c23", "comment": "Malware payload", "value": "89e5487c5a6b435accce305e0989932c61d16dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717119, "uuid": "635cfb03-1011-4f58-9c1f-d62cd5b5efd8", "comment": "Malware payload", "value": "f6434a12a9e81371503dd09b09aca0ba034d1deb97eef9bc69cb66edf35da3d9530bcc50743fde52bdfc1d51786eee51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717119, "uuid": "16f56beb-aaa4-4b0f-8244-9cbef4419a46", "value": "3FE20915DBC9833EE233C37935B24851AFFDB10B1E42553E24C5848EA6E1A2396D1F9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717119, "uuid": "d1ee4df6-9f46-4c9d-9ba4-242ca9ae51ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717119, "uuid": "a56d9c01-f458-46d9-8ee1-cdcfe49db16a", "value": "384:1LHJ3f0T2AlOdawNOyMTrMZDkUPUuQ+TuYB4fsdoWSXAWSX6pQ6bn8:fQEA30DkmSRYyfxWqm0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717119, "uuid": "0ca4e726-a863-4469-8972-c08e6a9e35fa", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717119, "uuid": "8e4d4532-bf9f-448f-a4e7-224e07968d31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717119, "uuid": "a73aebc0-ff4d-4ffa-8769-79cbabbf7dfa", "value": "d3deecf84a70cad64bea1644f7e435e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6033af8c-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620694870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694870, "uuid": "7c4dc8e2-3789-4914-8e2a-921b91cb39cc", "comment": "Malware payload (DarkSide)", "value": "ec9866eb862dc9d2b7e9fe6f4a052744", "object_relation": "md5", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694870, "uuid": "36d0ad3a-9562-45b7-ac20-7ee6172c7624", "comment": "Malware payload (DarkSide)", "value": "9c372b7d2656c5c58634d8053183fa2b7cb9da317314e08d299783cedb28c1b0", "object_relation": "sha256", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694870, "uuid": "92cd4f0a-1806-43b2-9042-c50111b6161d", "comment": "Malware payload (DarkSide)", "value": "67ef968cc72749f27a7f60cd99462f9ece1bce6a", "object_relation": "sha1", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694870, "uuid": "71780648-cc86-42ee-ad64-a839d93c0e54", "comment": "Malware payload (DarkSide)", "value": "d023ac6fa23d0101a07156b4bc8b439d0425faf5e8fa0ba2d606aac47bfe51d0c89b7a4c59896de5f6bf6aeea6135ad9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694870, "uuid": "b3b57f9d-9079-4f2f-895e-3888aa0ef028", "value": "52D2F1D53EEA498ED391C1428C9240056F686DDDECB52592E101A1CE034BB71BBFFECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694870, "uuid": "7395fec1-da25-4be6-91d3-b54286c70138", "value": "768:vdVUdoNZ08EeXznroLo+vG/9g9ACzECrLGO:LUdma8xzroLo+vGlwL1KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694870, "uuid": "0e16fa26-7841-447c-93a8-57305e98b2a4", "value": 29723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694870, "uuid": "d5568b48-ce96-4fb8-b689-80b10c59b884", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694870, "uuid": "1bf3f453-b9ab-4f8b-ae19-839e21145cc4", "value": "ec9866eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9185c46b-b26d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620746922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746922, "uuid": "91f0cc29-5b0c-4f8a-b79d-4b65142f7794", "comment": "Malware payload (AgentTesla)", "value": "3d560ec9db66cd5c8b5527000b7c371e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746922, "uuid": "df198653-bb9a-4b70-8aa5-764442d4ae08", "comment": "Malware payload (AgentTesla)", "value": "9cc577a17856f7e178975cc513fe1ce2afdfc5f30bac68852b6f06e18fb0b091", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746922, "uuid": "282b45ea-2ff4-40af-8dae-5f9c1bbfcdf2", "comment": "Malware payload (AgentTesla)", "value": "abc97a4a80eaa7e30335cd2b6df88a5af73125dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746922, "uuid": "16aa52d2-c9a5-4b59-aede-e44815790722", "comment": "Malware payload (AgentTesla)", "value": "8d429bb1a3c899c4d5cbbd540ad02dc3ee1e0a4ed582d991a63f9cf2d2665918310e236d449425cf9fae539960f6cff0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746922, "uuid": "ed70dbf0-69cc-4481-bf70-f8989dfad1a5", "value": "AA052359B3C90678C1693BB59825CB041F79A39D2A23EE9CBD08F27C8F2779447217E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746922, "uuid": "738c125a-fa45-4b8c-8e45-d162d9391f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746922, "uuid": "76aaf63b-9c56-4ef5-8d43-7389364c3d9b", "value": "24576:tf9IX1K3YL5sb9Wt+XoeaWJoVCk9yVlydS0:tlsuYLyb9WtcIWSokYAdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620746922, "uuid": "86d365fd-94c6-4055-99cd-8d3fa40eb37f", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620746922, "uuid": "02b5f716-f073-449d-a12e-dbfa907a17eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746922, "uuid": "e6d5ddb0-b27a-4907-b726-3ab9344b05d6", "value": "SWIFT20210511094146076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4db46b-b272-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620748923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748923, "uuid": "3f0818d0-9767-4c53-8d77-4684ecef9ba0", "comment": "Malware payload (Dridex)", "value": "eb09cc098e5e9a47dbc87efe2dead8c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748923, "uuid": "45595c70-0d35-4469-859a-b7d4df06b7dc", "comment": "Malware payload (Dridex)", "value": "9cce5dd4421b22b787a1bde8892def572915019142147384f9912ca9d7da7ba7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748923, "uuid": "ace784c7-81fb-4863-a412-1ebb6cf944e9", "comment": "Malware payload (Dridex)", "value": "a7b27887d925cc7a3822bca410157c7290f96778", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748923, "uuid": "f80fb3ea-564e-41ca-973f-1cf0aeaf66df", "comment": "Malware payload (Dridex)", "value": "7faa373da2634f0a8e27bb3e0b0986a8e6870b7286eb8a50747a4bbf42d5d7f821180f9e9c177be9db2c08358540c454", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748923, "uuid": "5241f4a7-9ff8-4b50-b854-5954b9d1c111", "value": "16F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748923, "uuid": "9bd4f3fb-34dd-4a3a-ae62-46ea704711f1", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748923, "uuid": "5fc688de-5c6a-48a2-ad5c-e9c51032b966", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620748923, "uuid": "42463f39-1af4-4f3d-8207-b7e057e11934", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620748923, "uuid": "5e608234-dc17-4c6d-90c9-4becd9952683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748923, "uuid": "94b7d311-65e7-4a35-b9ca-dfc2cb45bf2b", "value": "eb09cc09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f26073-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709260, "uuid": "810453b7-10f3-4158-a980-5f65aed844fd", "comment": "Malware payload (Dridex)", "value": "41e58c470883c6be1d1727663ffa0e24", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709260, "uuid": "26f1f515-328d-490a-a0c1-e0c5f4984878", "comment": "Malware payload (Dridex)", "value": "9cd2ec5344c93b079dfe87da5617c85e8fb41c216c9b4d9d04e4be7be4abe496", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709260, "uuid": "d26d469b-081a-48fe-84f4-7f267dfd9f96", "comment": "Malware payload (Dridex)", "value": "9df2e1d76ec3564cb9127ee6a9af23a5cf0bd851", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709260, "uuid": "58c08ffb-f078-42ea-b304-3a52d8196c0e", "comment": "Malware payload (Dridex)", "value": "7c642610731104bb30e26299b88cbfc64cca1d3993358878ec1098d3ce43bb6b1d273244f7f99d602ab520de5b678cb2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709260, "uuid": "48370ecf-a183-4602-a4c4-bef1f2b2e42a", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709260, "uuid": "1bda884d-382b-4bb1-a0d1-f75ca59c426b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709260, "uuid": "ce74fe88-3b5c-401d-9d16-b109174feb8c", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709260, "uuid": "c5f1bab8-ea0a-4023-bb43-33cc27e7c8d7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709260, "uuid": "036c031a-1a5d-4d57-82d5-30dcda8965ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709260, "uuid": "60337834-5b14-4a9b-82c7-4b1fac6a6de8", "value": "41e58c47_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a60b9d1-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714725, "uuid": "765dce9d-5229-4fb4-b1df-c78ea4104bdb", "comment": "Malware payload (AgentTesla)", "value": "79cceba3cf50d1638834c479e88037ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714725, "uuid": "cb895b79-f75e-4fc0-b301-793db1625405", "comment": "Malware payload (AgentTesla)", "value": "9d3231435b27ab9cdf3e1f654f3cb48d240aa1636891c62867db3f0036deba04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714725, "uuid": "2a0b29cb-5636-4040-810f-45ecbaf5a087", "comment": "Malware payload (AgentTesla)", "value": "3d8054bfd0affc00505830984f80e44eb7631dc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714725, "uuid": "fef2b2de-a0da-4434-8879-fb00d8aea1f2", "comment": "Malware payload (AgentTesla)", "value": "8477b397b688be680c8e9f330bfc53ab4ab1133671b7c13d0614ba09996dbc12aa5b7695b07266fb788ce266274696c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714725, "uuid": "4bc2d4f8-b23b-4681-88d4-32bd8c98a48b", "value": "3F854A09F76CBF96D13E0F76C003526883F5816363B3F75B29D91AE11A61B898B0F586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714725, "uuid": "cb233de8-d892-4fb5-8ed6-81ea55f4976a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714725, "uuid": "95563994-9f42-4fe7-a63a-7c34b598f3c1", "value": "24576:cr9+vH2vm9CV/0XCGbesLSul7ND4G53u3O4lCs+O29:c92CGXCGb9l77zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714725, "uuid": "daa8d99e-d70c-4445-a118-b029bdb145fe", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714725, "uuid": "61a0b5aa-2258-4dce-a0a9-6dd04d55e33e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714725, "uuid": "5008c133-199f-414c-bd61-6f24ffb62022", "value": "Product Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf9bb0a-b249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731371, "uuid": "ba72a14b-e6bc-49d9-ae82-8ebd746a1b30", "comment": "Malware payload (Dridex)", "value": "e6af2a887a21d037654b13a038d4a4c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731371, "uuid": "51630c97-012e-4b65-b33a-e65d665d36ff", "comment": "Malware payload (Dridex)", "value": "9dc938d4f5181989018631c216be7094f16a2f49e4e4aacbd46993b5d73adb91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731371, "uuid": "d7ae26e6-6a20-4615-b574-db916ca681b7", "comment": "Malware payload (Dridex)", "value": "d64b7a247f5ecfb8c08d0017b12341a493011f31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731371, "uuid": "48c3c534-873e-4dcd-84f5-89ba3ee419be", "comment": "Malware payload (Dridex)", "value": "3d63b8e2e81594da19d5142eed6864708eb46b7c547f58a6fbe046fa499429e1bfe81f70037a9ab743d9cf8616b211c1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731371, "uuid": "ed789395-04eb-4211-a3bd-1472e23eafeb", "value": "17F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731371, "uuid": "add2dd04-8e33-4085-9f2b-6cb2a3a8b31d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731371, "uuid": "efc40d2d-8d55-4d39-8fb2-50f8d420ddf1", "value": "3072:fWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:f42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731371, "uuid": "60808ce8-ab04-4b4e-b0ea-b96e9213ddeb", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731371, "uuid": "4dae4385-7ad5-46c1-a37e-5d37d2172e26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731371, "uuid": "bb0d7010-1cdd-4991-b240-07c660fa68fa", "value": "e6af2a88_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df06eca-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620720100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720100, "uuid": "191efcf7-bd37-4850-a888-ee6cf00d9699", "comment": "Malware payload (AgentTesla)", "value": "d8f8a5b901ea27c8277964d95b4b9d8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720100, "uuid": "8dc26e92-d271-4bbc-9b5a-f44093a519b1", "comment": "Malware payload (AgentTesla)", "value": "9df0a0cb2d01d70a84143dd1c1b0749e5abd2b64546f2706b71da16081e35ecd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720100, "uuid": "ebc26c93-40b2-4088-bd75-8f1993564847", "comment": "Malware payload (AgentTesla)", "value": "a043b4103a42d559e26a6c333214e7e0e865025f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720100, "uuid": "1541a2e1-0058-4ac9-9c7d-ef04e61bab9e", "comment": "Malware payload (AgentTesla)", "value": "6276d4b6fb11893875667339f08258b4b52af690f1c8372011d6037515313b0027fe49e2f17f5069c8912ed3d568d26a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720100, "uuid": "570f58fc-59a5-4ce5-93d9-67f6b0d015bb", "value": "45A422066ED8E701CAF3AA35B8A4C5B53F127F44D813DB87684B326D4B75704C479D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720100, "uuid": "673bf5a0-4203-442e-989e-b3d414606e0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720100, "uuid": "b8c34173-0302-4eec-97e0-675ed5babbe7", "value": "12288:AiHFMw7Y9MA59CyMAn0Px+b+jiuEBbhho:xH+w09tV3b+WtBbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720100, "uuid": "ebd70d61-4ced-4637-a091-fe2ceec0f554", "value": 484664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720100, "uuid": "23398a0a-fa4a-4a26-9770-5f511fb57d85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720100, "uuid": "9dbd041b-d2de-4bf0-9295-a3b7426d3bc1", "value": "d8f8a5b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede7a443-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620753090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753090, "uuid": "d21b6eca-645f-49a8-87cf-b3f035a51578", "comment": "Malware payload (AgentTesla)", "value": "a1b1cf44917a35fd512a05b526e1256d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753090, "uuid": "a499a4de-a682-4b66-a92d-5cf216d82a4a", "comment": "Malware payload (AgentTesla)", "value": "9e01f131107841c788f990a02403dffc3d7f04b4ed0ef934c3f2ccf3c1d21d62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753090, "uuid": "33182a03-eab8-4ee0-89c8-4f9ca6edcc1c", "comment": "Malware payload (AgentTesla)", "value": "5886717c14b12d27a2b7d9e5af8cf2f3b1dbddcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753090, "uuid": "d81bde85-29b4-4b69-8f8e-04a1b8d08820", "comment": "Malware payload (AgentTesla)", "value": "f4f447aaf93fe8c80ebbad87dce5fb64def9ed1c4b87dc925dec5aeb8fff21fc7647b130f8f24741ccb9118afadd925e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753090, "uuid": "91863fd8-baaa-457d-a4a6-33f873757533", "value": "DAF47CFC764468F0D35B5C27B3CF0C1682651270A93B6A0B8B6113BA5A57E273E39D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753090, "uuid": "777200a5-5a38-495c-b875-a896b2c4eefc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753090, "uuid": "4cdb1863-203d-4994-b344-dbe17634692f", "value": "12288:loLLoS60/K7yh0E2e34eXdBYCvsOZfzq1rTPQ/eK6M:loLAEnDX6GeljgeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753090, "uuid": "9e537738-db63-4154-9b80-a56e1165f26d", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753090, "uuid": "918343fe-a35b-421c-b2cf-84124b64540c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753090, "uuid": "9f861c92-a6b7-4259-8862-1599637e0cc1", "value": "a1b1cf44917a35fd512a05b526e1256d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7eda08a-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620716519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716519, "uuid": "51e33c4e-715d-47b7-95c9-e960f864a14a", "comment": "Malware payload (RemcosRAT)", "value": "21edfbb74014d454423ae7043b4f23ea", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716519, "uuid": "2a0b626b-a23b-423e-b9b6-f02c97db93d8", "comment": "Malware payload (RemcosRAT)", "value": "9e226f4878d21f5b1497b6c0d69e452f8a531634b3f8951e51049b5b4cafa8f7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716519, "uuid": "176c6cc4-bfb8-4633-824c-5249e3a6eb11", "comment": "Malware payload (RemcosRAT)", "value": "ac0bd31d14857aa89daab142de5910c0a6c00465", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716519, "uuid": "37bcab01-0017-481e-acbb-0be735a62478", "comment": "Malware payload (RemcosRAT)", "value": "8a6a478fe0dee1786701705fb34dc0adaca1a540c03db5e8db7fbe4e39963bdb23fe19f6962ccdbf2dca04e2393d6378", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716519, "uuid": "d6348978-3dde-4811-a81f-3892d5aded58", "value": "1B25F421A2814722F06E3B34D82672645BE5BE7C1DD05369E6B43B0B4B3F6412DE61BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716519, "uuid": "0380a484-f483-4234-b0d5-1b1e65e2a565", "value": "b64b452434f9b4c79d8cd285903a399f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716519, "uuid": "c4597be9-2518-4ef1-b1b3-afba8faa3526", "value": "12288:/AQUdCLsY8iOnhm8q9vvgh8RWvezDm+hz24S0EmwoKtJ7RXXBLuU/Oy/EE:/AB5iGhyR7PlRMlHVXXB6UD/EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716519, "uuid": "4b10843a-d666-4abf-80b6-b89c0211bdd0", "value": 970352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716519, "uuid": "0b590ffe-38e2-4541-9af6-fb7b769a7986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716519, "uuid": "069a425a-7426-4411-92e6-4f87b690d4ae", "value": "21edfbb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cedbc5a-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694892, "uuid": "d7113545-c278-48c7-b266-0be65ff79571", "comment": "Malware payload (Dridex)", "value": "41907482a6a8cd55a8cf3481d3ee24a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694892, "uuid": "5cad010b-0d75-4959-9399-91fd19f5cfeb", "comment": "Malware payload (Dridex)", "value": "9e904fe0824dbbc9edb284a84f3449afc98278dd02d267ce7c08e3643c71bd3c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694892, "uuid": "bb1d1014-77bd-4bab-8a72-1df1258a0e53", "comment": "Malware payload (Dridex)", "value": "1b957666c5595b473892f182ad4b9f3f82310b80", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694892, "uuid": "696894f4-29c7-48da-8160-7729b0fa459e", "comment": "Malware payload (Dridex)", "value": "a9f9a259e5c86ba2b5f20e83c5dd2fa80900443cd70a00d118742d2e294e224de837e5ca70d9c798b1c45998b229b6f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694892, "uuid": "6f3cef5b-ab4c-4678-8bf4-2c911c98a45c", "value": "2BF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694892, "uuid": "c05134cc-2416-4162-95a2-d6948430c1fb", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694892, "uuid": "aa57c7b8-a482-4461-bfa4-f0045e486d9e", "value": "3072:KWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:K42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694892, "uuid": "55e463cb-cc2e-4477-a47d-167578bca1ef", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694892, "uuid": "586ea820-ffbe-4166-933d-1d53c118e877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694892, "uuid": "3b964803-e1bc-4857-94be-3662abfc8f88", "value": "41907482_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c714ffa-b231-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620721144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721144, "uuid": "8348a877-3753-4791-bd18-d8869e1c4a4c", "comment": "Malware payload (Dridex)", "value": "ed145a14bfbb9dced524c660f5b9a524", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721144, "uuid": "187a4405-f464-4883-80a5-4bbd1f120b15", "comment": "Malware payload (Dridex)", "value": "9f35834cbb94a640efc423688864f7f682c98438e61b3fbe5691aef8412d758e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721144, "uuid": "e51d6276-9ce4-4ac0-97b0-553b7d82b0c2", "comment": "Malware payload (Dridex)", "value": "b5e4611ff7d4777dbb24bdc41b001a85154ba5cf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721144, "uuid": "e641536f-989e-4d38-a2f1-b87d1904b070", "comment": "Malware payload (Dridex)", "value": "3e901f603888c11ea995881e69aade0a40bc4ea6c04618b92d7251c968417945eb07af7f0815ed34904c6e47277ba37c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721144, "uuid": "80ef6b54-ba54-488e-a6aa-29b6e00d08b5", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721144, "uuid": "df1fcd67-cc0d-44b2-8f07-1418e3d34238", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721144, "uuid": "88578269-a40b-40b0-96b4-8ba833a883b2", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620721144, "uuid": "36d44a65-d206-4ea3-925f-4800f4f1291c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620721144, "uuid": "f2813827-b13c-46c4-95cb-129d35afe658", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721144, "uuid": "b717216d-9b2b-44cf-a4cd-3f5bf21d6d55", "value": "9f35834cbb94a640efc423688864f7f682c98438e61b3fbe5691aef8412d758e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69358ad-b256-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737160, "uuid": "4690bda4-547a-4c1d-b060-3cbf28146427", "comment": "Malware payload (AgentTesla)", "value": "e6fd86b4d700cf206695b3bc5d37401a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737160, "uuid": "da4379e9-d1d4-4d96-b7ac-c571449964f4", "comment": "Malware payload (AgentTesla)", "value": "9f5246d9c9dc30f30f1ad1ffaa3e3a5e4b81f51d2b9059527190cd3a55523eb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737160, "uuid": "48c5a164-224c-4c1c-bf45-3746e399a507", "comment": "Malware payload (AgentTesla)", "value": "967a7f18033fdfdae7d6768c4adbe8573e065a83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737160, "uuid": "ab7b7b2e-1bdd-4985-b3b9-075b742fc14d", "comment": "Malware payload (AgentTesla)", "value": "398871f9857fcb09483483c402827eacfbe2f530af1be684f2237c1698a49957c969c156128bd9256a78341e8e7f9100", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737160, "uuid": "8b8c6d2d-bc9f-47ac-af4b-23f87a208287", "value": "16459DAD325077DFC867CD76D9681C24EBA0B47B830BD643A06306ADAA4D997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737160, "uuid": "b2159e8c-7a4e-43cf-a50e-47840a0fd56b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737160, "uuid": "883bface-93bc-434c-857f-f06d37429bc6", "value": "24576:D3GTSrzcS7fOcxtIV3Kvqqu/uOnBbT0htlZMlD9f0YCUE4Hu:bdOcPIV3KiquuO1TCzM/fgUE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737160, "uuid": "e99c4c01-4ca9-4302-b541-c0b5f1552dfd", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737160, "uuid": "a96b0eb0-f94c-4687-9c32-940d5d0f46df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737160, "uuid": "1ad05cac-b25b-4efc-89bd-1a450d0685b8", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44410b98-b235-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620722741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722741, "uuid": "9f252fe4-b263-4156-b435-53577a5f2b80", "comment": "Malware payload (Dridex)", "value": "3a2606a36ef0bbf775f8172b7dad29c9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722741, "uuid": "963ec0da-9a8f-4a4c-8758-b2655e1a8b12", "comment": "Malware payload (Dridex)", "value": "9f96cbd00b9a448c032d7e8e78b194a739b848a03bcba8419acfa99db0ba65b6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722741, "uuid": "8d1f1d38-a825-4da0-8d4d-686edcdb22bb", "comment": "Malware payload (Dridex)", "value": "2f7cc983bc0e74f1d6a72b8df624b62fa934a438", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722741, "uuid": "42fe9f28-ffeb-434c-b08b-d49a626b3a65", "comment": "Malware payload (Dridex)", "value": "4e8e1f5afc8c04ddb141a8544f5dfcab38d076522ce8dfaded1b430069af57c8ae3a2bd74cf88dab7006f68d4229bd41", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722741, "uuid": "79e5828c-7252-4c8c-8081-48aa81f9f798", "value": "AEF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722741, "uuid": "4de4b241-ac50-49fe-982e-5671fe43eaf9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722741, "uuid": "b75c59de-5fb1-4dfa-9782-afae8ad215b6", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620722741, "uuid": "bfaf1dd7-5d55-4798-9eb1-ae0af2729696", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620722741, "uuid": "06a9efaf-7693-4a04-9b43-e674e716c884", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722741, "uuid": "507cefa2-f2b7-4a55-829c-1deaec4c603b", "value": "9f96cbd00b9a448c032d7e8e78b194a739b848a03bcba8419acfa99db0ba65b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7498870b-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716809, "uuid": "ca7e8e23-583e-4f86-bbe4-62e5c326f951", "comment": "Malware payload (Dridex)", "value": "40091685939e2ed905fb541e4e53a200", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716809, "uuid": "7d0acd65-b3da-452f-bb05-84954cc3ab75", "comment": "Malware payload (Dridex)", "value": "9fa6a2faae7da4fb6278b7c56871dd2392a0a84207a262595aa21594e27ab7c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716809, "uuid": "abaef961-770b-4615-bcda-9907402c7698", "comment": "Malware payload (Dridex)", "value": "232cbda59bcb6840bdb1bd98877c9667aa562f4c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716809, "uuid": "d4667039-c274-4f7f-bd39-48e3cf2454f6", "comment": "Malware payload (Dridex)", "value": "97ada7238a86bb4bc5d45199ebecb1d673b4abef2320bfe292b864c60a805c0034b1951f1a2908936b2e470d7428ecb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716809, "uuid": "d96b5d63-009f-40bf-bac9-5164164d57f5", "value": "F7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716809, "uuid": "18701c7c-7a49-4c53-bb83-2d9c39f8d33e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716809, "uuid": "9475da76-851b-4f1d-b0b4-475edf1659ff", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716809, "uuid": "144bc3aa-3224-4956-8d4c-1b8afa08d466", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716809, "uuid": "860fcdf5-c4b4-44f2-b3a2-74b5d7f995c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716809, "uuid": "08f7e3a5-5edb-42af-bd3b-6ccf7c71e18d", "value": "40091685_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741d226b-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620727546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727546, "uuid": "4adf9316-1f40-41f1-ba34-8ff411d7db44", "comment": "Malware payload (Dridex)", "value": "63c873d106477cf30b508d7d05e93c8a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727546, "uuid": "8be9b579-1827-4fb7-ada7-70d27e896104", "comment": "Malware payload (Dridex)", "value": "9fd064280b6d93c655d2ba0b611bdb9eadfac9b7bbfa9a8c5c3c6055f57b0eeb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727546, "uuid": "d3bf83b6-f8e9-43d5-9b0a-d6f696b37076", "comment": "Malware payload (Dridex)", "value": "fb8c290e8a3cb3ab15ba4d8abed72051e3f1e6ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727546, "uuid": "5ab4e12f-a7c5-4412-a527-a5300f5e736c", "comment": "Malware payload (Dridex)", "value": "3792013d7b7db516bd49e9ecf4117135ce195c8ee3c6c947926b57f95dbed676afdd2e5994b788f65c0fac1831d4b382", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727546, "uuid": "86aa2d81-9ef4-430a-94aa-42277bfe55ba", "value": "BEF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727546, "uuid": "2cd73fba-194d-462c-abf9-83f6cc25c687", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727546, "uuid": "515bc478-0342-47de-84ca-e3657bbcb141", "value": "3072:sWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:s42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727546, "uuid": "339cb12e-ccd4-493c-88ba-c7c09261a5be", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727546, "uuid": "4c0aec39-dc01-462e-9e42-173a332fdd12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727546, "uuid": "64efc383-213c-40ff-aabc-e61d43ea315f", "value": "63c873d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3216557-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716565, "uuid": "751254cf-404c-4246-a56c-fc753d12e2f4", "comment": "Malware payload (Dridex)", "value": "bc151f99a8d1d0ea96662fec16bee968", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716565, "uuid": "74b10128-c785-405e-8857-0a279aed6320", "comment": "Malware payload (Dridex)", "value": "a070410f3b2f252af6f4df830e1205e709ff9377484468642cf2648e60aff8eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716565, "uuid": "73f528ac-c331-42cb-9978-8c1dbcc7b5d5", "comment": "Malware payload (Dridex)", "value": "c8deafea47ea8f8e0d81f7fe218fa2d6720ab56b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716565, "uuid": "92276c61-fd2a-4f90-916f-a6baaaa4e497", "comment": "Malware payload (Dridex)", "value": "011ce07948f0c4ef05140fc33a90833edf1a5f0a73857a9020afc980287119398d06c2aec4a2388b10a89f9f9266a333", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716565, "uuid": "63d12b67-ae14-4844-b0eb-7ef2fdc4562a", "value": "F3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716565, "uuid": "1ee383a6-b19d-448c-a188-4527bc4e7c07", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716565, "uuid": "f6a141f6-e948-41fd-b48b-0f246b10b43b", "value": "3072:FA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:F3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716565, "uuid": "74299bfb-711e-44ee-84c6-39d567383e66", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716565, "uuid": "3f606715-2c65-4b6f-8d7d-ad0e9434b395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716565, "uuid": "17bf6434-4f4e-4656-a579-6141ffe61ad8", "value": "bc151f99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b323c34-b254-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620736013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736013, "uuid": "3a689f01-7bfd-4669-a52f-d6bacc4b7f47", "comment": "Malware payload (AgentTesla)", "value": "ab225d22239f5aa695034bfe722fe811", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736013, "uuid": "5441a1bb-9196-43f5-b861-3aa69bbc22b7", "comment": "Malware payload (AgentTesla)", "value": "a0972aa9646c5ce19da5f835b19dc053681d920d799dfaf785bfe0f04c923c18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736013, "uuid": "00562908-d031-44bf-aa49-b856979769c3", "comment": "Malware payload (AgentTesla)", "value": "bc35ed0890cbc6e61c754015bc934fbca024d5df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736013, "uuid": "25aa0b6b-e2d7-4861-85eb-976bf86c05df", "comment": "Malware payload (AgentTesla)", "value": "d1cee1c7812dca6ed2bd76c8ab671c5f6f9ee0b9ded462dfbc75e4c1b1705406769b1db36aa9f67ed088efc8b4c5d7a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736013, "uuid": "4ca026ae-9fcf-494f-8be1-888aef53e6b1", "value": "A30533FEB9CC61A8DBE14C46519CA4D96527B5DC3752B4AB23636FC200ABEC0C434B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736013, "uuid": "f7e482fa-409e-4348-8337-2dbfba921172", "value": "24576:ue7ziZYaG/gnxpz8p5BVdYF6nW64j2+DNEuV2:J6Z8gn8pV9WR2+Ou2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620736013, "uuid": "c613f9cf-74f0-46f7-931d-f1a913b57952", "value": 804602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620736013, "uuid": "06ac5d12-44bc-4f0c-abda-786e2c691508", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736013, "uuid": "454d6641-e510-4b06-a81c-448c8985a336", "value": "FW RE TEXGEEK INVOICE & PACKING LIST - SCAN & SOFT COPY.gz.pdf.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99870307-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuasarRAT)", "timestamp": 1620714723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714723, "uuid": "3b97a02e-8d0a-492b-84be-2c245fdad38a", "comment": "Malware payload (QuasarRAT)", "value": "de345c2937069317cc039fd14ad8cdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714723, "uuid": "0dde9006-06ea-4382-baaa-c1c57626b9f2", "comment": "Malware payload (QuasarRAT)", "value": "a0a941db02eb3b60ac61954c236a11f4470697234f30f119236663b676efc157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714723, "uuid": "2456167f-6261-4bbf-91ef-1bda689cc5a7", "comment": "Malware payload (QuasarRAT)", "value": "adee6c7de423d40ea8355ba5e2a2dbb0fb6b1ae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714723, "uuid": "f47118f2-e2d4-42e0-a62f-9fad4db4de45", "comment": "Malware payload (QuasarRAT)", "value": "1c275425e0a7165383cb0dca3c7a9a0625d195e45065c81ad2c905048a99b41725b3021164cc14241c6364d3adfa4cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714723, "uuid": "00e820bc-ff29-4f3c-bab2-e58f71d081a7", "value": "1454F10276870312CA6468B581DB352823F17FCE1F37D68D7D5E735D4A623A36E06A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714723, "uuid": "0d72bed2-f2d1-4418-a559-ae4b83748cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714723, "uuid": "25603615-becf-477b-92c0-2b11bcffa4af", "value": "6144:mZLR3JTpnK4Fc7lyM1rrSjwJYNSITYFXKKwNY2Gx:uLhK4wR7YxYmxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714723, "uuid": "8f5be0e4-45d3-4428-951b-fc26dca10772", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714723, "uuid": "4ca30210-e09e-425c-9200-803ad6791c18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714723, "uuid": "c70e57f9-1d65-46fb-88a2-89095fa47c29", "value": "invoice_56342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2b1fb2-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620716929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716929, "uuid": "f62d9688-3776-4ccf-adce-88dd06de2d1f", "comment": "Malware payload", "value": "2690a623a402a07ed0544a8e965fdea4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716929, "uuid": "396526dc-1cac-497d-a5f7-1a2518727c29", "comment": "Malware payload", "value": "a0d070b66408654cdcb84784e77914dc355a23c81e3e6ef36362470619c4de96", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716929, "uuid": "d1df73ac-66ca-4038-8006-fe0464845f82", "comment": "Malware payload", "value": "2a56080ad265f5efa3229c3f7a085ef80cbf1952", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716929, "uuid": "e618a4c8-2046-4961-b701-feaac88a0692", "comment": "Malware payload", "value": "912160bbe9e3437f1466531b36b94ccd272d2d0f5d578d9f3f7df7f6357b99f1a260cbde648281d30a8e157d57bbb489", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716929, "uuid": "40b3ca1b-ebb7-4a78-b143-4789fa7850b7", "value": "4492D0C6BD832645F05F3A74F9D3B45DEAB6B88F1128616A02443064CA07D7DBDA76F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716929, "uuid": "a34f78d8-f387-4495-b0a5-3f2a6ec5c2d5", "value": "384:C5ygB13yd1WL0fiNEvrIT+Oz/dZdSV22UqKgvxlLGti2POm80PKUCaDUANV+:Q13Q1WREa+OzVZdSV/nGtiC80CrU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716929, "uuid": "ee1febea-dcf7-4a1c-bc5e-a2c5cb48ba3b", "value": 19825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716929, "uuid": "6e19ea98-8c69-4c7e-8176-ffeb4541bc9a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716929, "uuid": "9bf01ffd-b81b-496a-9692-41ea1d59991b", "value": "New Bonus Announcemnet.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e011417-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714946, "uuid": "2f040d40-8264-47c6-a170-95752ffc81bc", "comment": "Malware payload (AgentTesla)", "value": "7e76181741c0fbb17d579d6a832b78e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714946, "uuid": "d3d1280e-3e95-4f53-98ce-73785b73d764", "comment": "Malware payload (AgentTesla)", "value": "a1499561e9c9c75eadebd97762a2b5638208129bf70e9ec41d1eb88df2830df3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714946, "uuid": "d758c9ca-f5ca-490c-acc1-a7427bb6dc3e", "comment": "Malware payload (AgentTesla)", "value": "936007ab37d2407ff196e802cc4d61110e116c12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714946, "uuid": "747879ad-36f1-4966-8aa5-e268bbffd5f0", "comment": "Malware payload (AgentTesla)", "value": "7db12e6cedaf32647799524020e2379e9bc953c400cc482e41f246818f56886f8e52479c17feb1fbc055a7dc516afd60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714946, "uuid": "a9fb155d-bf37-4840-a5c9-81620d7acd69", "value": "50056CE87144A8E5E3071C7367CF8C11416426B8A53BDA0E2B51673E5AE7F133D3AA8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714946, "uuid": "f6e514bc-cb9c-420c-8441-a9cbd66725db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714946, "uuid": "3bcd06e6-786f-46f7-bb7d-58abfe82d717", "value": "12288:C8BoLLoS60/K7yh0csJ1Wa7EGj8k8WZLYSB3/O0xsiw819xhJMQSiyyjK:zoLATJ7Bj/Z/tsiw819NMQd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714946, "uuid": "20680b49-a8ed-4161-8605-1ce1b49d6e0e", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714946, "uuid": "0c0182de-1a54-4ccd-8490-381f6d6a80b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714946, "uuid": "affa0496-782f-4d9e-9e8f-e63e286a7ab6", "value": "Quotation 68094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cebfa5-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620752466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752466, "uuid": "57a091f5-d03e-4ac5-ae61-4ce204339e21", "comment": "Malware payload", "value": "3a38d85e084e243f612f460dd98989b9", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752466, "uuid": "bbdc64a9-4f64-48ba-adc9-0379a768ff02", "comment": "Malware payload", "value": "a154d528dead8c483f1a391820a99bf7bfb5569cb705beff421c6be94ea8a135", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752466, "uuid": "9d23409c-accf-4fe2-9a89-f2d2eed34855", "comment": "Malware payload", "value": "9b30fc9e8153193086da99e4dc35be77482882a4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752466, "uuid": "f33d454b-3199-4297-9591-3e1c3a4585ab", "comment": "Malware payload", "value": "6b81888acc0ecc2338aeabbda94b9ed8a85f9aa4fe86e711dcb2d9b170ba170bc9d43962b27430d8745028b866ee380a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752466, "uuid": "e18d69f1-bea9-428e-ab37-816c666a4168", "value": "0E552342F240C783F96761BA4493C9B9827EEE00A116A597372E773B747EB3017B531A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752466, "uuid": "e29c08c4-9c51-49ac-9362-83b9aeb78fa6", "value": "24576:X0Uf65nzT3Hdtqdz7ScJjymt5oaRyb97G/pyuMZTOmJcrslWhnqi3z:kUC5nzrHEz7ScJjyO5oagR7GxMMmyach", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752466, "uuid": "d36f20e6-09ac-441e-a744-22115f77f527", "value": 1314304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752466, "uuid": "b3b579b4-3bd8-40a0-80be-f9a7ee1ef176", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752466, "uuid": "5eab55d0-8e0b-4e65-b1cf-b6ba667049fc", "value": "Transfer invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f797c6e-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715458, "uuid": "d6c83ee4-c8df-44ea-820e-23b1d56067f4", "comment": "Malware payload (AgentTesla)", "value": "3e1d830efbcbe4a17c4eea1fdeda396c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715458, "uuid": "1c0bbd9e-b9f4-4863-ad62-f7a4c8de6d1f", "comment": "Malware payload (AgentTesla)", "value": "a15c7da51880307f2b5ea65bbed80b472fd6d4e5fb31808fc00315675f1995bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715458, "uuid": "9c3d3195-adbc-41fa-b8c0-897e84b13a4f", "comment": "Malware payload (AgentTesla)", "value": "82b43f9477a3e710f38f6ed637054a424c658b54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715458, "uuid": "6184baf5-a087-4d1a-b0e1-2e48ab496160", "comment": "Malware payload (AgentTesla)", "value": "4caecf7398cf18ddd8a3037af8005c32e635a687e22d770692aaa831049b22845fcde206194aaaaf7e8d9964507a60d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715458, "uuid": "d29f3618-c616-4e1b-9868-b5547e6bd030", "value": "D305230333E0A3A4C4BC13B178E19A4087F0D196A914FE892E4966FDAE776D8CE557D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715458, "uuid": "e8023317-10cf-49fe-a9f7-fdcd6670fea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715458, "uuid": "e37c6957-f516-4a81-bb59-46b3069c50cf", "value": "24576:R9mDTmMliYF7F4DJ/hwIUxPk5vhZ+W/W:uu4F7Fs+IU2+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715458, "uuid": "b191f1ec-13eb-4a4d-9372-283000ec0502", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715458, "uuid": "ed18ea4f-a312-407e-ad5a-45f25656542f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715458, "uuid": "1cd13488-83d4-4cf9-a630-2b4bb1271468", "value": "PRQ-30223 RSTMI7-252.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b8ccb1-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715368, "uuid": "741c38ff-38a5-4b8a-abda-d22a60f63021", "comment": "Malware payload", "value": "45068f907806b9146f9f4733a5d4c8d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715368, "uuid": "6d208b1a-6f1c-495a-acfa-aa897fb0e0dc", "comment": "Malware payload", "value": "a16624be76f60cf8925dce62033c0935da75d60462d3f51cba66c06684f6146a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715368, "uuid": "423d87c7-32dc-40db-8377-e78c8d9d9fef", "comment": "Malware payload", "value": "cf07352135747e3a93e7a0c36d86695c633a6a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715368, "uuid": "4b2ded68-e46f-4cbe-a8c8-85f043227e7e", "comment": "Malware payload", "value": "b39bb2936fb72549ca3659667b69151728e63ea703d4e99bbdf5f4fac7afb115471eb7766f5396cbb79f002cd36ef7ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715368, "uuid": "9473dc7c-3213-45fa-81da-72d082ca9f71", "value": "72E4220332E88B14C0BA17B451A3661847F19A2B9355E35E3F8829ED5DF77F582C2BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715368, "uuid": "5a2b632d-1e00-4cce-8d80-4a67ad56cd1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715368, "uuid": "364881ed-c493-4197-be24-8dc1a69e721b", "value": "12288:9qSyiP6Odm/s0DXJ4q5tREU9Ac1ELImibEqk3gB/3BbHXI42TbcP+Vg:M/s6J40tREUJOwbENY/BboHcP+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715368, "uuid": "79333b69-d43b-4467-b7f0-13b9036bf15c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715368, "uuid": "31849ba2-3181-4747-a76c-1668cbaaa8ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715368, "uuid": "9dbe2dc1-29e4-4438-b7f8-d785532e9e4b", "value": "lH1IQ4QOaUfvtva.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c26f87-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "ae319d8d-2e48-4811-ac19-1f0d972c933d", "comment": "Malware payload (Dridex)", "value": "851f3725ff0a372800e7653f7685e6bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "1ec2a456-dc0f-404c-9b0c-07d7ed8d538b", "comment": "Malware payload (Dridex)", "value": "a176f2e3711272d7626211ea4ca9a7b00b3ad0feedcd5f9ca2d342f4094246c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "a4f43b46-3893-4449-910f-785d7e59382e", "comment": "Malware payload (Dridex)", "value": "094b246c9d1e5f0bdd80c0d2b3cf8771c35e5582", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712898, "uuid": "f07258c3-4c7e-4d03-b0bf-caf4dbd09769", "comment": "Malware payload (Dridex)", "value": "154ced396832be8e1b0e7bc4bcd7250af3298134de9f543de0cc6497a35884763783e8d10e096ed833c542bcc439f583", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "e73a201c-7c5c-4589-b23e-e4ec340765ff", "value": "F1F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "dfcd2239-fee5-4d46-b5d0-3237ffac7911", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "df9e5a0f-2b18-411b-b2a2-5af8596ff996", "value": "3072:CiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:BeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712898, "uuid": "77064a0b-5705-4af9-b30f-c0f2c714d9f5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712898, "uuid": "01bf8010-6e21-4b46-9a65-7d82ff97e436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712898, "uuid": "c5483e4f-f586-4db4-bd74-463c79a2d236", "value": "851f3725_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba6625f-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620752764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752764, "uuid": "baa03a37-f061-4caa-9037-7aba2552d1ee", "comment": "Malware payload (Dridex)", "value": "c29ae6ee579b7895321b7991a13cbb4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752764, "uuid": "812978a5-4130-4df4-b431-916eb1ef175f", "comment": "Malware payload (Dridex)", "value": "a1993aacd22d34d80b581c089f0a904372e5d11d1e881a72e8bb401f22e68066", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752764, "uuid": "6e93ea0b-c6ef-4429-a84d-d70741cff37a", "comment": "Malware payload (Dridex)", "value": "25fae2d6d2504a32b50f9b7de69005fb585d733a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752764, "uuid": "ba2be315-36b1-4de6-b201-5815cb84038e", "comment": "Malware payload (Dridex)", "value": "53bfed83d659e1d9c3aa01fd8e346f80cc559662f5797c0ca050304952107322b00396c0c8c343ba8797059b4caebab4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752764, "uuid": "3cfb6679-c389-4d16-add2-e60ed379bd61", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752764, "uuid": "0c016f23-743b-42be-8328-5f2a4e25362b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752764, "uuid": "9d0e6157-bce9-48a0-8c0c-b4fe48c1b50f", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752764, "uuid": "accb1ee1-f359-4759-8ed8-497e777419ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752764, "uuid": "8aca95c0-a18b-4b01-b08a-265580759c24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752764, "uuid": "0c59fec4-ecc2-4d53-acc5-888c340b1d03", "value": "c29ae6ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91379b8d-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705690, "uuid": "4465285a-3c34-4b35-8f52-23f195cab974", "comment": "Malware payload (Dridex)", "value": "f9b6d7c71d62beab184774d88228ec5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705690, "uuid": "0bd473ff-75b7-41f3-bfdd-85df00dc11e3", "comment": "Malware payload (Dridex)", "value": "a1ce50d622398b43a9481d8de9914579b77e69d021ff186c4beeec3b16353580", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705690, "uuid": "f518c2e1-0f95-4d5e-85c6-a767d1f678eb", "comment": "Malware payload (Dridex)", "value": "0c59681386ef1ff937e55cc92499f2e02ce6e70f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705690, "uuid": "4ecc42e2-3f77-4689-a164-57ab696a9ad9", "comment": "Malware payload (Dridex)", "value": "adde89bdc9101d8594b9c0f2cc74680bc969c6eae8b8d1452e037e175700364d51654c6c87584d939e43fe4b9daeea91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705690, "uuid": "04523765-745a-4051-82de-6af82c5494fb", "value": "28F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705690, "uuid": "620e1caf-ae23-4e5f-b281-dc7d463f3955", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705690, "uuid": "1b828f9c-f091-4449-9813-01767f47ac79", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705690, "uuid": "8bec7e7e-b076-4d07-b9bb-c82255b38de8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705690, "uuid": "810eae72-5b2b-43a0-bba9-768dae9436ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705690, "uuid": "15e1fcc4-ff50-4278-841b-44afe1a97156", "value": "f9b6d7c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40f05d7-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620728941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728941, "uuid": "feefccd3-7d19-41a2-a96f-30f477b1731c", "comment": "Malware payload (NanoCore)", "value": "135ab6c14011003e72cc82fabef66b83", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728941, "uuid": "6ce6bd4a-0843-4a7b-b5ec-a03b01ceeed9", "comment": "Malware payload (NanoCore)", "value": "a205490d99143217a75fab698df9a450827728eed168b9659a89218e863deabe", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728941, "uuid": "263b8cfe-eea7-4b95-bd16-6241c5175c36", "comment": "Malware payload (NanoCore)", "value": "cb269c2bd704562b6206a79bd25e19f0a3498cc1", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728941, "uuid": "d734851e-a3b5-49ce-be6a-f67670ca4cbd", "comment": "Malware payload (NanoCore)", "value": "4c0c87cd542bb4021a37356c949b9d9dc298aa94c6c854faa4a12a8c3f48531c32e332cf482f8a520df4b01e338e67d4", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728941, "uuid": "48150a22-0528-4d46-aee1-9fd487476213", "value": "36E27569BF8A82B7DDB94FB825E243421B34FAB66C739A0FB9F04409DC572439D03654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728941, "uuid": "823df21e-e49d-4ed5-988b-bf6aa27f719f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728941, "uuid": "4b903f6e-3cbb-4336-978c-526f67cbc060", "value": "192:j6fr/yJE//7p+UTsHw7P+zwTZOjAvPIM:j6fjyJEX7f2W+zwTZOjAvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728941, "uuid": "2ec3db3e-c62c-4b12-9ef8-a9c17def5ce6", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728941, "uuid": "b9fb741d-434e-4884-9dec-7ef732cb2ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728941, "uuid": "4bbf7993-dc3f-41b2-a9db-306663b4386d", "value": "Waybill Document 22700456.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123d1262-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691304, "uuid": "2bae4dfd-347e-4b6b-a7fc-58ec9e464e2f", "comment": "Malware payload (Dridex)", "value": "cc12a25a583aee27501a24f48ba5c431", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691304, "uuid": "a556891d-994d-4d7a-aaa3-666fecc79f31", "comment": "Malware payload (Dridex)", "value": "a22c90267ee2c1ff2c83e37e8ca9daa572e1366ee4b0391785eff8d9ed80024e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691304, "uuid": "8add135b-2b7b-4978-b737-496bdbe3e469", "comment": "Malware payload (Dridex)", "value": "66550589ced8154aa2094b1dfe9b8d87a2e91eb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691304, "uuid": "7c9e3f72-6197-422c-94cd-e830824a14cb", "comment": "Malware payload (Dridex)", "value": "b941b2b1265a28a10d956176d2629a62781caa52fac38151104652a788a934246ba010c783ed5ebff4cd04986ea991f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691304, "uuid": "6d981264-c771-4d96-9927-e6b237222e4d", "value": "B0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691304, "uuid": "db9f4585-26c5-40ac-9b0a-3a951e5bee20", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691304, "uuid": "ad0e5c7a-96fd-44fe-9bbb-3b423151a0a4", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691304, "uuid": "142b9b07-1c0b-4be9-a8c6-ad6ae77006a3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691304, "uuid": "888d375a-b1a6-40c9-a7f9-4c44ef387d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691304, "uuid": "c3b61a29-107e-48f0-ac65-f2a9ff28ba92", "value": "cc12a25a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cbcfa6-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716534, "uuid": "0190c3cf-cdd6-4b08-b6ae-982be22e0883", "comment": "Malware payload (Dridex)", "value": "b5fb623e77a6b280494ef394b677c509", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716534, "uuid": "963171bc-ad65-4872-8f05-c2c9c191f0d4", "comment": "Malware payload (Dridex)", "value": "a2596c088ee7ee3eca5f03a34a7d910ef304c1de275d226ce3b806cc5d98861e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716534, "uuid": "5ce3cc23-ebda-4973-aaf0-3b2db2d12214", "comment": "Malware payload (Dridex)", "value": "f0e2949a1c01f067fb2f46bc010b0ff424226f9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716534, "uuid": "a4d85b56-70ba-4cff-bb1a-f68ca10c541e", "comment": "Malware payload (Dridex)", "value": "ef80953b372838f53070ae4e511be53d69fe05dfa26a6214faf11cb78e33f8e379f0c0f851ac07a1926cb3a3ce4e1732", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716534, "uuid": "899a92f3-a4a6-496f-93f3-4c14225fb76e", "value": "87F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716534, "uuid": "61fdc656-d59d-45b6-b482-20a4beb113c0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716534, "uuid": "c1dc3ad5-37e9-40f5-b688-80cc308283f2", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716534, "uuid": "9961fee7-033e-426a-b1a5-fa7b9b1c3f1e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716534, "uuid": "7bbd1cde-604d-4372-9901-7dad0f06720f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716534, "uuid": "fccf8c10-64ec-485e-9172-5723b8f1b7cb", "value": "b5fb623e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccea798-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620735667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735667, "uuid": "594a0792-28a6-44f0-80df-b2f5009ff308", "comment": "Malware payload", "value": "0d14b3ec06dea5fea741ead03ed53dfa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735667, "uuid": "f215e75b-5bd3-4522-822a-533bd6bfd267", "comment": "Malware payload", "value": "a2c50ac3239268bee63365cd08e8b27373f35a23b115aac488c99ccff6cc6fbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735667, "uuid": "976161d4-89aa-4e20-a080-7dbdcda3aaed", "comment": "Malware payload", "value": "c3ea7b2ecf8d8ed315fc7fe10e5a391000ac210e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735667, "uuid": "8807c5db-4486-4f8b-9909-5e9462d1766e", "comment": "Malware payload", "value": "46a08d09e1db90c8c995bd8c685a1e24bd06cc13a1f4c2ec36aa697905c7320dc41605d098810fd068cf093e7e15f65b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735667, "uuid": "7e5b88f3-e765-40bc-8372-025b84996609", "value": "B8055A1AB2D7143BC03706BD492792645C3B7D202A96584A5EFCBF4C1F392A33D36E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735667, "uuid": "27142c6b-da23-4b7f-be64-7b1f518a219e", "value": "c00b6ba7dbbc6abee9ace3a65a49ba24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735667, "uuid": "766f190d-f32c-4dd7-a650-c40f923f4d98", "value": "12288:rwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEg888888888888W8888888J:3NzCtUpQ9WWPBSSRMTEpXNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735667, "uuid": "77789fe4-bae5-48ba-9a25-373aef840329", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735667, "uuid": "b03fa4f5-d1f2-4a4d-83da-df6246e4c5a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735667, "uuid": "572e9176-354a-4ee0-8985-c7a5eba4d024", "value": "a2c50ac3239268bee63365cd08e8b27373f35a23b115aac488c99ccff6cc6fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551fdda6-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694852, "uuid": "0f6fa8be-9056-4710-a65e-5c929969ca9f", "comment": "Malware payload (Dridex)", "value": "78219d31bcd3068471ca9e7a0d8dab86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694852, "uuid": "4ef5807e-dbdf-472e-9a88-dc43aa465f42", "comment": "Malware payload (Dridex)", "value": "a2d2572c8a5bbc250056afaf31c96f9e668216f2c340fbf4a4626d102e54e952", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694852, "uuid": "f189d62c-694c-480b-94a6-def0b3280ea5", "comment": "Malware payload (Dridex)", "value": "8fdc11adbd97697be9015ddea0001c258a754d7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694852, "uuid": "4ba3ee13-971f-4fdc-86e7-8303a0f2fcd4", "comment": "Malware payload (Dridex)", "value": "67f02c6f4bae7ccb549647b3ac99b60bfbd82a24379f13685e97df3d08b69c6b30a6b7be3b4604152c26dc203f27ea41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694852, "uuid": "de3df066-0ba9-4561-abcb-01c57919d3aa", "value": "09F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694852, "uuid": "22f56a0b-d5f8-4e58-9228-8f9a026da701", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694852, "uuid": "d8d2efb3-ff42-4c30-9af1-01a2e49f1e84", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694852, "uuid": "d7621f83-9ff9-4787-9b68-baeb266d0da7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694852, "uuid": "7de9ee1d-3628-4c20-b62a-3ef6a00801dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694852, "uuid": "79a17de7-ddd8-43f7-bcdb-12c5bef86e5e", "value": "78219d31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4899f861-b29c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620766986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766986, "uuid": "6a4fbbbc-7fe0-473c-9107-a9670ad61bfe", "comment": "Malware payload", "value": "7c346f91cd13e2459ba8733606a7bd4d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766986, "uuid": "f2172235-84b3-4e15-971c-966f3355d821", "comment": "Malware payload", "value": "a43b45eb147f2ea5f68c9fac3cf8e6f73fb65328070a06b6e3769a95e0899fa2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766986, "uuid": "c07e6e49-bc07-43f2-a332-c5fb13c32cdf", "comment": "Malware payload", "value": "6d0cdb0a49f7d259c3a28b535576b07787de78cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620766986, "uuid": "73fbee85-91ce-4e50-b3ba-b19ecb575cfe", "comment": "Malware payload", "value": "ddae14c9dde01e646a3de1b4a7b571fcb410155a392bc2099725b710b364320b330b5a977488d79f29c10a8089fab3ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766986, "uuid": "7bd757d4-3752-4531-9062-da26e1852491", "value": "D0F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766986, "uuid": "249395ca-d3c6-4497-9612-f7dafc277e5e", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766986, "uuid": "33959776-e46e-485b-9c84-7adb26a7439a", "value": "3072:QWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Q42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620766986, "uuid": "24d21a94-6d38-4479-a65a-ff023d4be60f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620766986, "uuid": "59c47243-c154-41b2-b3c6-84397f021a0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620766986, "uuid": "db4dff2f-dbdd-4e66-a3d1-3a942c6770a8", "value": "7c346f91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851836f6-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705670, "uuid": "f961033d-708f-4e3a-bbde-8b210a517f3b", "comment": "Malware payload (Dridex)", "value": "42572c93355914566f391d76b9878bd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705670, "uuid": "89efa945-3ff5-4d04-94a7-01813ac55641", "comment": "Malware payload (Dridex)", "value": "a451ead97ced2d9f2ad3b2e468f924c117062d96167f2f99a9b0da71e98bc158", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705670, "uuid": "2ec6d4f8-ba47-451d-a004-e889bb1790fc", "comment": "Malware payload (Dridex)", "value": "c00b653d4973b1d844c5246ba816ad693613b7f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705670, "uuid": "787fb5db-b142-4f16-99ef-755eaf8cab71", "comment": "Malware payload (Dridex)", "value": "875cafcfb0e4b90a8d53addfe7ce283cb695dfd984ec21a5cf61574178acf54c42152c399aa7c5cac262bd8b9a210be3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705670, "uuid": "cb63aa98-d128-41f4-9387-307a81ce8e27", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705670, "uuid": "3c1261a8-c859-49d8-b0c8-d7ae237bac98", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705670, "uuid": "1ddb6689-a322-4b69-ab8a-bd25e09d36dd", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705670, "uuid": "93e3c60c-c7d5-4dda-a89b-78cf5fc9c396", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705670, "uuid": "3ef311cb-3b32-4307-9617-d4ea1ff8e5d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705670, "uuid": "8fb360a6-5190-475e-a0ae-949e41329f49", "value": "42572c93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cc5103-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620735736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735736, "uuid": "7d1ac898-ea41-437c-b125-73ccdb2ac780", "comment": "Malware payload", "value": "024ddbd6cf82a9125dba9aa28cc1f2ce", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735736, "uuid": "42ec44fd-6232-4e5e-b6df-9089f0abd087", "comment": "Malware payload", "value": "a5506822025cdb6ad9c70ad8966804c8ca39d3d9c8f4a260492c65b9b4f82290", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735736, "uuid": "c231a355-019b-406b-92d8-cda701a04722", "comment": "Malware payload", "value": "f09dbef05de1b9ef5b1dcce203b8e140502ddede", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735736, "uuid": "b0bf4fc7-4af5-4947-9f4d-2decfa0de93d", "comment": "Malware payload", "value": "c5ee8d75c744596a01294a6a95094415bd4814e7665e6c3a1b0631a9c2ddc1075f77e218c71ce959793cf89fa35c0ba6", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735736, "uuid": "51ae5fe9-ccfd-4cc5-beb7-efe379219ab3", "value": "F7227D78C112FC16C22151BDD169C1F0F7399113EA22B52D6056B2AE0FA11C75BDE6ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735736, "uuid": "3fb3c7e7-016f-4271-b914-15660a20435f", "value": "192:ScIMmtPjWU6nG/bARrOJT3iV/WBJkQXMzhtKV3MDeV:SPXaUREOk8+gM9gxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735736, "uuid": "7a1d766f-0ef2-4a46-846a-08b822f1ee0b", "value": 10333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735736, "uuid": "e8898e0c-9d25-4c84-9e24-fec28b351660", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735736, "uuid": "0db0d25c-cb1e-4f34-88fc-7083a62c59a5", "value": "Payment Slip.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a51f1b-b229-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620717561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717561, "uuid": "16457ac8-50aa-4bfd-b3d7-4786299ec025", "comment": "Malware payload (RedLineStealer)", "value": "6371809cc1f36cb84e64c8ff6d11ee32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717561, "uuid": "53447a4c-6f41-4980-b260-0673e3241d03", "comment": "Malware payload (RedLineStealer)", "value": "a5547a483166959c075435073f59aa9a6fff753dd2dca1830bb5a16a9919cdcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717561, "uuid": "3a624d6c-774d-4654-8d58-17985a6fdc78", "comment": "Malware payload (RedLineStealer)", "value": "eb9354a4b8fbd0e361602b8b44d9305e3039e83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717561, "uuid": "39240ac3-fb04-4bda-a196-4e56182e0e0d", "comment": "Malware payload (RedLineStealer)", "value": "91aa3b51223428b4f50c2f03a83609f35cd537876537a36f7cc8dffee82bce2064c42f3c237225e593318331ff95ead4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717561, "uuid": "428a186d-4cad-4c99-9a0f-0e16d9ee5f61", "value": "31149E1175C1C1B2C4B7113044E6CB799A7A7031077996E7BBDD2BBA6E213E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717561, "uuid": "341ddcad-a027-4ff4-b5ba-a093fe5ffbc9", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717561, "uuid": "30f57bcb-0ed6-4cab-9494-f671d14d5186", "value": "3072:WDKW1LgppLRHMY0TBfJvjcTp5X7f+HppGNCf14dpG9idC:WDKW1Lgbdl0TBBvjc/7fvCf1Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717561, "uuid": "12d01e19-ef2e-42ec-8f8f-f1d265286353", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717561, "uuid": "703c4dd2-4ecd-4350-a709-1064fec0b1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717561, "uuid": "f3085c77-184e-46fd-ad82-2722318c94c9", "value": "6371809cc1f36cb84e64c8ff6d11ee32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a7f971-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720191, "uuid": "3b2d35ec-ba3c-4a51-a9f7-cf7c18ed3b19", "comment": "Malware payload (Dridex)", "value": "c9721b27e7e180411b368157486fbb09", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720191, "uuid": "c41ae1c3-3332-4d06-b616-d990d85299d7", "comment": "Malware payload (Dridex)", "value": "a5592c4ea504f9b5ce1c8c019a7bf58aba8af1147326ef0bb245a057de334c99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720191, "uuid": "541b256c-988e-4e6d-838d-e2dfdbd56241", "comment": "Malware payload (Dridex)", "value": "35cc9410eab5f50eb756159d8de56f43bac7db0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720191, "uuid": "bf7d1b4b-69a1-4543-971a-7c3378b731d5", "comment": "Malware payload (Dridex)", "value": "e6911ec5a4cac34742e7c23eb7faae1eed1ea318b05ae7860c0528abd74c82ef3b5b7fa3fc3f041da834d598eaee7810", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720191, "uuid": "37b36753-b51e-4075-930b-9f6d7c84d846", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720191, "uuid": "e71cf0a3-164d-4cde-a104-56745b9fa8ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720191, "uuid": "db7e4147-1b2d-4b63-8ab0-00e8eb4da58e", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720191, "uuid": "81916e41-b834-4806-a267-08e482ad022b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720191, "uuid": "9b0c2199-106e-4df7-8e33-93536cd9eae9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720191, "uuid": "e7a9d40f-b2d5-4f4e-b96d-4be0afa1dbd2", "value": "c9721b27_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ecd907-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620741747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741747, "uuid": "da86d69d-031b-43cb-b591-46eb864d4534", "comment": "Malware payload (Formbook)", "value": "e4101e98b37e7815239bb6afc9ab5c31", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741747, "uuid": "ba185178-986d-498f-9423-e54c0d3d6956", "comment": "Malware payload (Formbook)", "value": "a5c0d3697381d8bb2ea2bb78185398fcc343b7f59816b4d990641178f31fc551", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741747, "uuid": "368aff98-5ec6-4a0b-a70c-37ad8941b4e1", "comment": "Malware payload (Formbook)", "value": "408fd331caa09d1361f860b56a62ebabb6643f14", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741747, "uuid": "70970391-2439-4fb1-92f5-54577f38aa17", "comment": "Malware payload (Formbook)", "value": "82de47723aac3bdf04722c234c42d25f8a278338bf3fb87327c62f4a054a3f7513742e645b59aaae6ab81b89410d159a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741747, "uuid": "838d277a-490d-49c7-b218-8c0bb12318a3", "value": "5BF49D957E5448E1D1578438C96386B6E6B27C055E3C934FE290FBBE9F33252AC1A323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741747, "uuid": "337bc272-8f21-47c9-af9f-67bf701289ff", "value": "146e24575086448ba589e1755a927ce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741747, "uuid": "88e535e6-ff16-4737-b374-a10932ecdb43", "value": "6144:7rTgxddgTv9frsgFfybbpRMp4ihr+Ds0NXi6+TMSnnJvkCx2XYH0yNv93LJ4wge:7rTgxkvRsOfQ7MyNNIJV3HVNRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741747, "uuid": "643c2996-a4ac-411c-a64a-24fdc6406072", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741747, "uuid": "cceff1ef-a636-45d5-bc18-a3611b5dd051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741747, "uuid": "19a3fea0-2943-47f5-9372-bb2f49cce916", "value": "PRF00202156KMT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e5750b-b26b-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1620746151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746151, "uuid": "3a2edf12-a931-4ed4-859f-0658fbcb1158", "comment": "Malware payload (CryptBot)", "value": "e458dc2ba9e161ea08ff8bebea2a469e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746151, "uuid": "4d975e95-1a2b-4a14-a8ca-70e323bf9dfe", "comment": "Malware payload (CryptBot)", "value": "a5c463db805e356cb6e73e5676b397eab265e061c6797e27b626b8b4aee892a3", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746151, "uuid": "4e1fe89a-1e9e-4bb7-a00e-a9710aefe390", "comment": "Malware payload (CryptBot)", "value": "33c3d82ad1a6ae6025f3c6d7230b7182da4b0765", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746151, "uuid": "8d9ab0a6-74f5-4999-9da0-a4425281bf9c", "comment": "Malware payload (CryptBot)", "value": "69263f60e4aa4dc2acc2befc06d90506a3e6482025e8acdb6a927e9ea735104ec906c7d19cfc483fb55d579903c14ef5", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746151, "uuid": "a3504223-4da2-4bb6-9857-5e5702b2f29d", "value": "4CF4F11132E1D032E1B725754575C7B80ABBB4722B789ACFAAC54BB94F24AC0DE3570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746151, "uuid": "534d0805-f022-439a-b2c0-aa3985e0ad5f", "value": "7c7468077fdc0ac19fd97bae9e84d6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746151, "uuid": "defa6514-4f27-4454-89b1-517ba1172d69", "value": "12288:0LbDQ1c1lf8x4vIN92yhfgO8B8dpSfWGklyqJ64Ocg8PZCpdnvkv5:0LXQ1c19e44jgN8dpWWGvw6zcdhIdnvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620746151, "uuid": "9bf42b69-d0aa-40ea-9722-660232c5175e", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620746151, "uuid": "8e149338-d791-4cdc-87c0-1521d4b35579", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746151, "uuid": "bc7d24ba-d695-4a31-a279-f609f538776d", "value": "a5c463db805e356cb6e73e5676b397eab265e061c6797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff576253-b235-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620723055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723055, "uuid": "e54c7ba8-9db8-4fcc-b756-797633d8a877", "comment": "Malware payload (Loki)", "value": "3adc32c54d66cedb755ac6e923d99650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723055, "uuid": "90facdf1-b8f2-40ae-90da-cf249dde7218", "comment": "Malware payload (Loki)", "value": "a63d9a2733e9e7711a72e57e3c41d24ab6c79ed171a53aee16f002e91a3914d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723055, "uuid": "ec475cfa-1911-4c36-8ff2-1688eae36e69", "comment": "Malware payload (Loki)", "value": "afae7a047fe93ab25705737dd7f72621dec1f5a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723055, "uuid": "4a417ff4-ca6d-466f-b584-d5df4433a759", "comment": "Malware payload (Loki)", "value": "5e616c6104fd2c87274a84c4d3d1c488b7ee1a65fde13b3b9e9c8abd3507378bc47939705321a8b0688f019d5851e705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723055, "uuid": "dc4ef25c-9f56-4126-9f90-2e6da72150ce", "value": "7EB4DF137244997BE6032CBA4C1DE2B225977C24842AA91D65AA331F15F232253FF76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723055, "uuid": "1d868b46-181b-4c27-8e88-c19696bceac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723055, "uuid": "87e551d2-51a6-4300-98ea-feea329359a8", "value": "12288:+6RrRE272MKkwOhd2wxIleBfzaW3xCsOp3Z+jL8DP:nHEw2OywxIcrBCsOP0cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723055, "uuid": "7df02a87-0888-425f-90c4-5b81f0ec2911", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723055, "uuid": "a6d30687-47d3-4961-bf59-24960a5b776d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723055, "uuid": "cc0094c0-065a-4d05-85ca-294dd53bf15d", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c5b3b1-b216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709320, "uuid": "9077ff1c-f286-4433-83f4-d2ab2f83aa88", "comment": "Malware payload (Dridex)", "value": "9e7ac8b73a30a8bba61dfe7cf43bd240", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709320, "uuid": "7d7dbcd9-12ae-4cce-8ae5-0faa5e25b737", "comment": "Malware payload (Dridex)", "value": "a69a28f3c1f5f1875ee90cdd382d9544346b3a68406288d54c3b3704b979572d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709320, "uuid": "39faa977-a89a-46d8-a62f-2e4951dc28cd", "comment": "Malware payload (Dridex)", "value": "23bcd811c74656730151241e0a5b454d8bc6d5e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709320, "uuid": "ad1f7ca6-f17e-4d5e-b922-cc8891e5eda3", "comment": "Malware payload (Dridex)", "value": "3b94c974edcfee0e3e0f9bc46186c9795f79045e774e9aa235e72742873d87b0373eb3728e0f725ae9a219ca263eb550", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709320, "uuid": "3814bcd5-d88a-4533-8ed1-f4fc6ecf7a49", "value": "95F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709320, "uuid": "faef3714-02f4-4e80-bab9-5ebf2220c342", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709320, "uuid": "92c01d42-73d5-41d5-80ed-6dd240882e16", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709320, "uuid": "1d7ca10b-14fd-4839-8a19-85ebd23928a6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709320, "uuid": "87f379cc-9931-423b-b299-7936bc99d0f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709320, "uuid": "e3e01e9b-1cf5-4879-9592-76bafe8705a7", "value": "9e7ac8b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719ae48e-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620738279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738279, "uuid": "201817db-a2ab-4527-82f4-411675e3cc21", "comment": "Malware payload (AgentTesla)", "value": "8d95525f573a42d69024fbd74678f52f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738279, "uuid": "5cfef032-e4e8-4680-9ad8-7fd0b327bb8d", "comment": "Malware payload (AgentTesla)", "value": "a7688b47f34769604165a6b7d266815cbb73cd6ec9a9324194cdd22d70395441", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738279, "uuid": "7d5eca0f-2348-42d6-8059-3869a81ab5fc", "comment": "Malware payload (AgentTesla)", "value": "3ed698c07edf1ad635f13d301b308ad23fb73f59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738279, "uuid": "f9286eea-4bd2-46d7-87ce-6b12ace1748f", "comment": "Malware payload (AgentTesla)", "value": "d743abf9a29a95b4965df35a182969fc996d1344fabc72c2b5e74c5bdd52b137132bc70fbb59360689f8b7ba6615c30f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738279, "uuid": "194a0f03-da2b-47fd-a299-3a794cc43fc5", "value": "A51518A8B10468ECD326487EB7EA0E124595DD70693E1A864720337B253FFDFAD7C489", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738279, "uuid": "9f352782-61d1-4f53-8e3a-4ac4859913e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738279, "uuid": "fd8f793c-29cd-4093-800f-499adc2a1228", "value": "12288:VoLLoS60/K7yh0o/6HZN5LDi/7GZbU2I9MZvYw11woiuFpQnOZwwLD:VoLAVHnNmGqWZvBEQ7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738279, "uuid": "9d356fc9-a2b9-4216-8d13-b1545acea1a4", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738279, "uuid": "de46b724-7ea6-4485-bbf0-82ac65353262", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738279, "uuid": "23bd8021-6413-4c17-96ac-ae056fea4606", "value": "RAFu3BBhMGuisBT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cfa5da-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702099, "uuid": "d56aa1bc-13de-49e1-b138-a00d11f3cfa7", "comment": "Malware payload (Dridex)", "value": "f42a5b5667409628f09728204df2bc28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702099, "uuid": "c2a8a21b-2aff-48af-b738-a8bcb9ddca15", "comment": "Malware payload (Dridex)", "value": "a85eb0d55bf143b06b621725e8ddb04355b17bdbcf1256392ad15f3ef0893426", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702099, "uuid": "16722707-b547-466e-81e2-58fe38ecc9fa", "comment": "Malware payload (Dridex)", "value": "5c7088e3856e180061944bbdc593aa17e1a946b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702099, "uuid": "0eaa9ae3-1f93-495a-a2f2-595ee887be71", "comment": "Malware payload (Dridex)", "value": "9b89c9f081437e28f71b72d9e89e97c23a1285bd89100ec6298a0034fa1100261ef304514534f99487c75bf84f9b5d19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702099, "uuid": "c17ce0fa-b175-4a7f-bc01-fa6c78daf705", "value": "E6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702099, "uuid": "5e2bce92-fe23-4403-bbe8-b0104ff0b67b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702099, "uuid": "1c63484c-da7f-49c2-850c-b2f7a17d1ca6", "value": "3072:6iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:5eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702099, "uuid": "fe87a9ff-046e-4773-8661-a497e9bfb10e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702099, "uuid": "ee6a8038-e15f-49d7-bb03-3409b65e35fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702099, "uuid": "7460b51e-45ca-4854-aef6-0759c0ca6c36", "value": "f42a5b56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4677d7-b27d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620753653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753653, "uuid": "68632fed-a838-41f4-a9da-131c3b75dd4d", "comment": "Malware payload (RedLineStealer)", "value": "29fb6de6b8f7de2261e0f71c5dfe4768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753653, "uuid": "52f8821c-8e91-4385-8628-ecde4f2cc1ef", "comment": "Malware payload (RedLineStealer)", "value": "a9289a16ff39127e2cb155b02300338f78c0c29f6ef5b78a95d91f3ea0e0a57e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753653, "uuid": "c01b7d23-0c76-41dc-a1c1-fc20c910fa52", "comment": "Malware payload (RedLineStealer)", "value": "9ef3fa8a4726a355b790c25f8518e800a3b9de77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753653, "uuid": "fc2c6ff6-d787-4e70-9352-4f437b1d5901", "comment": "Malware payload (RedLineStealer)", "value": "e228c23162f0818ffcb1f1c25c88912db05a0312ccec791286d664fc87d789ba662fee413465bc3bd74ed49f5c8273ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753653, "uuid": "f5d2f1ee-c317-4ca9-bba8-e9ab947e329b", "value": "1FB34B3C7FC95E21DDAD5A7A81D19005D3F69CA15183E32AEDC039E98463BF06A07B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753653, "uuid": "9e6c8da3-d756-46e2-ab19-dc8b5660e4cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753653, "uuid": "1b1429a8-81de-456a-99cf-84864c7bf689", "value": "3072:WV3DWZlDhl/72u+aSEWiWXsdWblrbcGjY0m2:WVm9iu+aScW0Ac9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753653, "uuid": "fcd44de5-aaa1-4782-9ff3-adedc618b35d", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753653, "uuid": "c4e5f314-87f0-402c-b821-7d964bae7f6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753653, "uuid": "0b4fb7ad-05a3-487d-8522-f966b2fcca6f", "value": "29fb6de6b8f7de2261e0f71c5dfe4768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1c7045-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620727368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727368, "uuid": "667236ae-f218-48a7-8b57-d13f4581f4f2", "comment": "Malware payload (Dridex)", "value": "983f5bc5625be282f3a60a7273b3d1cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727368, "uuid": "00a87ec6-8fef-4cea-be3d-aba9140688d3", "comment": "Malware payload (Dridex)", "value": "a9d7cae97635f561ed0bf268367963faa26220be2af08092d90c63705fa05a68", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727368, "uuid": "fca51573-6b1d-4ae8-aa44-04d8c3816899", "comment": "Malware payload (Dridex)", "value": "2b69cc775a366bc4547d608e9e516bc4c264ac22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727368, "uuid": "3b38e7c0-ae07-4046-8e7e-bc5a6c87c1cc", "comment": "Malware payload (Dridex)", "value": "b8763758e18d66bb5437b5c7764990d392ba1304c86e6bb94bca27b33f5154b021200e5b2003ef6cfea4dc0886b23c26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727368, "uuid": "baf46b30-1415-445c-82cc-b31888166f25", "value": "49F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727368, "uuid": "0d370a1f-48bb-4fdc-a73b-c11f81f94d2d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727368, "uuid": "403620b0-9744-4f23-ae86-abfe757055eb", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727368, "uuid": "e0caaafe-b0f3-4880-8443-6670ac5bb127", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727368, "uuid": "ac55ab98-7761-46a4-acdf-ffeb66fd78c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727368, "uuid": "a175529a-1738-40a4-9f3b-cc461d5439c1", "value": "983f5bc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb5b129-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702064, "uuid": "94ea7268-223f-4c46-8d53-aa93fd8be0ad", "comment": "Malware payload (Dridex)", "value": "5298cc28def6751091643de287eb9e3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702064, "uuid": "26c0c596-3257-4ad9-87d9-749370f97540", "comment": "Malware payload (Dridex)", "value": "a9eef161221aa0e39b507284fbb3da46faddb8e164603529a1ef7988e71033ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702064, "uuid": "7b3b7908-e026-48ee-a878-1440993c6d94", "comment": "Malware payload (Dridex)", "value": "e8eb42e7388d305f558e426d2ae576dca3df8326", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702064, "uuid": "a8fa0316-21b0-420a-ba09-4b62efb67324", "comment": "Malware payload (Dridex)", "value": "c60cee26ea1cceac1b3132a0267a6ec312ccfde9f1a350c41829f38d8da274f1a330afb11f75646a6466d3430dab0f30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702064, "uuid": "0230c2e2-4ce2-4e9a-a80f-153501b209e8", "value": "D3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702064, "uuid": "6bad9313-4dd0-4722-ab3c-df14289feb32", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702064, "uuid": "0636f2a5-a13e-4993-8017-93d125d2f6d9", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702064, "uuid": "551d1ffd-1a54-4bd7-b890-5641147db7c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702064, "uuid": "9160446a-ae36-4333-86c4-d2925d58c327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702064, "uuid": "745c34e7-5f79-4ebc-bcff-a486c8b2cea3", "value": "5298cc28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d0a133-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620698527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698527, "uuid": "faa43f0d-5e62-420b-be23-6e9d806be142", "comment": "Malware payload", "value": "038baeca0043f2b9e8064cd6f7847684", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698527, "uuid": "01c0fc0b-ff9b-477b-8a93-5b72ea232463", "comment": "Malware payload", "value": "a9f87afcf87bc6fa2d116218cd653e5aada30cb615a7d56650d6042a55152160", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698527, "uuid": "ee7b9ba7-338c-4869-a0a0-7c9ae25ab201", "comment": "Malware payload", "value": "2239701c48ce8293cd307ba7d801cb94ae57518a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698527, "uuid": "5d240236-0e47-4c6b-a16e-7da70527a321", "comment": "Malware payload", "value": "81951c9d2810058150eac33b2046808ff66b4a1dd96201c1db225226c8606aecb6ad18e103cb6dd83470b75e430c2dfe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698527, "uuid": "a10253cf-dee5-4e97-bea9-74d8a695d047", "value": "9E8302B1ED6FCDCC53DC37830C16A4F3C2C059BAE5AB0E860A0CD596239D55E9EADA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698527, "uuid": "5c90a4fc-e062-4bfb-b1d0-8a11a37460f6", "value": "1536:A34z0ep0qDgh2kofoVz2XNE8XJRAEp3MO1ngECb4XtvvRL:SWZFg1LAE8XEmtgECUXRRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698527, "uuid": "7f3b30c4-b3d4-45fd-8144-0482c0270e56", "value": 85393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698527, "uuid": "1cd6c5e0-25b9-421f-8e89-496c0ff3246c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698527, "uuid": "fc25b9ae-54d3-4c5a-87c9-771db0118ca9", "value": "038baeca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984c3d21-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714721, "uuid": "89e8bddd-75f2-4d39-90ef-d0f5b2b15bf6", "comment": "Malware payload (AgentTesla)", "value": "e41f49ccc0f0d0af5ed98b39067abd2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714721, "uuid": "780bf8a3-caae-4ce2-95e5-8da4678f04b2", "comment": "Malware payload (AgentTesla)", "value": "aa8eca13cc8a3bae0616cca54b78e4cc9c19beb27a2a48830f1f86e4b3154a27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714721, "uuid": "8756dcea-8a6b-405c-948e-0bdaae259e85", "comment": "Malware payload (AgentTesla)", "value": "79c4f2b0a20878be3e0f4fa435b2aeb03f770232", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714721, "uuid": "1d463bc3-c678-42d6-b30f-d503fae508ae", "comment": "Malware payload (AgentTesla)", "value": "5334dd8e4c2f93474cb1eeffea60b159122bae1b5052eb7e47662047a327cb26ca96136cbec6b2ac5c3d20fcdd2df981", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714721, "uuid": "8905d289-ee45-4f4b-8d49-344930ba609b", "value": "CAC4E0213358AB60F17E973DC070101593F1F51BEB79EA8EBE9850DC7962F418AA2B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714721, "uuid": "51ddd69c-076e-4ba9-a854-ac3426729245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714721, "uuid": "707b0658-4c55-4450-a142-80fa11bfd866", "value": "12288:BBFT17BMThB8kl8anGzQDjFGQ0t6rN0H8YzOH66575RmSTUCk:pdBMT8N2G/QzHP5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714721, "uuid": "fe3b87e1-47b4-4944-baef-aebd88692056", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714721, "uuid": "48d0eb87-bba8-43c3-b70f-770bab85fe59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714721, "uuid": "4cb092aa-7b09-42a4-bd0d-d9e9a5515856", "value": "Proforma_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c462b58c-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735841, "uuid": "d5d6775e-e55c-4d87-a4f5-62d4bf1587ff", "comment": "Malware payload (AgentTesla)", "value": "dd2eb46743bf230998439673e3deba99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735841, "uuid": "92bcaa47-11a2-4782-89e9-a41ed44af79c", "comment": "Malware payload (AgentTesla)", "value": "ab417e35533138c082445ac1997401837c2be3af4527860f3b5c30dcabd325cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735841, "uuid": "991f94e8-700b-48d9-8417-890894193c7e", "comment": "Malware payload (AgentTesla)", "value": "4871d34e0db77e32f627e74b92e9a9fbdef7a21a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735841, "uuid": "b9782b10-71d2-4461-ba9e-0d2d405c3b67", "comment": "Malware payload (AgentTesla)", "value": "fa088297f39d8f0dc6ce9925e23df293dd74513a837e5210fef638d427ac0589b1901e6aee4868ef0cf4da71ab16685c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735841, "uuid": "8ca2119d-9f5d-46de-9f1d-aeb2cbed684a", "value": "BC1501323328AFA1FABD9B7D9820015457F9A946E321E64D7EE811ED0DA6F414373F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735841, "uuid": "bdce3fc8-7009-4354-84a9-bc9cf2d3a299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735841, "uuid": "b584b232-56b5-4fb3-885f-355f1a634d80", "value": "24576:J1K8N2X9mBmtr0jDbe0fiP4HrSSbffx0LIE:JAntIBsESWGsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735841, "uuid": "248fa416-0b6d-45d9-ba88-b9680ce6d3fb", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735841, "uuid": "8c1ab86b-6672-489b-ad10-258ffc9e2ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735841, "uuid": "3ed8a002-1f0b-4a8d-b7e3-dcca3e9c2fb2", "value": "Swift Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d257230-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620716421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716421, "uuid": "a935d669-a765-426a-849a-d639ab105418", "comment": "Malware payload (Formbook)", "value": "6f3920cffa1a702c833a6361ee081151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716421, "uuid": "8726aa93-610e-4d05-aaec-b9edd2dac537", "comment": "Malware payload (Formbook)", "value": "ab6a4abae4d494b05d58dcf9a354231d3c7ae78fec4a62fc1f5559febdc3995c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716421, "uuid": "400ea908-845e-4d7b-b51d-41352d0333a4", "comment": "Malware payload (Formbook)", "value": "a26290a4c22ec653796edc01203446fd15280ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716421, "uuid": "29e3730a-301c-4405-8d2f-de98a054fbc7", "comment": "Malware payload (Formbook)", "value": "3c8c4407775113933417911a7dede5c6df6711bdd9016cc8a430857fe4ddfce8a645258fdaa8ed583cb8b513d56385bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716421, "uuid": "703c0502-99c4-4ec2-b713-fe72cb77e8f0", "value": "D9447C69F3709CE5E412817E887AE8351133AE5A9167490E375E362D59A33C310FBF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716421, "uuid": "7ee42bca-94e4-4d33-8cbb-5118eadf209e", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716421, "uuid": "666b0665-42ef-4600-a738-e27cc2ab958e", "value": "3072:Rf1BDZ0kVB67Duw9AMcIQKaqbNW5J9bDoN4vShvCscBJQ92Zn7SJepVKaxTcJzfu:R9X0GwPNW9e7cg6oepZqvz4Nlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716421, "uuid": "2fc51fd5-328d-4f5d-8556-3992130321b2", "value": 277252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716421, "uuid": "e54344ec-3bf4-4029-a03b-d4d9b5135175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716421, "uuid": "a37d9fd6-bc9a-4fa4-b97c-0d14fa2a7578", "value": "EDS03932,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b21841e-b238-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620724121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724121, "uuid": "a2543025-6536-4786-99f4-ae4288045256", "comment": "Malware payload (Dridex)", "value": "70a948081e125a254211fbec6a5b4a54", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724121, "uuid": "b28cef86-04a6-493b-946f-e84696ecc4b5", "comment": "Malware payload (Dridex)", "value": "ababf1408edaf3ab43f9821600994ba38d97b5fdbb3b79ae895f070f1cce84b9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724121, "uuid": "3129415f-e789-44fb-ae66-54632380ad79", "comment": "Malware payload (Dridex)", "value": "2dba8e227720464165dd72fa8ed363d883e41c96", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724121, "uuid": "9f5b3aa9-1306-497b-a219-e6fed3699ab0", "comment": "Malware payload (Dridex)", "value": "3a21091f10b69ecd91dbdde0ca49bf8cd690a03f70cab15177fb697ec9f73585c6ccebac4046c04d7d5f953806bac3f2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724121, "uuid": "58cbc734-403a-4681-b1f9-b853337705ff", "value": "EAF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724121, "uuid": "90c22b7e-0f33-41ca-9d35-fe00fb0aaba4", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724121, "uuid": "6b95724d-fe66-45bc-b99a-99a032751795", "value": "3072:kWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:k42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724121, "uuid": "9ab80555-e814-47df-8be1-0a8c289e52af", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724121, "uuid": "c9eddd03-4b0a-423d-bc0b-63d4f1cedce3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724121, "uuid": "5a880676-8750-4cf7-99c1-3a8f345ee6d1", "value": "ababf1408edaf3ab43f9821600994ba38d97b5fdbb3b79ae895f070f1cce84b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930344c2-b271-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620748643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748643, "uuid": "47e6aecd-f106-426e-b79a-89600c0b3036", "comment": "Malware payload", "value": "ef7d61928153c7ac6dc3d692e9c42fcc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748643, "uuid": "10b9929c-8ba9-43c2-8e02-c05da97a2c76", "comment": "Malware payload", "value": "abfe523af5774d0d0f3f10533fc7143245a8c0e2985470a540537b22e03de592", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748643, "uuid": "e22dee79-469a-46c6-bef9-1d092009f91b", "comment": "Malware payload", "value": "a9081581a8dc0a3e75f45acb071265fccf4fc091", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620748643, "uuid": "bf96864e-d60f-40e4-a411-eb30322999fc", "comment": "Malware payload", "value": "d6c874932ba608b3eddeaf53f260d3463e5c78e74e9a124de4d553fcae6345747fadd228d5bf235b737728755b9dc31c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748643, "uuid": "585e14d2-99f5-4224-8b38-a6cd2cd41894", "value": "E803E00FC37F4016D7CE0272885529ADA722F8A1288B3B163775DD1D7DB2773292752A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748643, "uuid": "1b9a9c2f-e997-413c-a980-ea91a41e953f", "value": "768:Ov7cYx4dTVuspEbjrTiLV4fzJsf7/Ov8T/POQQXIGA9+OlQGpWkQ:/VuXfY4fz0dHOcMyr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620748643, "uuid": "4eb08266-6e65-4f10-a309-69b4effb3a0f", "value": 38442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620748643, "uuid": "3b984eab-8877-448e-869b-636a9ba698c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620748643, "uuid": "4a00ce05-0598-4a25-8955-8460d17475b4", "value": "RFQ ARN-PO-2020-11-00073 MINE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34b8380-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620698499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698499, "uuid": "8f8761f0-bf9d-440b-b147-c99f244c4e27", "comment": "Malware payload (AgentTesla)", "value": "ca2023dfdbc307264989a1acf13835bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698499, "uuid": "e6f177fb-a34c-482f-9182-edbde4717c9c", "comment": "Malware payload (AgentTesla)", "value": "ac35077db796140c052467dfc645a8c936f24be3bcd8d7a1947cd8336ca708c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698499, "uuid": "4b9e0421-bf22-4030-9d1c-1e14780e6aef", "comment": "Malware payload (AgentTesla)", "value": "c732abde9432a1849f8aba88751fe091a81ba720", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698499, "uuid": "2a03df60-e35d-4f54-8c2d-7bb00ad98d69", "comment": "Malware payload (AgentTesla)", "value": "0d81a66969e5b54f4738fe807f93160c1814898d8fe75af3270782ca7abea3c330d82cce3403b7dd3549be81cef2bdd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698499, "uuid": "d8750e04-2a0f-4bbf-8829-d5e339f9a236", "value": "28B4239F355CAE2EDB4A3752FE27C3CC8A341100A465BDB7DB418A1893655CB5CEB82C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698499, "uuid": "cb40f9ae-f5b0-45b3-84a5-1f60fdbf7543", "value": "12288:Rnwi0RJRjyc5cUmiLS9Hr0ftR5/g0rwCXa0O1wigE0F8wRp:FWJJyEYv9Lm/478PxrRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698499, "uuid": "02da01a8-da57-48de-9afc-4e2bc1cff445", "value": 526577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698499, "uuid": "274b920f-c047-4ce0-be09-dfe7a441e848", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698499, "uuid": "d87e1ebf-a4a0-4d19-a1a8-563d75d380c8", "value": "ca2023df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33459b55-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702096, "uuid": "8115a481-1350-4d7b-8415-010e297b77cb", "comment": "Malware payload (Dridex)", "value": "55c243c5a9093d06a1cdac08bb302df7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702096, "uuid": "df033862-5472-46ba-a8d3-c578c456f389", "comment": "Malware payload (Dridex)", "value": "ad0018431397c66164609b7e1f94ca27aa7c5f8263e26abf20ca9a9154232b4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702096, "uuid": "e9af27ea-2fe5-4a45-85db-db24f5d20b92", "comment": "Malware payload (Dridex)", "value": "354108ccf7484ba295e20f558c4f58078654eaca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702096, "uuid": "d1f27cad-ae93-42fa-aec5-ad9fe5978e42", "comment": "Malware payload (Dridex)", "value": "5ab78f81360cbafa4844eaa6f9636fb7c52365f7954a6145ad4939d83ff1bd895afa187058c6f799a38601467298f497", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702096, "uuid": "c7af52ac-e033-4e1a-bc96-47bccf4f029e", "value": "EEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702096, "uuid": "98cf1b6e-8aff-4bff-92e7-0fdb1254774b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702096, "uuid": "4703a3ab-926e-43f5-a786-9a9d3ba3bade", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702096, "uuid": "9ac9384a-6953-4637-93c5-17aaecc1922e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702096, "uuid": "bd3b7e2b-a359-4058-a34f-e9f255cea8e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702096, "uuid": "66e36c0d-a842-4469-9bb5-52c6ad4b9313", "value": "55c243c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4faf26c-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729050, "uuid": "f0a7927a-92a6-43df-9b4b-cf1376dbd49b", "comment": "Malware payload (AgentTesla)", "value": "d7a5bea94fbfa892c29abfdad51486e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729050, "uuid": "27bb0ded-8748-4131-9dbb-0e3bff13ef4c", "comment": "Malware payload (AgentTesla)", "value": "ad191b230cb5e870e4f4a32f242f0545914d1fb36a050bf4e5dcb3ab8d8d83c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729050, "uuid": "a5ed1ee5-c3cc-4caa-9702-34c226884fad", "comment": "Malware payload (AgentTesla)", "value": "7ad7890d32d92d3dfcbbfda26e0cde2da7a94c21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729050, "uuid": "eca2f7ef-bdba-44bf-a8be-14ebf4cfbb11", "comment": "Malware payload (AgentTesla)", "value": "58bcb98d58d23e4cac0d417baef10f7522553a90ae2653e0620f8964c7db5ff2f95081ca41ebd448ec2e6aa9d7545da7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729050, "uuid": "7bc4ffb2-d12e-47db-a284-0e9befd8f9ae", "value": "5315013137A89FE1F27EAB3D98A0114483F4B406E722E65E7EE815DE1955F8147A3F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729050, "uuid": "26d4da65-77a2-4cef-8282-ef69fb6d59a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729050, "uuid": "1d21b94d-9227-42c8-b34e-7b19bca51c5a", "value": "24576:gNb2H+WsXCqIeHhgTdNcGbFFgr5WEYLxNKHhp9oiy7o:gSBIhgTdNc8Fy9oLxNKj9oiy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729050, "uuid": "01ada3b2-788c-4ae8-9730-71dcd9b82e4d", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729050, "uuid": "1084a3b8-811f-42e4-ab75-f8a08a4dc37c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729050, "uuid": "75467307-b17f-42b3-a2f5-b80b2f61fad0", "value": "PO #367459.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2bab86-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720150, "uuid": "392f1559-a369-426c-bde3-5fbf2038fe0f", "comment": "Malware payload (Dridex)", "value": "fcd3420173d699771de70923fbb06ac6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720150, "uuid": "65da81f4-de35-4003-8f0d-b43f5d4c57f3", "comment": "Malware payload (Dridex)", "value": "ad3d832f55b34723710803be19208846a8b95d171ad8c21c69e469c245c6a328", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720150, "uuid": "bd3b3233-c711-4b4e-bdd8-8b1a16d7f4d0", "comment": "Malware payload (Dridex)", "value": "0c540aca366df15ecd31cdee987d391108982441", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720150, "uuid": "c8a75b37-9296-4594-aafd-3cdcc042e35e", "comment": "Malware payload (Dridex)", "value": "7ba623ed803bf0c00f9a38e98f91815f71c96cd20f1b1c4965e764e1531b5108b98979d0fb5cf19b01513508cc5611e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720150, "uuid": "0c1f7ad7-d3b7-46d4-b339-f8ff302acec7", "value": "26F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720150, "uuid": "3c6fa1ef-54a2-4c39-a96d-3b21c799f177", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720150, "uuid": "303a3442-2a7f-4e1d-8551-47108c09c6e6", "value": "3072:cWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:c42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720150, "uuid": "e53a7387-e433-4e6e-9480-9d1d9eab52fd", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720150, "uuid": "901bcaad-eee5-48c6-bfb2-e0a1858d2f5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720150, "uuid": "f10d3b4e-b4eb-4bac-8ec6-06329b760f94", "value": "fcd34201_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ad63e1-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715193, "uuid": "1181ca15-6897-4d79-983d-3978055adc82", "comment": "Malware payload (AgentTesla)", "value": "e03da446c6f1723f4e9a0c76755231a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715193, "uuid": "77116ff2-b5cd-429b-9f11-4a6b037151a7", "comment": "Malware payload (AgentTesla)", "value": "ad955529bf96483828333f5a0b6c69d1bdacc0798123470d8de0875c75b9010d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715193, "uuid": "b852b28a-324b-4dc0-bc0b-2ae9f8d88580", "comment": "Malware payload (AgentTesla)", "value": "2ec2a6f04dc8836fba7465ec815832fece5504f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715193, "uuid": "c09b834e-b137-450e-82ec-4c91bd0e7b50", "comment": "Malware payload (AgentTesla)", "value": "5552f97fdf4759b38bdd2a08772b9de6ba3f36aa21670980d6bc40f1e232d5fcc74259ada83f15b710954e1773832fc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715193, "uuid": "5b72aad9-0f80-43b5-b14b-0e1399d141d9", "value": "B905230323E0DE18F5FC26B056D2424507F5F666A223EB293EC865EE46F7AC2C2467D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715193, "uuid": "aeec4956-9469-4672-be40-df928d1d6e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715193, "uuid": "cce61db8-800b-4ec9-af6b-d51247fb7844", "value": "12288:sqyHyijdW/xwc7+gOD5OLOEFCKs43aAKdx7dmEhqSfDXLWm9Cq9b3TcZv0Rq:Uo/aciF+OEFCj4KAs5c8DXLWmUIcZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715193, "uuid": "1c76da1e-2768-4941-8ab0-76bb8eb1c0de", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715193, "uuid": "1bc45771-c510-4397-9d2b-a584ff7b1509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715193, "uuid": "a47c271a-4b7f-4c4d-bdb6-e5654164788d", "value": "ePj6KfzLBxh4vbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3cad10-b272-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620749064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749064, "uuid": "b35edd31-8e3d-4e56-9011-db4415f9552d", "comment": "Malware payload (Dridex)", "value": "68fc4458df6e8cfe486616c739162db6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749064, "uuid": "52fb8635-38b0-49e2-bc99-cab6afb6d6ba", "comment": "Malware payload (Dridex)", "value": "aeaa4c8ead906718309a9fcb3f2ccff4710266d5b06c6012b6a4378ad9ca276f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749064, "uuid": "fd9c45aa-c257-4f00-950b-8775bfcd17c2", "comment": "Malware payload (Dridex)", "value": "6642e096544f98731def626c50e50c34700ad54a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749064, "uuid": "72a57972-81f5-43f2-9865-8ca87a6748df", "comment": "Malware payload (Dridex)", "value": "61800cda8c76ce952467a394b0e36e5aa3a231745106c79f03974e2eab97ada0609513ad8241f947617912d397f8362b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749064, "uuid": "186b10a4-8706-406a-85e7-4e5b8db10778", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749064, "uuid": "73de751a-cf76-4a2f-88fe-f1d8566344a9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749064, "uuid": "a871b670-a01e-4eb2-9527-3bb4bace45b9", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620749064, "uuid": "43d63810-c736-48d1-96b2-7da22532fb5e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620749064, "uuid": "659af8f0-ff97-460f-900d-f56325e629fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749064, "uuid": "eb59b38a-9760-43d3-b231-08a84eb62b8e", "value": "68fc4458_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e0118c-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698447, "uuid": "b6bc987d-86ef-49b5-b1ef-d7592e5af99a", "comment": "Malware payload (Dridex)", "value": "82de81a1859820bbabd8a2da75b0656f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698447, "uuid": "be10e55a-ba03-4944-9d10-584a9d3aad6a", "comment": "Malware payload (Dridex)", "value": "aec4a6258b2d4faaabb645128ee63174b98f36512a8eb31a9ad9b0d26f43f06a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698447, "uuid": "923acc32-af72-4f0f-bbfb-9406342b6bb6", "comment": "Malware payload (Dridex)", "value": "3e5c33d3f4c46c8ed96218de41dbc392b66e32b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698447, "uuid": "d06abc99-6eae-4ab5-9129-6bca4771d544", "comment": "Malware payload (Dridex)", "value": "ac89e1b44652fc56d549f6d811b34e587c3bbf30722cf73a90ce820b89c610b3a8661d33095fd51e1db4dcbc96736fe6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698447, "uuid": "3180b677-230e-4622-b137-b324363dae75", "value": "A4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698447, "uuid": "a30a6466-9af9-458d-9b27-c2d224366214", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698447, "uuid": "789e4b28-cf72-4375-8938-a4ba7583988d", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698447, "uuid": "6d80a631-e031-4ff6-9611-45c7cfb7f429", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698447, "uuid": "63389d13-c6e6-4aa0-90e6-4b00c337b5ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698447, "uuid": "af986c08-febe-4dca-a4d1-9710eaa18b00", "value": "82de81a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76e0a10-b22e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620719981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719981, "uuid": "795db86f-8175-40ce-b699-b76d9e397d97", "comment": "Malware payload (Dridex)", "value": "d28f066db05934fc1ba72b6a4448d756", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719981, "uuid": "167a920a-fe40-439c-a799-756485189afd", "comment": "Malware payload (Dridex)", "value": "af7bf75deeffae18a4742eedb68416556aaf9034b623a8cb5979594c3e826a68", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719981, "uuid": "9dfd3780-f1b5-47f3-a961-1c27b6bc46ef", "comment": "Malware payload (Dridex)", "value": "0d4c0ccb306db358add21b1f99cb315f70750924", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719981, "uuid": "1b74dcfe-804a-42dd-824f-c37dd9b10310", "comment": "Malware payload (Dridex)", "value": "b0245ff7ac7f6d7239146ed206faee831cc298649110b43b2f7d47df2acd9417b44e94aaf3a9960c106dc8ba1fb92649", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719981, "uuid": "49da7b72-9615-4f49-859a-210e07de0d16", "value": "69F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719981, "uuid": "70f84fc4-7cb3-4e82-ada3-f9a0c7ccc38d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719981, "uuid": "4ddfe875-9a5b-4d5a-91b1-4382be20d72b", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719981, "uuid": "e77d846a-b2b8-40cb-a3dd-af061d0d9e0d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719981, "uuid": "0cf21a99-f898-40b6-942c-5599a1f4cb0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719981, "uuid": "b7da6dc6-5bb3-4726-aedd-01b74f8a74cb", "value": "af7bf75deeffae18a4742eedb68416556aaf9034b623a8cb5979594c3e826a68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12d4da6-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705717, "uuid": "06cfe746-0a3c-4464-be13-9eeb1e7e10e1", "comment": "Malware payload (Dridex)", "value": "249eae2eb0417f4149de0013f952346b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705717, "uuid": "b31da3da-8e11-4cb3-aea7-caf21bff78ae", "comment": "Malware payload (Dridex)", "value": "afa9b0a12bd5295d11038550344fc6a2c2a9afae0fc30b48c0683227b18276f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705717, "uuid": "1e96640a-8025-4721-8d81-f3a47ec10311", "comment": "Malware payload (Dridex)", "value": "934564f38b0ff61e058ebd202a7946ed50f129a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705717, "uuid": "b35729ce-405a-4a10-981a-f9b101ec08ac", "comment": "Malware payload (Dridex)", "value": "2481c1d8ebf43f0f947d805a1d14f03bb60d708f38be39c644840f419fcc1c6defe9cb806f57aa7ea9f42a3434283e74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705717, "uuid": "8e406236-d3ba-4eeb-bb18-4b3a05cb182a", "value": "BBF3D0906A9BDF0ED9C13CF96A96A879B173458D811FDAB4D0CE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705717, "uuid": "64639c2f-186c-4e28-b0a4-e96af94aeba9", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705717, "uuid": "2b242fb8-2667-4100-b4fa-ab6f54a13de5", "value": "3072:Pesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLpM:D4+VZQpt5hyPsa1ekiEKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705717, "uuid": "bb57ccb3-44e4-41d7-a38a-5934727dbfe8", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705717, "uuid": "e22ab944-8b11-40d8-a569-9d7ca9f1e22c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705717, "uuid": "cc38090c-8b74-4d27-b6ef-9d02d36b5296", "value": "249eae2e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03abc062-b1f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620696433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620696433, "uuid": "d497f9c6-8a6d-474c-85b0-13aad301b924", "comment": "Malware payload (AgentTesla)", "value": "2c02273735efe9ee83b319ee056939ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620696433, "uuid": "d9681435-373c-4352-bbc5-8b2487175b37", "comment": "Malware payload (AgentTesla)", "value": "afd4a2b60af8081a2ec7f9de5c4f19dc94f265364a84d6855890202b3bac1984", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620696433, "uuid": "1c287656-8b5c-4bd2-95f6-d3e10f49b4e8", "comment": "Malware payload (AgentTesla)", "value": "c3f6747b70d6942d3f56e6f590cf57c1d091f52d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620696433, "uuid": "485070b4-4005-452c-b46b-5a30ce888522", "comment": "Malware payload (AgentTesla)", "value": "4da8f73be246fcbda51d147a60a616d1de152dde06cc567cb84a9eccf7fd8386643d5269b38e6f228211970d86f90ad1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620696433, "uuid": "696beb16-1bf1-4cc6-91e2-16c1e9e00727", "value": "9805BF2D66A46E00E9BD1A3FC561D57080FEED06AD03DA5E19F03DDFB9B6BB4C40160A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620696433, "uuid": "0426d466-69ff-4680-a4b4-6c163845ca6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620696433, "uuid": "4eb23875-9b7b-4879-af55-64caf0932d55", "value": "12288:Woq/DoxynUVZRH8gDnh+m+GZMHJXwziPm90tjc5sYdW2jsQKLP7nh:pW6ynU5nh+m+GZ0XPI05hj2jsQ0P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620696433, "uuid": "eca39c2f-89bd-4efa-8780-5d7233770dbe", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620696433, "uuid": "4e85e15a-775c-48fb-88dc-846c2bf2bc8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620696433, "uuid": "ff845947-f0c3-4a24-86d2-89a1f6696863", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc4dd61-b27c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620753303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753303, "uuid": "441d6ffc-ad7e-4e4b-bb35-c3b20059e3fd", "comment": "Malware payload", "value": "2a152a29ba5f6ec474e6b24cef4da8d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753303, "uuid": "25aa2769-c42b-495b-8aa9-a92eb007c3f9", "comment": "Malware payload", "value": "aff52900376b64064617bf5f18810e60069d8551ff57dd144cbc43c60eaffb35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753303, "uuid": "e596684f-dce8-4e70-9f25-601a675778ea", "comment": "Malware payload", "value": "519b3d01d255be7aa5fc42c44979292084863d23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753303, "uuid": "3a96caa1-7ecc-4aa5-92f3-165f880eef29", "comment": "Malware payload", "value": "166ec45a41402ef9ff9edc2d5956d4c47fd3c1d47ae41a3fb664e5ec03ae1e9231fd57f91e5a3ff9838dcf334cb67489", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753303, "uuid": "c0a9ebcb-bff3-49f0-a62d-abcd085ee668", "value": "8B05232C9B40D3B9C89B137855E3E916477EB6975223E30B2B4410BE2D22FD19447BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753303, "uuid": "2b8582d8-7f06-453e-bd38-ab1751f559b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753303, "uuid": "b88b8696-7d43-4b23-b4d4-256d0f8b6ecf", "value": "24576:HofctcNo8k0WdGNaPB1JWW2Nv+Yly5+9VK8Ey:HgcIo30LN81oWG+YlywrKty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753303, "uuid": "d3cbf758-5976-4649-8e92-4af60c3fe26d", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753303, "uuid": "d803912e-7f77-4861-a634-59bae4cecace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753303, "uuid": "a8ace632-28fb-4899-8f42-acd997819f7f", "value": "Octamod 2021 -\u2026P014 New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15c0cd7-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698523, "uuid": "42c048e8-8ec8-4eab-b053-513a0542f98f", "comment": "Malware payload (Dridex)", "value": "1bc9a96ed91e58a453d7539a9ebe3b8c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698523, "uuid": "2e5564fc-464f-4d06-8bf0-c89a377f47ae", "comment": "Malware payload (Dridex)", "value": "b081f0516fd1f28cd02adfeb441a98a8a6aea2e7362141dbdbaab651f76f6ec6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698523, "uuid": "d43206ea-725d-4bdc-aa06-de05ac2487fc", "comment": "Malware payload (Dridex)", "value": "222520f266cc2a8812401040cf08f71053ac28e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698523, "uuid": "438c10f5-dc15-4065-a6c7-70ecded97cef", "comment": "Malware payload (Dridex)", "value": "e7603ec9507ea7c9a52491cf9533fcf4e094b02df5734d83bd66bd7367d96a53d25ac1dccf49699e10b591921b34ed30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698523, "uuid": "dae478c6-fe51-4db5-bcba-f7e88b86d9c7", "value": "6AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698523, "uuid": "ecf53ce2-282c-4d75-a79b-00eb88b7f131", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698523, "uuid": "60d2ffd1-8f31-4167-bfb5-892dd0cd1683", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698523, "uuid": "87cca46e-b0c4-4ea3-89d8-0fed966fe3ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698523, "uuid": "b0bc3932-414c-4048-a5fa-afe767281caf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698523, "uuid": "b474725a-65d7-478f-ae12-b1489caa6b84", "value": "1bc9a96e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7919ebce-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712951, "uuid": "98d965f8-fe21-43ed-abb9-af1d0ae2790a", "comment": "Malware payload (Dridex)", "value": "247baec7f613595b93d130af31aa9f5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712951, "uuid": "e1ce4a90-f1b5-458c-8ee8-d5ce8916c371", "comment": "Malware payload (Dridex)", "value": "b193d8c22f59bdd552402528e6b35a2e9b8451380d64159a27ede8b7c40417b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712951, "uuid": "c00518d5-96ba-4f51-8ed9-ceea0156c870", "comment": "Malware payload (Dridex)", "value": "9af4b3ea3fe92d7b9a06497a9ed19742d876dc04", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712951, "uuid": "0c4a8be1-3933-433e-bcdc-48413ff0686c", "comment": "Malware payload (Dridex)", "value": "933d2974f8643323aa0346e2d92f02e4e5fbbcc259d4e0cc42fcd962d9479a24cceaf9269c2b3c4f0aafaf6ae9e9be23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712951, "uuid": "741825cc-d8da-4b1e-a6f0-549c84623673", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712951, "uuid": "f24af7f8-fdc4-47e2-bafd-c6211940383d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712951, "uuid": "e721c772-2cf5-439d-b26c-dbe25961c181", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712951, "uuid": "fbf89632-3882-444f-a0fb-5a2b1ab04783", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712951, "uuid": "fc4bd0fa-e568-485a-8fa8-251722aa305f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712951, "uuid": "75a64170-402e-4478-aabb-95a3444bfb5c", "value": "247baec7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec76b9b-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620715189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715189, "uuid": "01a6a2f8-f11f-4295-8af7-a6505c5ac68b", "comment": "Malware payload (Loki)", "value": "b1d78e6a8d2f23ad5952d431cd01f5c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715189, "uuid": "cef17704-9a27-4e8f-a15b-6a2d3b811eb0", "comment": "Malware payload (Loki)", "value": "b326b4848fb7610629f54054b30bac754382db0684a37da3c44e3342a21c2dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715189, "uuid": "816b1a50-5a1d-4771-b880-fc9eda69f2cc", "comment": "Malware payload (Loki)", "value": "19aa2e5f1f2abcc2993361fe43af38ce29051597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715189, "uuid": "d37cbbfa-9c55-449b-adc8-b876a3bc43b2", "comment": "Malware payload (Loki)", "value": "69199d46b1fd9e08ffc4c9936f34016b2c67c176dd11bd5656e8a90bf6733f7d94885bfb8cedae5891fb970b5c145820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715189, "uuid": "efceae83-80f6-4ba5-b7c3-6369b5b9dc88", "value": "A1056BACB55458F5E3571C33A3CF4C0782291274693BAA0F8BB0177E5A27D273E39989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715189, "uuid": "703ec289-792d-4e5b-b6af-868450431e8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715189, "uuid": "20f5f3ae-ac55-4028-bdfa-0b5e6e21f998", "value": "12288:faGjoLLoS60/K7yh0IjJ5x7gibGSc3h2osMD5U3S0sLuxT4:boLAy5lgiaRMobDuuSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715189, "uuid": "36bb4ee0-c392-4224-9750-8a3b0f539f55", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715189, "uuid": "57b3dcd6-79d1-454c-af8e-ec2d64286df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715189, "uuid": "81f2eb3b-f402-4b13-97f8-20f7cb4fb12b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd3f4be-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735699, "uuid": "2b8e85e9-090c-4058-b076-801ed152356f", "comment": "Malware payload (AgentTesla)", "value": "6fea9fa0c1515401c1c1b16050fa47f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735699, "uuid": "856ca514-3a0d-4007-98dd-17fe37ea4707", "comment": "Malware payload (AgentTesla)", "value": "b33da17596e956896a4791449395b6c8eee6e9d214b645373b218bc23240e203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735699, "uuid": "74f3c63f-8919-48d5-a8d1-53feb6350736", "comment": "Malware payload (AgentTesla)", "value": "aad04e566fa2b06e48c8d99a5cbe69186d11a9bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735699, "uuid": "d690da7b-4069-498a-803d-19357d869c8b", "comment": "Malware payload (AgentTesla)", "value": "a0c29ef25ffdde1d390fadd33336b9077154484d7a85b86ed1bfaf084dc62f7787003c0e6ca660247c1aa4e3fc3281fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735699, "uuid": "cc54a506-f3ca-4816-b696-2b9239673b61", "value": "22B423DB0888FE88F2FD81BBE750022A5DCEF16A53991901F7B5C545D2A79DF40B1B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735699, "uuid": "5e8d4db5-bfb0-44e7-8911-5026aa932486", "value": "12288:/lndBlTB8dKWevhosVjy0h6vLtqLXKXn2IGftoO+V9s:ldridKWeZxVjnSpeKX6m5V9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735699, "uuid": "5207f400-9c12-4c47-81f2-42036358a699", "value": 534411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735699, "uuid": "d45f1f80-6309-4509-b281-a3f3fc084f6b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735699, "uuid": "21eed3e4-48f0-457c-b3d8-3cf746e3a080", "value": "QUOTE B1020363.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0249904a-b216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709316, "uuid": "f48725c9-1b1e-4de4-bad1-cef2e4dbbf02", "comment": "Malware payload (Dridex)", "value": "6a03eafb6e6e352261b83f5436cbd066", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709316, "uuid": "e711b1bd-c231-475a-8479-927c3e565a8b", "comment": "Malware payload (Dridex)", "value": "b36d66b677cdb2a4cac6122c39d26821cbaaa02443f122fb2895c3f8b8d695d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709316, "uuid": "f9386731-4f35-4233-98c0-dbf88655e1b2", "comment": "Malware payload (Dridex)", "value": "e8c552414fc972bc21c6b566239cae6148788eee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709316, "uuid": "167b77b9-8d8f-41e5-8074-d0e3b57cb82d", "comment": "Malware payload (Dridex)", "value": "be4b2b4ad4ea3343c5bfcf829adcc3f269957f0b0ebefe8d3a962ee5b0cda2b8df3d2c2e8432ba2863bea5bbf9a6dc7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709316, "uuid": "fd5f1054-59fc-4d89-87a2-29cb600a2096", "value": "F1F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709316, "uuid": "9d8607e6-6e79-47ab-80bb-d3f23bd05c96", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709316, "uuid": "c4e3a661-5a21-4cfb-9836-c474f02b34c9", "value": "3072:PWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:P42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709316, "uuid": "9e25f889-d43e-40af-bf25-1ac7b8d46a6d", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709316, "uuid": "18f5ddad-527f-42be-94d1-335c33d23d0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709316, "uuid": "321e2053-e1f9-4bb5-8ff4-08b3110d019c", "value": "6a03eafb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07d1e30-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728989, "uuid": "df75c21c-5ccf-4ed4-b00a-f5008345f2db", "comment": "Malware payload (AgentTesla)", "value": "98957c57335fcefd5dce687b2eb7c248", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728989, "uuid": "1bbbd8b5-0672-4b0d-a0f2-75b5487ac7ab", "comment": "Malware payload (AgentTesla)", "value": "b3d0bf9251e4c9e7643d80a95dc7ed46e06f062610c3f3cbcebb8ba8343ecede", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728989, "uuid": "dd60804d-ce31-4724-8b77-325f048e6f97", "comment": "Malware payload (AgentTesla)", "value": "8f3893d501e48d7c582f1de1f321f8ac24338262", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728989, "uuid": "23915259-b3c7-446c-b049-90e648e30b34", "comment": "Malware payload (AgentTesla)", "value": "110d2ead06d1873f29286deebcc68c0eb8ef0361b488d661474c709493d7d6380575f4cc73cb6709197aaef19a8b4bde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728989, "uuid": "9d1454c5-f92f-4bc2-b94a-310e546f6d62", "value": "B8150221335CAFE2F6BEA77D5820415813F9A805E722E18E7EE518EE1951F8147B3F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728989, "uuid": "a0bb2c19-55c4-44e9-b925-b25c650eafe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728989, "uuid": "4c21c1b5-6dde-4b85-a705-b78855ff2a5b", "value": "24576:rdvwSNacO2+tB/PyGWtlqhVi4kUpNFHB023ewK:rwFtNPzuYL9k6Fh0ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728989, "uuid": "35fcbeaa-c39c-4502-bf13-efc6367bc1da", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728989, "uuid": "1d44ca12-d34f-45d4-b3a2-24d8136b8842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728989, "uuid": "3c972dbf-f742-4ab0-baef-3dfe78f79bb5", "value": "PO#011.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24f8d93-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715248, "uuid": "1354ee1c-fc5f-42b8-8c57-d8edc684cdc1", "comment": "Malware payload (AgentTesla)", "value": "bf8eb7393f93fc1c4d0f5016277fd16d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715248, "uuid": "bcc09397-e0e2-4729-9674-3f8e3f3d1644", "comment": "Malware payload (AgentTesla)", "value": "b4c4042d015ad6b2d72685db71fb526ba53df98dfd609d25b70e6186835ecd6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715248, "uuid": "e18fb53c-34b6-4133-bf9f-92b948884067", "comment": "Malware payload (AgentTesla)", "value": "5839062a35bf01e3d0da2351019ea2852a829fa7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715248, "uuid": "db5b6f0a-8303-4a5d-abd3-dd58fa76a16c", "comment": "Malware payload (AgentTesla)", "value": "2b5450f8c84198fd4062d3a9eab2b2769858dc3adb978ba218d29c2bdb94d501dfa11f6d79c903cb36200fdc4a82a283", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715248, "uuid": "eb6633f5-5712-44ef-9be5-36151638ce37", "value": "5D05238333E42915D6FE2BF52090640657B4E40AE617FB4E3D8949FDA6D7AE043923E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715248, "uuid": "c5fb8d4f-930d-4dd7-a399-bcf1d00f081f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715248, "uuid": "5c93e1d0-b2cf-4025-9fa6-03d585585e70", "value": "12288:sEdhyi8QpfBaSYt0v4hziaLLxQAOtMPRiPD25b/luXxxgpSG20VAujR0XZjF+P:153YSAh2CLxlPkg/luXDqS2RjRW+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715248, "uuid": "63d6b70f-4804-4e48-b460-2beaceaf1ea0", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715248, "uuid": "1a86b932-e8ad-4cb7-8e82-770980265afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715248, "uuid": "48e9cc1e-987d-4b77-b135-d37ca52bd02c", "value": "RFQ-Quotation..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767e4b14-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738287, "uuid": "4d582ee8-e80c-406b-86d3-743f1fe4e852", "comment": "Malware payload (Dridex)", "value": "5a9225e5dd050879718312863e486631", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738287, "uuid": "7518398d-2881-4344-95a5-8d784d2328eb", "comment": "Malware payload (Dridex)", "value": "b59e0ca13e74a09ff3d6c8096bb022ac9e21e9c3baa8193ff2db3ff31af3650d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738287, "uuid": "ddf90baa-d441-41e0-a351-166c0e92d9cd", "comment": "Malware payload (Dridex)", "value": "8c5010542c214c69ef40e18f156ce924911d54b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738287, "uuid": "96b9be25-4d3d-4585-beb4-f13796347289", "comment": "Malware payload (Dridex)", "value": "d6d64a79ff1eb37fe33a88b823ef933be9d3b8313842a007312cf142ace1f179318bccc263f5e0d1a6ea4e7564d3b8fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738287, "uuid": "856c356b-77a1-40a1-8a39-2b6fa31f6218", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738287, "uuid": "308b38c4-19b1-4a9c-8801-cec17628397e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738287, "uuid": "ed652eac-cc52-4923-9f54-473ec442e22f", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738287, "uuid": "6837ed18-c123-48b8-8a86-51cf50e2f040", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738287, "uuid": "abec8d75-e41a-4603-b2b8-ffbe286c2ea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738287, "uuid": "ba671162-ee84-4c22-83c0-4912807d701c", "value": "5a9225e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efbe769-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620712156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712156, "uuid": "0f0c137b-473d-4334-9bf0-f26b6800e91b", "comment": "Malware payload", "value": "c047aacc87f84d879cd666afdcc252e7", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712156, "uuid": "05e32554-2cff-4efe-93ff-e389d236e1f8", "comment": "Malware payload", "value": "b5add0dcc5ce75c19e2af5c9566c449204b77c89247df496e4d5ffa7ed281d56", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712156, "uuid": "968c6d1a-8006-4007-8b8a-56f1762afe3a", "comment": "Malware payload", "value": "0abf60d43979e5a0e0185e26a01fcd9986249cb4", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712156, "uuid": "76e9f462-4f5f-4fd4-8586-52d1f4412624", "comment": "Malware payload", "value": "1b2784c0e1dd5518814e590dbd6e2bbe04b8d1f09aaef425ba868ffc7662bc9b192c9ad58c4ff235c59f31efead3f07e", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712156, "uuid": "f7fdfec9-288e-4c7d-a530-22fd6386ab92", "value": "0EE42313561F6870F85E6B30FBB02D1A729FEE3377841506892A94EC37087E2F52D15A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712156, "uuid": "e556f927-c11c-4a5e-90f4-73baeda9ef8f", "value": "12288:SzygNAJhi4sShjHxU8QLf8NNbpxiUGBrDBam+Y4a6owDe4of22AkG:FgNi1sejRUFLENNbpHkdN4howDdof22i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712156, "uuid": "3f09c906-1365-4905-b5fa-75e4b9dba4a3", "value": 662829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712156, "uuid": "a585350f-d996-467f-99c4-d40829abede9", "value": "application/x-bzip2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712156, "uuid": "4dcadf17-4cd9-4004-b3ba-d1494461d88d", "value": "Ningbo-Bank Details.exe.bz2.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae16cfb-b24a-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620732067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620732067, "uuid": "6e750498-1026-443f-ba94-9f5e90d340a1", "comment": "Malware payload (OskiStealer)", "value": "3ea68451bc134bea97313a13587b7841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620732067, "uuid": "7b9117da-1624-48d3-97d8-6c6279713db3", "comment": "Malware payload (OskiStealer)", "value": "b5b4f2430ee5b5348b55a2d1be3e1bf5f88094e67409bbb88d6e677da91c8482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620732067, "uuid": "9eaf9ff4-19bd-4fd2-af63-482e663160dd", "comment": "Malware payload (OskiStealer)", "value": "f75536e5d9e174aa2d2e75521c134c03a720b93b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620732067, "uuid": "e246801b-20a9-46fe-8465-478f32893ea0", "comment": "Malware payload (OskiStealer)", "value": "53288bec74d133a5c1d1797815ec0356768238f93de2d024ddcfdd681cc9a6903612595cc4e024577652a99b79221bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620732067, "uuid": "e370ccfc-1ee0-4623-9192-496c5c8a4514", "value": "CC44124823A28FA7E45F177015322B658EC79D050D92A7CF73EC3C553A62A43662E2E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620732067, "uuid": "70cc18e2-cb16-4abb-8943-f3d81e108fcb", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620732067, "uuid": "b4b83e50-5e8d-4450-96ca-4db83f13433f", "value": "6144:j9X0G1nmT75Uv5c5p9YpiDRsNYiBZIniAqhAU6rOD:t08mT9k49YpiDRsioZIniAEjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620732067, "uuid": "d7662fa7-9a3b-4efa-9b99-e6c4ebb06011", "value": 264653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620732067, "uuid": "cc90f01b-79e0-41dd-a5a5-df36144ec446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620732067, "uuid": "5d24cb73-863c-4396-999b-5f9c4b6c06d6", "value": "booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5499e862-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712890, "uuid": "c0384bdb-1dfd-4cb5-b9ec-67f7c8e73b36", "comment": "Malware payload (AgentTesla)", "value": "85f86fc98abf8385add5d5dc21b96eb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712890, "uuid": "d37f18b7-c889-48cc-b637-f33775d9e02e", "comment": "Malware payload (AgentTesla)", "value": "b5ce42fa28b7438d94fc27799005c42328fc24d4e67dd8725a6eaedd8edb97d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712890, "uuid": "344640c9-1b60-4277-92ea-0e7e8a732877", "comment": "Malware payload (AgentTesla)", "value": "0319cfb5fc2439aca330483caa2f22263c52b603", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712890, "uuid": "29c69757-895d-4d7a-baad-f7c9aeb81b55", "comment": "Malware payload (AgentTesla)", "value": "64c6bffe9868d5bba83dd05f3862fe3cd3d652ae748ab90141225739c331659a905f4806fc0c63d8f2f7e1329ec56dac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712890, "uuid": "142d9b22-54eb-4801-89c3-4b8149a2de76", "value": "229423AF4B18386825B96D9CC4B740DDCB6D820CBA73883DEFF252D6358D5053936D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712890, "uuid": "c89d0ce5-eb45-4a19-aab8-7ae51a0aebc5", "value": "6144:9oLLG7tO7b5XhRtidjl/Uf+5wpLCjy3ZJ3jxIqxZUrrQE7mK0rxP91PnenM:9ojXntidjl4mG3f3jx5urn30r8nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712890, "uuid": "83b47c4b-4f63-4da6-92c4-57c90cc513b0", "value": 444023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712890, "uuid": "e980dfab-26be-4e44-b685-ed72ce29baf1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712890, "uuid": "b53c60ca-55cf-4b7d-86b0-a081101eb9ad", "value": "TJ190001-P-IW-DP-GA-2047-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3865b7e-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1620691252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691252, "uuid": "346ce528-9286-40da-9507-e53b6243164d", "comment": "Malware payload (Sodinokibi)", "value": "534dd5c506b802764937a2543a791cc3", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691252, "uuid": "02a87119-a300-4735-960e-ac4638cba7e9", "comment": "Malware payload (Sodinokibi)", "value": "b5f3199cd1004b130ab397a8798ee0a592190c0b7a056f08d2e20b505b70d1af", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691252, "uuid": "f182aa71-f764-408a-b180-8d1464882b78", "comment": "Malware payload (Sodinokibi)", "value": "8bfffa23ee5ca05314fa2bc5e2bb87bcb7f32043", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691252, "uuid": "70f4f2c6-4d6b-4604-a510-04e99f5faede", "comment": "Malware payload (Sodinokibi)", "value": "68aa257d46f2c95da1ec6c22d643d6e1f78dfb86316b9adde337730af9c85e20e0e1df074f85f1843e10a9faae6146c9", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691252, "uuid": "bdf5e06c-da1d-46f0-8457-9189447b2e66", "value": "2D6633CCD7DB7950753BB8E1D2979B0264B28E991D96386094EE7170FF7107A0E22CCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691252, "uuid": "40e4b9bc-6fe0-48b3-82ba-64cb8f0c51be", "value": "98304:1PFbGsXyJAPEITszCi9C5fwkF0J1SW+VVUE0drkPB3IAxclf/xrgTEri7iLC:5F5XZbT+j++OcdoJ4aclf/FgTg0ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691252, "uuid": "ddb6cc1e-3943-4b39-9853-badba28c4fba", "value": 6525686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691252, "uuid": "e579b799-f929-41ef-9b7a-df2699c16a1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691252, "uuid": "218d6543-ea8c-4cef-a4d7-f89883638e21", "value": "534dd5c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5c62ca-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716497, "uuid": "6afab6c5-ba9a-46ee-a6b4-982280889ae8", "comment": "Malware payload (Dridex)", "value": "51f98436c37078bd97e1d42362062623", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716497, "uuid": "112204f2-9e44-4dce-a2e5-6eaa7c67051c", "comment": "Malware payload (Dridex)", "value": "b653884bb1ca48cd5a3f55989921c7dff9031c38073ea833d01f5b6283b629db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716497, "uuid": "39211ae9-a770-4ea4-bc8d-c4ec6b6731b7", "comment": "Malware payload (Dridex)", "value": "c25a150c37587319506cdcdea3d412912aaa3ad5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716497, "uuid": "8b80a3b3-c83d-4ee2-a6af-6ae6107add55", "comment": "Malware payload (Dridex)", "value": "7ea12ab2d864161ab9c15c4241acecb5112cfef6c4659f6ef7afdcebe1a12d4b3a66a69aa765172d5059565c8087ea55", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716497, "uuid": "a477d5f9-ae57-49a8-a3d7-62ffbe9b5b76", "value": "03F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716497, "uuid": "285009ad-8728-4c1e-aafc-909379cfd28e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716497, "uuid": "fe1b0d71-6d48-4604-b94f-da682b80f558", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716497, "uuid": "a9d9e675-13fc-46d8-8ea7-f98bdfafadf7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716497, "uuid": "2057620d-916b-4be4-803a-fdac989a0e30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716497, "uuid": "087862dc-504a-47d4-9dc4-a9482022d54e", "value": "51f98436_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd681864-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620735856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735856, "uuid": "9b436c07-809a-4429-9849-4ac87d7f2dca", "comment": "Malware payload (Quakbot)", "value": "69e098902fa697f2714460bb6e316745", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735856, "uuid": "33887e64-effc-47b5-b50a-52947b1d4494", "comment": "Malware payload (Quakbot)", "value": "b71db38d6a0d5662d139518ac16a79f19469d430f180cce83abb3e50411cdad7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735856, "uuid": "896ec730-c3b0-4c59-9729-3423f381e7aa", "comment": "Malware payload (Quakbot)", "value": "50d4bbc5e174df5a64a4026c4cc5e72d6b6e964c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735856, "uuid": "9bd31014-a4fd-4df2-8947-7904e76e8174", "comment": "Malware payload (Quakbot)", "value": "5f04ee4ae94ed6918f4841732af2fd63bfc092f214613abd0eb7bb3dfe4a3c56b06e3884e3fe592aa0adfaf6b128322e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735856, "uuid": "6af0a363-f867-4c2b-9be0-88a7e6901610", "value": "F9F4BF22F2A0CC33D173277D8E5B46AC9926BE81F924DD4B2BE41E4C5F392C17A16257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735856, "uuid": "0a0e4d52-1580-4da0-b921-75a24404a248", "value": "fc1104f9bb3be9c6813277ea0711ec4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735856, "uuid": "20966f45-04a5-4b83-bc70-183ff5a74eea", "value": "12288:enRnEh0sbP6x2EQN84b+YJpGE5ke42eEJuBnitAL6wxloYm8I/BP9mmB+:QEesG3QQbsk6eEJuBPOu+99z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735856, "uuid": "8d1e8b4f-84ec-4828-a74e-553aa9c23975", "value": 757882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735856, "uuid": "96a1b2f2-000d-4fc3-a16c-6eb68901d82b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735856, "uuid": "d1e85d9f-48a5-45d0-801f-1e679558cbfa", "value": "lora.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6754275-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728945, "uuid": "d7abf707-50b9-4a9a-b354-20f483f9f193", "comment": "Malware payload (AgentTesla)", "value": "2b5748f93c617c351cec0dbb22e35b30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728945, "uuid": "e296e5a9-ba41-4b5e-9824-fe0280121858", "comment": "Malware payload (AgentTesla)", "value": "b791f9ada5f7bab5e26ab2227b0f615afe2135362e53149ae13df99af3072fd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728945, "uuid": "5e594449-c116-472e-9fd7-8e93d45d6249", "comment": "Malware payload (AgentTesla)", "value": "e9844d8415f1148eb2926b98917977b781801ed2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728945, "uuid": "e00afc89-e371-4158-9620-81579da93a3d", "comment": "Malware payload (AgentTesla)", "value": "ccc2df61f3caf44b4660ce9fd40ed23b65f0946481224cc7cb2372a8996464bf34fd92c89bcf3b53b4cf9805f90a0e11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728945, "uuid": "f0c820d0-039c-47c9-9905-a36cbbdabf53", "value": "2D15F1223368AFA0E5BD477BC864594083FAED03EB22D55E7DE970DD49A0FD02672603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728945, "uuid": "5b5a6036-6a55-4e10-8d4e-278e3fae9ba2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728945, "uuid": "5e4e4563-3dc0-4a00-a4c4-f63373f4f245", "value": "12288:XQ5iV5PwzbeLUiHmpEIEM5IWNyBP2WI9PJb2f5ykmalUG/cA+Cw0Y9xds4i1iBO3:AjgUEmGIpVNyBuWIf+maeUcA+CAMiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728945, "uuid": "04d796ee-597f-4275-8eec-49c685cc4e5a", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728945, "uuid": "05c51423-0249-4b56-b7a1-03fef8033731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728945, "uuid": "26d8894a-32da-4918-9e84-1df6f2c41548", "value": "P0900779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6522235a-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (DCRat)", "timestamp": 1620717213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717213, "uuid": "8a48f28f-61d3-48a7-b638-aba578fa9fb9", "comment": "Malware payload (DCRat)", "value": "ccc7803389733e45ce179ae208242269", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717213, "uuid": "85175650-9422-45cc-b057-5dcd4832476a", "comment": "Malware payload (DCRat)", "value": "b796073540d5c7e3d2d6af78a6226e51ca4eab04c5d258d8a324c0d6fe6d36bc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717213, "uuid": "15f1f6bb-45dc-4de7-a251-cb8c5c4378d4", "comment": "Malware payload (DCRat)", "value": "21d8c9325420266b40a141e78d51bc4a3b3c585f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717213, "uuid": "4f58283b-e5ad-4c65-a5ea-abd595ac2575", "comment": "Malware payload (DCRat)", "value": "3abd105ca85be52d44f6cf3dc6087c58d1addd7b61e2b86a23a663a635d19bd297de95d13652dce69d08cd9071904745", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717213, "uuid": "f1400b20-3590-4295-81f8-2586e8a2997e", "value": "0D55AF6D321076DFC867C832D9586C64FB60B877830BD207A05725ADAE6D99BCF250F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717213, "uuid": "b151cfc8-13b3-47f6-a9fc-363d6a73ee4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717213, "uuid": "7c3f822f-9a6b-4b2a-8100-a9bda68151bc", "value": "24576:vDfb6KgrfANLBmxea2rbQs2WtbhBC5n5GD44G+ftasroX61:7f25DAyxeaRWqn5N4tFoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717213, "uuid": "ef7cd88e-13c3-422e-913c-dadee3d7f4ed", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717213, "uuid": "1fdb714f-6c5d-4aa6-b05a-589987a90cab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717213, "uuid": "c0c22993-871c-4055-acb1-84798bc2a1bd", "value": "ccc7803389733e45ce179ae208242269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb53fb68-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716579, "uuid": "2a8bfd25-04fa-4e8d-972e-7e2dde0b6d7b", "comment": "Malware payload (Dridex)", "value": "c641ffec31ffe3a8f5b4108a5e50f3ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716579, "uuid": "fdc1bb7d-3353-4116-83a7-1ce4b47c832c", "comment": "Malware payload (Dridex)", "value": "b83743b7c840b2a17d95a88bcb0d62a8b9668a4b7554d17e21e6a4ff97af8394", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716579, "uuid": "333cee0b-1887-4379-a906-116f0110229a", "comment": "Malware payload (Dridex)", "value": "181b8b6d20c78476d04d3c758d10db7149a2ccef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716579, "uuid": "618e5d69-c688-45af-835e-022018e69788", "comment": "Malware payload (Dridex)", "value": "bc829174d3df619adaa5565cc0327adbc942aeb50a5c8350c7ad12470f8d6ce3b81bb5f9fcc055bbbb8333ca9c66b6f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716579, "uuid": "c7eb6a94-0175-42b6-99b2-0648f755d8c3", "value": "4DF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716579, "uuid": "0d95ad5d-2b11-4e56-bb82-72de9e617fda", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716579, "uuid": "553f7ceb-d9ee-45a4-8a3b-eee77299cea6", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716579, "uuid": "47476b82-7e69-4ca3-8c98-151f16421f92", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716579, "uuid": "73a557a6-568e-48a7-92f3-8eb19853365a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716579, "uuid": "23aa9e1a-f9f3-4b9f-8645-a418e41f6713", "value": "c641ffec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e16043-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716813, "uuid": "7ab8cf85-b3a2-4b3f-a998-a7449a9f4cf8", "comment": "Malware payload (Dridex)", "value": "65f99f05b2f321ba20c15fa6855ff59f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716813, "uuid": "9d620125-b451-42a2-b83f-aa889c7441cc", "comment": "Malware payload (Dridex)", "value": "b8e0f69f97c05676be325cdedfd94f177ab9497c23c0e69ad63590b7fcacf092", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716813, "uuid": "93751fbf-68c3-4551-97cb-867b81987bf4", "comment": "Malware payload (Dridex)", "value": "6e2c938c3a9da6ea14dcc571f6ed57f596aa2389", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716813, "uuid": "d31b4ee0-1da9-42e7-9af6-360980c52fe5", "comment": "Malware payload (Dridex)", "value": "59422102d03130037afebf01eaf9a3145a3f16e4f8adc370670a0e594c5732608d2fd0a9d71192bc72a9bd6cbb30ce66", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716813, "uuid": "e56c431d-ebe8-4fe8-b65b-9ce1794ad085", "value": "25F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716813, "uuid": "3dbc2367-7c45-4fa0-8a87-c719dec54306", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716813, "uuid": "831242e6-aa39-4d5f-9af8-1f25b28a1037", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716813, "uuid": "859b1e52-7c49-42d7-b428-2f4ab6769325", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716813, "uuid": "656364ef-760d-42fe-bf2a-3665fd09be56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716813, "uuid": "250e9189-2e8b-4829-9fcf-6ba4e453071d", "value": "65f99f05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a0ef25-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705644, "uuid": "4bf947c5-b14b-4f6c-9689-5f87a7bed52c", "comment": "Malware payload (Dridex)", "value": "e39864d71e9678b8e4577cbf166cde27", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705644, "uuid": "6abb2197-db75-4ddb-b7bf-3fb92408d5f9", "comment": "Malware payload (Dridex)", "value": "b91d11ee6ae4545065fcc3682986a67dc458a35cf60b73b83c632d23813bebcb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705644, "uuid": "8ad11722-92a9-436a-a906-8c8b581c5ada", "comment": "Malware payload (Dridex)", "value": "ac3e56000665071d55ecdbb58b7afb54263fe49c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705644, "uuid": "5e2f44dc-1ef4-4d0a-b556-019092740bcc", "comment": "Malware payload (Dridex)", "value": "73b7d0b7b6b5ceb11285cc6901b5dd2225b869dd3f97642ab0d68613842270b92a39b493c0f26588069cb64b15592395", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705644, "uuid": "e5f4dec6-b306-4271-a2a8-06f9affaeb3c", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705644, "uuid": "1cf7ca5c-79ec-4b2e-897c-491c3304899e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705644, "uuid": "32800c3f-afb1-4895-8300-d7f72a45b790", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705644, "uuid": "06994952-109e-4f5e-98c1-2c985eced43d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705644, "uuid": "750c96e0-602c-4cb0-b3b2-1365d274544b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705644, "uuid": "80010a04-3b9f-4bd4-b11f-a9f9e7d8ed73", "value": "e39864d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37306bb8-b25a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620738610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738610, "uuid": "5cfadba4-69a2-452a-9075-4bbb090b6bff", "comment": "Malware payload (Loki)", "value": "d500d9c8fe5e285ca7333ae0a1ee4fbd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738610, "uuid": "9269e95c-9fa1-4fee-b2be-0e98172ed3ea", "comment": "Malware payload (Loki)", "value": "b9818eec76a44c8a4614df0d7f4912a6e8284f5266a2439bf590bfd650fdb89e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738610, "uuid": "02fc8820-86da-4d2a-984e-b46e91c013b3", "comment": "Malware payload (Loki)", "value": "cf2948b746ebaf934b1b79a6c88bb265aeeb98a3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738610, "uuid": "6a0d29af-d961-43d1-8143-81bae60e9c5c", "comment": "Malware payload (Loki)", "value": "0d1c45ade9b0f04946b054980115e47e928db8ff4d036c8963b0bf6a4a681d1c40325e8053cff12b788cc909489f8de0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738610, "uuid": "153c822b-cbf3-434a-8436-3611390cf088", "value": "1BE45BFC751465F9D35B5C23A3CF0C1682252270A93B6A0B9B2103BE5A5BD273E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738610, "uuid": "cbed1c30-af1e-473b-92e3-111d86112857", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738610, "uuid": "eced2801-be88-4f14-b9ac-228118236bb9", "value": "12288:boLLoS60/K7yh0AwIXwQD10Albzps/CvAD6F44pAUEwKCLeQACh/:boLAxlQD1HJ+/XDE44pA5ClAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738610, "uuid": "b9979ee0-6a4a-491a-b7b5-21eea5f1db5d", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738610, "uuid": "450207dc-3dad-4163-8f78-85c1f0fef5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738610, "uuid": "4007ba52-808f-4423-8db6-e19e0d37f3ae", "value": "27nEZG2qxdowBja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796b24ed-b27d-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620753754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753754, "uuid": "755b1747-fa3a-40e2-bb50-917ebb61e5de", "comment": "Malware payload (NanoCore)", "value": "fbfddfc110fd9d3775674447316de3d8", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753754, "uuid": "430cad26-a976-4410-8f30-c94d02f597e5", "comment": "Malware payload (NanoCore)", "value": "b98a4c0f84e431cbff5477f1e1ddfe1a93ba56775148cfca7f061f9beca0e48f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753754, "uuid": "53953e98-5582-45c0-99d5-b19a15cb625f", "comment": "Malware payload (NanoCore)", "value": "250149eebd54c774175cef2a09344cf429ca6f57", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753754, "uuid": "afa62604-3af8-430c-8e49-9dad99348fb1", "comment": "Malware payload (NanoCore)", "value": "11d79e4257887dd57bfc664a5ae505cda106f4921177862ac01e6373dd9431bc4e7cb79c450fa37a9bbefed71594fe07", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753754, "uuid": "5f67d1ff-b4fe-4c89-818d-a2a9a9eda689", "value": "90C4B7D1F150C8DAED6B09F1AD2BA53024D7BE9C94A4410C569EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753754, "uuid": "ca4bcdec-e72f-4482-9387-d03f7abaedb8", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753754, "uuid": "261a2e2c-0845-49d0-97d8-c6aa35635c0a", "value": "6144:49X0GPoprRVuufOwF9z+53e7/1yzxQ63W9CgE4iB1fMMtD8Dbc:O0LrP/OMhEzWskiznkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753754, "uuid": "a06b4f7d-2158-457f-a990-5c2354bd2b3d", "value": 555010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753754, "uuid": "6bba66b1-9a5f-49a3-ae9a-5aba4e5b7ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753754, "uuid": "2ff9a712-fea0-4c42-971f-f43e04c31629", "value": "SYT09009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71efcecf-b249-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620731407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731407, "uuid": "ae999357-f37b-4ada-bdf5-5322b068e581", "comment": "Malware payload (SnakeKeylogger)", "value": "be8928c5a8b81bd3dc8c5c031bffb529", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731407, "uuid": "340a8a4a-8eb3-4308-bb63-1c253d35c9b7", "comment": "Malware payload (SnakeKeylogger)", "value": "b9b7c8c13a609e6a8ecdafaf039b5f7505f7fb72d444a41ff7705a8a249e4b4b", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731407, "uuid": "1e12e239-7ca5-4adc-8c44-5f9db5b58767", "comment": "Malware payload (SnakeKeylogger)", "value": "f5a55492ca257306cb51b10169cf37bb6bee4caf", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731407, "uuid": "97bf4581-889a-4aa2-a30b-ceb139f4352c", "comment": "Malware payload (SnakeKeylogger)", "value": "c3cf816ece7f52f14e0aba2b3b5a8666809a3408fcf41983871c468b3a62685a76fad50b40f5262d44c9ca501891be1e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731407, "uuid": "54d23c7d-7215-4d7b-b1de-bdcc775f382c", "value": "9BC4E082A640C045DC3E5BB0E83E9EF0964F7DA6E874B14F2F897E6873B31E21536549", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731407, "uuid": "e84063f0-3f25-4fe3-b1e8-83b7c1de85f1", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731407, "uuid": "40da14e9-51b3-4170-8a22-55f24dd19048", "value": "12288:H0WP69ewcDZn3XrF+SCn+S/ZNmhKjEuWjoES5NRctMigL:FPcVcDZnNCnf/ZOKguWUhv6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731407, "uuid": "8be36fde-920f-4796-b43d-0c77a7c42f22", "value": 590765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731407, "uuid": "9ade6ddf-2990-48eb-9092-2da8e6ebccea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731407, "uuid": "0d902399-9083-4faa-9a6a-33b852333962", "value": "be8928c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733dd4a0-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620705640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705640, "uuid": "7cc5a72f-ea16-4834-b1de-a91cc5b67e57", "comment": "Malware payload", "value": "3fce454b5a5ba7d73cc2b2560f69a48a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705640, "uuid": "6f5a8e19-7748-4585-81cd-45b739450203", "comment": "Malware payload", "value": "b9c87683d4000e24d419ebe199d2c55dbb9757d5cc8f4e6d9a0295e963cbb07c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705640, "uuid": "29fe8108-fb15-4044-9785-78780e30a77e", "comment": "Malware payload", "value": "b9321f7d1bbb1e020b03b676bd23d53e9ff6c17e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705640, "uuid": "fb328b18-c6ab-4529-bb85-5b39675ceb17", "comment": "Malware payload", "value": "faca8f2fb583a00935e1830096812a6e7121b91436f2c92e4302e2d18f928cee84a6e784f11df03e1ad5118c7927b2d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705640, "uuid": "0a22c4f8-bc3d-4beb-a86c-7ef9368f2015", "value": "2E138B47DD045C03E0598BB9FF921EE8A7681999F80236FD38BD1CC56BE01426E9A53D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705640, "uuid": "48659592-08a4-4130-b0b8-3ce9fc0e87ec", "value": "768:i17BPssgSvs9DBZdEC+iyNaVY2gCB38jyakw6Lzbi:i/PDgSvs9DEjaVY2gG38vH6L/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705640, "uuid": "6878035a-52b6-43e7-adaf-84f00b3e945c", "value": 44166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705640, "uuid": "3cc1cef9-bdcd-4a8e-9ed0-30fe71389deb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705640, "uuid": "67fcbfe4-36a0-44fb-b3a6-fa4a5080cd4a", "value": "3fce454b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723bf16a-b2ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620774358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774358, "uuid": "7ce9e0d5-d9c5-4129-9d3c-070dedabac7d", "comment": "Malware payload", "value": "2843780bc6df47a8af8733cae2d784cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774358, "uuid": "bbdbab27-b6a5-4c9a-b9bc-1989cb78c2a8", "comment": "Malware payload", "value": "ba43ffc7c7a9a0a7a5b991ddbea399fa8d0d3c23c5ffe120b8e8a9d2f4bb1c72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774358, "uuid": "c0852672-769e-4e55-a555-4f73e456a026", "comment": "Malware payload", "value": "765a7738f92c50a80da7fcfd82e416375cb0ed73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774358, "uuid": "d0d7aa1a-8fa0-432a-b1c8-44fde16aa7b6", "comment": "Malware payload", "value": "111176e53d75d2b7f6a5454e8e021726bc040ba678b8c4f397e76bc7306e1ea38d4a7799b984118ba351b30d4e246050", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774358, "uuid": "4e19e38f-c910-4368-ade5-d6ccea041203", "value": "E3F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774358, "uuid": "62c4b7e5-398c-4639-8aee-af1555fa4fe1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774358, "uuid": "53a6533a-5b2c-4bd7-88ec-0e1d9281861c", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620774358, "uuid": "6d569074-1eb1-4138-bd05-5448dc65a248", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620774358, "uuid": "05e5d221-bdca-46a4-b3be-858c43caaaa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774358, "uuid": "238f8f87-525f-4e36-abaa-6c0f56a7d6d4", "value": "2843780b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a283b3ad-b29c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620767137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767137, "uuid": "aa2dea7d-cef1-4502-8527-203cff98ec79", "comment": "Malware payload", "value": "555aa235be2eeda2c4162cfef8b2df32", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767137, "uuid": "c78403be-c432-4ded-ab75-15cc7aa4713c", "comment": "Malware payload", "value": "ba92908e6992eb21eb2265dbdd2f69364c9966a861f54750becc50b5c6bfefde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767137, "uuid": "bb268f20-1ea2-461c-be26-56f04edc8a1f", "comment": "Malware payload", "value": "a95087fa082f73abd1797cd7d066ef941c2c2b3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767137, "uuid": "e9f14d4d-1980-4ec7-9846-483edff5c723", "comment": "Malware payload", "value": "120b9fadff7e7fe7d2c394ed33afd4b7bc2871c40d52735679afc202d792d2db8f33252d637bd85254db5169537b9d7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767137, "uuid": "7c54bc39-98e5-46bb-bcf5-43dabbf4d69d", "value": "E8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767137, "uuid": "4cdedb9b-ecd2-4b20-a929-d992af256a84", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767137, "uuid": "a76ba74b-b50e-4173-a557-c3470606def7", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620767137, "uuid": "eb106f2d-2f90-4a09-b3f2-3a5da2853b46", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620767137, "uuid": "653499fc-4c9f-45cc-be4c-f585a17bcaac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767137, "uuid": "d9a1f5a0-4e96-4a7e-8ca9-df9589fcdd7e", "value": "555aa235_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6bb9a9-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698439, "uuid": "6e2741e2-c20b-4051-a3c4-cf25d201163d", "comment": "Malware payload (Dridex)", "value": "42e31a8bc4375199d7a9c7995dba225f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698439, "uuid": "ab4c29eb-2b0c-421c-b58f-60c11bf00f04", "comment": "Malware payload (Dridex)", "value": "baa8009b937afed675fed6f954d8374a442717095ba6e98b216941d619cc1bf6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698439, "uuid": "2d586982-94d0-416c-bff1-2ac32160ab64", "comment": "Malware payload (Dridex)", "value": "0a3decea0991c334e6419bce273f5e950f5ebfd7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698439, "uuid": "af1d1d23-300c-4c3e-879c-04e0cb54657f", "comment": "Malware payload (Dridex)", "value": "4941830724312929ca6b17f19ee14a329012eb6e36c5573a55886334c08f52e538b7bf7123966ed8a97d9438a1e17e63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698439, "uuid": "fd7d0309-9976-40bf-9997-4fdef2b6e1be", "value": "81F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698439, "uuid": "0aea094e-f52c-47b0-82e9-f043e1ca3a09", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698439, "uuid": "2d1fca72-b448-4e5b-9d6e-5f26fc3f85c8", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698439, "uuid": "39142f98-1898-47c3-9961-6a0d20f176ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698439, "uuid": "662ccc52-3a0a-46c5-982e-aef18c9d2f09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698439, "uuid": "7ac8fd99-d7a2-4b94-a3df-94f03f93cdd6", "value": "42e31a8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869849b8-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714692, "uuid": "c3707514-aa45-4919-b924-75613287bbc7", "comment": "Malware payload (AgentTesla)", "value": "b71867b3278b9d29be8870740a3ba192", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714692, "uuid": "18aaa176-bcbc-4b66-b73b-76305ed05660", "comment": "Malware payload (AgentTesla)", "value": "bc19c6ec53c76e72bc291e6b014080dddba872befba2507f07c3e046e13c4ae6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714692, "uuid": "1fe342df-ce76-497f-acf3-9145d862e1b1", "comment": "Malware payload (AgentTesla)", "value": "0733b0544aa102b188b610dfa7aadda3dd8b9617", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714692, "uuid": "4e7b8eeb-0910-4079-ae87-9feb7197f03a", "comment": "Malware payload (AgentTesla)", "value": "d686f6a9f4ecb5e4ef0617ff87dca0a96ae434541b02c1366620f030232b7e0aa14a174db5bcd5baaf7f2bd6d7809c99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714692, "uuid": "35d2f7e7-9a08-4c78-b748-81bbfb41be5f", "value": "E6F4E0203BD8AA58E57F97751970C54023F2BA17C722CB5E69CE904E2E72746C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714692, "uuid": "85d51aa4-cd00-42b2-9e6d-7bdb07b00a42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714692, "uuid": "f1b3b4a7-2d7a-457d-a489-a0325271c398", "value": "12288:EEsy2lDXqtBVw1hhh2mppc3BRtbTw6IMEDiQnC7VGGJyfr1hFJ:EfDXqPGhhh2mew6IMEDi8ChG5f5XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714692, "uuid": "daee2b52-f334-4b9c-8c71-950ce96c29cf", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714692, "uuid": "eaaaf72e-8371-44bc-be7e-77610e15e8e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714692, "uuid": "a0258cde-8d9b-4520-ae28-9f82cc24d020", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b23103-b210-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620707100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707100, "uuid": "86664f46-8c59-4849-8789-d1e726d56bdd", "comment": "Malware payload (DarkSide)", "value": "a14e07f7da701bd91108f988862a71a0", "object_relation": "md5", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707100, "uuid": "affb8fa4-50b0-46f1-a48d-5b64ed851645", "comment": "Malware payload (DarkSide)", "value": "bc32a2ccf158ebe2b76646be865a4c6dd91da6b8e5bb0dd9520102a9bfea5439", "object_relation": "sha256", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707100, "uuid": "ee815755-49fc-4bd3-8ed3-d4b947785235", "comment": "Malware payload (DarkSide)", "value": "bcbe67c6518e68d4056f10fe9191d2900d06190f", "object_relation": "sha1", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707100, "uuid": "30e8d996-dbbc-4c5d-8aad-79d0def0369a", "comment": "Malware payload (DarkSide)", "value": "1c263af3b4751e0fddd7c528761332a4f4c986abdf7cba542e03fe7d5cf68d871c4e3c5d743de4af0bdfbe7b32361e06", "object_relation": "sha3-384", "Tag": [ { "name": "Dark", "colour": "#2F2C96", "exportable": true, "hide_tag": false }, { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707100, "uuid": "1ac78530-241b-4704-a85f-1579ee3d9c0c", "value": "BB134B8B8659D2B3DF1412FA5EAC7BE3665F2DF1C627905A06240F58A4384B3DF0172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707100, "uuid": "c2106eda-1a9e-4363-8b81-b4df9b5dfa26", "value": "b9eff3ef84e2c498e581399154cc6576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707100, "uuid": "84b3c300-1031-4e8e-a9d2-6c674073fe64", "value": "384:royzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpI8:ro4EpThIpEdauX3hS/sj5kGudUj9Vgru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707100, "uuid": "6cf69f0f-4aaa-4c22-a88c-465de80f5af6", "value": 42034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707100, "uuid": "ea52e2e5-eda0-4fd8-a261-c586fa3bbfa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707100, "uuid": "5109b0d0-7784-4a67-890a-459d46a960de", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaff0596-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620753085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753085, "uuid": "2378f2b1-b26a-42af-b42c-21d1d64fee43", "comment": "Malware payload (AgentTesla)", "value": "565124c8c99cf35e6c31f0b296295799", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753085, "uuid": "9809df0b-0277-442d-9af4-7f71aee87308", "comment": "Malware payload (AgentTesla)", "value": "bcb1d4be5d90089602ec881732a69337c591f5fa07fc497490283e9cb4215b24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753085, "uuid": "7563b34a-1255-4e30-930e-f2e20945a4e9", "comment": "Malware payload (AgentTesla)", "value": "737c7d3f3e8c76b14fc0ae0003e8ea2ca1321d85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753085, "uuid": "af33232f-489e-4804-87a7-44ced8b5fe74", "comment": "Malware payload (AgentTesla)", "value": "1cb138a1d39f8ec9d4fc3ef449bfd502cf9bac496b1adca0651be74cd8c5122ba3c2fe4f5b70946cb03a102a6fffea04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753085, "uuid": "fba27800-709b-43fc-81d4-2aea4ac16cce", "value": "6615124076D1952CC4790A30DCD6931C0A39AC91662286D9B9DBB23AED3E3DFDB70B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753085, "uuid": "ec7ab665-3a1b-400e-ba62-abc3f86469a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753085, "uuid": "e2eca238-bae4-47ea-bedd-c44ad815af0a", "value": "24576:pgIiUG5rGsZRA2laepVGK36/B3X1uDJEEflImEWZ:pR4FA2MeTGK36/B3X1+GpWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753085, "uuid": "77583eca-b45a-4cd7-b123-43fdfb3a539b", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753085, "uuid": "06b3c647-3084-4bed-b471-6f8356011c0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753085, "uuid": "0889b564-8fc2-48d3-ac46-91bdd2b8f768", "value": "565124c8c99cf35e6c31f0b296295799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a502b93-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717221, "uuid": "d1e13cdf-e012-451e-b3c9-b2e6796cab5f", "comment": "Malware payload", "value": "3797a11eaffd59ce06f191120eac881b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717221, "uuid": "1d536fcb-f6a2-4987-adc9-9ea7874dc92e", "comment": "Malware payload", "value": "bcde9dc838faa6a596f8b6610e37c3fd3a144d348ef64469b5cfd6b1f2e299b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717221, "uuid": "f8e8fddb-922e-4c9c-b289-1da0332f4237", "comment": "Malware payload", "value": "fd157ee38774f6c202efdcaa8e0025b436dbcbc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717221, "uuid": "e32150c2-e414-42a1-b4bf-d7135fd9a555", "comment": "Malware payload", "value": "16800a08e5ca7e86446ef163d3f8ba2fe45a8c6e01bf1c6f3682f75a4f57e16a6f323b9f82b4e4cafe2e8c0ff8514980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717221, "uuid": "b69d45a0-3d9a-4f5b-aa5d-9dd957bf39b4", "value": "65B22A6A11D4B124F6A709701CB1FCB43A68A7302494E90DE469155CCB83FBE78D9FDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717221, "uuid": "f502b258-f73b-416a-8919-5d2b7a1c8cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717221, "uuid": "510c2932-6fa1-4153-9883-cc5951d728a2", "value": "384:nGBc61Lrjk6BGUiTH03/uZ9kxQCbYhqEOkeZWZU0niMIFXHXXXrjIC:n6cR6YUm4YnhqLkeqU0sF3nvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717221, "uuid": "e22bb575-35c7-4d16-a5de-c43924618135", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717221, "uuid": "4508799e-83a3-448f-82c6-dc0c8612001f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717221, "uuid": "9cb8d455-a07c-4611-bfcb-63811563db80", "value": "3797a11eaffd59ce06f191120eac881b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d68914-b229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620717636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717636, "uuid": "8f9a3d48-a82d-438b-a29e-3e763dee4f02", "comment": "Malware payload (Loki)", "value": "4077a697f805b064748abee28b075efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717636, "uuid": "f50ffdf6-4ad2-413c-bb3c-42b04b5b1b8f", "comment": "Malware payload (Loki)", "value": "bd8d9286525b1c6df2d531a06620f5c39e388843a515f105ce6e13d7d7e275b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717636, "uuid": "ff6e81aa-a64f-47d8-a229-d92907159618", "comment": "Malware payload (Loki)", "value": "b378ac6858cd3db5cc0f9bf3108f59de054bde58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717636, "uuid": "346bdeac-4086-4f13-9fc1-892b42d14480", "comment": "Malware payload (Loki)", "value": "cc4f3cf9576cea9dc47f1343fd76c24cb5b2f16031bc804f8cf8b6bf2a55e87196fa79e663d63909cd63ce27b74ed915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717636, "uuid": "4c4ddc5a-3f6e-406b-83cf-a096b5ff000c", "value": "E2051217A6D07B20E1BE17B7C4E2455086BBBE47AB13C95C68F438ED54B3BA90250BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717636, "uuid": "5929fe05-d498-4ce9-be77-6443c666808a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717636, "uuid": "85b3a662-0ab9-40d6-9862-e3ea1c905036", "value": "12288:tWWFULgPmw+pBSDvC63+ZWjbO8T1JLEscjjTmafDwSfZhgyi+iBYyi6:8P3pIPuZR8T1J4scj2afD/xriP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717636, "uuid": "60108a18-892d-45bb-95df-843dc0119d51", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717636, "uuid": "b378208e-89f6-4076-9e60-9fd6581650a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717636, "uuid": "6312b23e-a280-49ce-be40-bed994799fa7", "value": "CtpIYy9OZ6K8kY3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5399eccb-b29d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620767434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767434, "uuid": "69749d9f-6064-42f0-8af3-94fca2b3db24", "comment": "Malware payload", "value": "18c0f6bec5ad497a9a2e651ade0ada7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767434, "uuid": "8114554b-d266-4571-bf97-255f4ef6254c", "comment": "Malware payload", "value": "bdede7677d35abba7c7c6f51327b7b1fd2d67b2ca34ec8ba14246b6442cc2993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767434, "uuid": "ea5c89ed-a50e-4c87-a50d-ab45e2dda993", "comment": "Malware payload", "value": "97d68e9a22f38ae796e5961848d0b248878a1810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767434, "uuid": "398eadc9-4c09-4ac6-b8ed-335e26c9926a", "comment": "Malware payload", "value": "019d8d7f533e1cccbf61c16121b85949d1b0f34891e7e5fb3f6d3c587a3c0d8a670c7c5189b7eca3952a7a78227c7467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767434, "uuid": "82c84723-ec56-4691-b2b0-f19cc9c36485", "value": "EB25E411A2914322F06E3B34D82A72541BE1BE7C2DD85369E6B43B4B4B3F2512DE51BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767434, "uuid": "55ecc97e-d087-43cc-b5bd-6d918e9711a4", "value": "b64b452434f9b4c79d8cd285903a399f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767434, "uuid": "bb9ef7b5-5a5d-4f61-8406-38f11a79e096", "value": "12288:BAQUdCLsY8iOnhm8q9vvgh8RWvezDm+hz24S0EmwoKtJ7RXXBLuU/Oy/E:BAB5iGhyR7PlRMlHVXXB6UD/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620767434, "uuid": "29577b44-ab52-40f4-aefe-c3a7ccc03081", "value": 962528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620767434, "uuid": "61bdcb0f-f8ea-4da4-a7ab-a6eb8a1d41f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767434, "uuid": "cdd14e41-11f1-41cd-b341-888e057020e7", "value": "SMC PO 1083 SAJ 1946 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506ce3c6-b240-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620727486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727486, "uuid": "cb8769e1-dbce-4760-a089-c74cc3b357b1", "comment": "Malware payload (Dridex)", "value": "29deac0b4ec54e43e428f9bfb2af3a17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727486, "uuid": "e821fc1f-0382-4d34-b322-e347ed64602d", "comment": "Malware payload (Dridex)", "value": "be7a589590cc619fd8284e944fe4bf0ef02d9890b22a85ea6a0e1052b6f5b2c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727486, "uuid": "a1b89c10-5a38-4f9f-a482-6c10b19006a1", "comment": "Malware payload (Dridex)", "value": "d0e4ba078ce233adf81fc1032a565db6437a7d4a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620727486, "uuid": "0e0716ee-e2a1-4bf0-9d1e-e98f2f627cf9", "comment": "Malware payload (Dridex)", "value": "423d053792b0fbce655b36ec0052d16db444eaebbe3d32e4b8a82ac6aa2770b3e2bf6e0206b9481546f21f3785dcd455", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727486, "uuid": "bd7ae6ce-1a18-4a9e-8ee7-5ceeac1bebd8", "value": "18F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727486, "uuid": "838a1983-7507-4f35-acd6-1b716d722d59", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727486, "uuid": "6e65adaf-8c4d-4bc4-a65a-5ccfa2b29163", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620727486, "uuid": "74a11659-ff74-4cda-9a32-efdb70cb7084", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620727486, "uuid": "15774e54-ac3e-4663-bd9a-18141240b3eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620727486, "uuid": "1d5e948e-2099-45e1-8178-d7cfd9f51f0c", "value": "29deac0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2f679a-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712958, "uuid": "5515f3b1-fcab-4369-8888-d5f697480975", "comment": "Malware payload (Dridex)", "value": "de44e4857a6ca120c26ff0831a5086b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712958, "uuid": "f4090da3-0ba1-4891-9f4f-82714a6f17ba", "comment": "Malware payload (Dridex)", "value": "bf96f4528afa9b23450d37ac61d0ab80beeec9759d6205a044a50192dc60cf5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712958, "uuid": "c191da7c-25de-4ddd-954c-ae8a9a8e30d7", "comment": "Malware payload (Dridex)", "value": "dc8c97162b375e32bd2dd33fcfa9822d44041cc8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712958, "uuid": "70f80f21-a060-4e11-bdc6-817bbdb06b80", "comment": "Malware payload (Dridex)", "value": "ade2321fd7697ab132b68e16747c352f81d528fb9f2396697601c4622b17453127bdbead9bef8ad4f1bdaf94964d6f7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712958, "uuid": "d6d2133b-0596-456d-ad9e-e6b606a0018f", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712958, "uuid": "7bccb696-7340-45b2-b657-425bdc00cb0f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712958, "uuid": "bca5b702-8cc8-45e1-8d2e-9a31007d2c50", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712958, "uuid": "a56cc9dd-28cd-44c2-a05c-7e57f9a7d2ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712958, "uuid": "9e5fac53-88d0-41fd-aeb0-18b40c22475a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712958, "uuid": "79443b74-3dd7-46d0-9f34-7eacc67ae072", "value": "de44e485_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170daf0f-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738127, "uuid": "f1960bb1-080d-41db-b773-41ff910f2574", "comment": "Malware payload (Dridex)", "value": "a868f6223efd4ea597f96eeb62f8b2ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738127, "uuid": "ab0eef92-646b-4ce4-a18b-d0d627932282", "comment": "Malware payload (Dridex)", "value": "bfa34049fa0089c12fc1907e7c914aa971ab2ac6e11819c537ff7c9223369c26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738127, "uuid": "7f16fc49-5b46-4879-aa82-bc394242578d", "comment": "Malware payload (Dridex)", "value": "5c11c48231aacab5fa132ef971c77400adba25fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738127, "uuid": "0a9826bc-b578-4ceb-ac88-e8f6eb29cc8c", "comment": "Malware payload (Dridex)", "value": "8ff65724351aa28d85c6d4931d9a37db851e0d42979290c2d52ead93945deda3db0b01bce0ce0354d8b304a8584e3375", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738127, "uuid": "a84ff23c-0c26-414d-beb8-b38025f8f775", "value": "19F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738127, "uuid": "9a398015-d342-4b1b-b7ff-604d3f50bebb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738127, "uuid": "68e4a52b-c7c5-4060-a56b-b6ce8af3f1f0", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738127, "uuid": "56fd0c37-f2f1-453d-9e3e-e9a6683e9c7a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738127, "uuid": "6a349377-9405-46c1-b526-0050cf22361f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738127, "uuid": "bf8834ce-6312-4847-8498-80a3d52a77d7", "value": "a868f622_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae64748-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620728899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728899, "uuid": "69a53079-fac0-4a76-938a-a917c7ff7a05", "comment": "Malware payload (RemcosRAT)", "value": "5c79e7985f29d10c562edc2345df8a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728899, "uuid": "3c4f5902-bfe3-455b-99ee-945e7db9d14f", "comment": "Malware payload (RemcosRAT)", "value": "bfe422f569af77aa4f5b1b9f1e85f6c89b7ca62540c368d5e5b152f68154a478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728899, "uuid": "6bc31092-c124-4fbc-8c88-e0ee2c3f427d", "comment": "Malware payload (RemcosRAT)", "value": "04214758794d18604c5fbc59c66dc30fe47a70a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728899, "uuid": "176c31b8-5bf1-4773-b6da-e4cc47d110eb", "comment": "Malware payload (RemcosRAT)", "value": "50730b6c0e666ed9ba1b920dec63ee679a0af324decf873898cdd1c002c7491385c07c8afcb41fc69a6607e369f0b374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728899, "uuid": "9af80354-a8d5-4ac9-958c-14f0ae346f72", "value": "0F250621A2414722F46E3B34C82AB2505BE57E7C2DD4136AE6B53B4B4B3F2502DE51BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728899, "uuid": "f962cd2f-35ae-42f0-b53b-495b7dfbb79a", "value": "b64b452434f9b4c79d8cd285903a399f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728899, "uuid": "2b43d4fb-974f-4200-a841-a0eb60cdd0f9", "value": "12288:/AQUdCLsY8iOnhm8q9vvgh8RWvezDm+hz24S0EmwoKtJ7RXXBLeU/Oy/oE:/AB5iGhyR7PlRMlHVXXBqUD/oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728899, "uuid": "265f0efa-1e69-45bd-9147-04162d1b2919", "value": 970352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728899, "uuid": "fb90c055-5c8e-4e51-8bf1-6e3120594483", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728899, "uuid": "69711240-eda8-48e7-b817-1e02dd063183", "value": "Give Offer CVE6535 _TVOP-MIO, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52407938-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715463, "uuid": "626a57c7-3be3-42cd-b4e3-579ddc9fdede", "comment": "Malware payload (AgentTesla)", "value": "e835f5a976ab1d8dd4e4e10813dd2a67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715463, "uuid": "675350fd-872e-4173-94f1-83e8ad198afe", "comment": "Malware payload (AgentTesla)", "value": "c1269286a5b767fbd0b90c97cc06279b08ed094069932c8d17acc4c3144a218b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715463, "uuid": "aead34fb-4705-42c9-8e6a-7637e7258862", "comment": "Malware payload (AgentTesla)", "value": "68d789fcc36fdd8eb5cbb5b58c55cb1d48174c24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715463, "uuid": "a7754a0e-90cc-4c26-8050-76aef7b24edc", "comment": "Malware payload (AgentTesla)", "value": "d4e65fdb9af388a933b12d4a815a871003cc1d87d3b24fd645b0d95ed394864ba4c7051bf73d98e7adf6211249dbe78d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715463, "uuid": "afbe1fdb-dee5-44ad-9568-2326fa79bb9d", "value": "C0F47CFC751464F9D35B5C27A7CF1C0782251270AA3B6A0B8B2103BE5A5BE173E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715463, "uuid": "f4896ee6-a67c-4ebd-a91d-9e8e12b10ca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715463, "uuid": "b191babc-c3d4-4576-91fc-c4b62d0e4323", "value": "12288:yoLLoS60/K7yh0KbxXMpYwYrm5BzpkfwUsmVwERzzMolptCvtaV6d3:yoLAKbGpyiTzpeXzzMolpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715463, "uuid": "2e6c35c4-be3d-4ad3-9077-df78eff9e8e2", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715463, "uuid": "d0c97071-ec11-4b5c-8cd0-855ff5e7e2ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715463, "uuid": "08c5bfb7-0651-4671-ac2c-224041e1ec58", "value": "COPY OF N-N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5678ca17-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720194, "uuid": "9bbc491d-588b-4250-910e-24d1e1633353", "comment": "Malware payload (Dridex)", "value": "d901c8213467b0d986b1c83c63603b28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720194, "uuid": "f465e19a-a8a1-499b-9da1-b6a39dcceeac", "comment": "Malware payload (Dridex)", "value": "c276537c3c6bdd6611d8d182529a4e30926d3e0f273f6d999143bd195135fcb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720194, "uuid": "c1d6ebf9-60ea-4f9a-b084-a6f1ce64a557", "comment": "Malware payload (Dridex)", "value": "e207bce842998f857b0aca14d8f08f236e10718b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720194, "uuid": "aa2ebcae-e5ad-40d8-912b-b667ada3f9be", "comment": "Malware payload (Dridex)", "value": "15b87d06a72b1d6cd36d32a8ade1610a997c28807378f62eb58dff788dbd0a9f93ec928da4a04c2269698a5eb82d1d18", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720194, "uuid": "41fc410d-522f-411a-bf45-298fa095ad43", "value": "69F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720194, "uuid": "0378df8a-3323-47c7-954c-b7ad6c6230c6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720194, "uuid": "6682828f-56de-49bb-ac41-730c47752ee4", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720194, "uuid": "ab293f14-6e13-44b7-9a06-4b41c89fa232", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720194, "uuid": "40b0cd74-c3fb-4e2d-8d52-ab4ee11322c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720194, "uuid": "44161f0a-cdc2-488f-80d1-923cf4e0991e", "value": "d901c821_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f552f32-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723699, "uuid": "cfbf7561-978d-49fa-96bd-974d8236b45c", "comment": "Malware payload (Dridex)", "value": "61bf0acfdc5c3458461a8ac4aa44b578", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723699, "uuid": "902f295c-3966-49bc-919e-1dfc7e4f5a78", "comment": "Malware payload (Dridex)", "value": "c27e5094e8bbf30840f4a4b35f8370d5c7b6d7595fa69cdadda5275489f62a2b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723699, "uuid": "d24cb473-f5f9-44fd-9a95-d6e4d9032662", "comment": "Malware payload (Dridex)", "value": "2d1c0636cf60eee09b837a9652717ca0381dc43b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723699, "uuid": "e980dd29-968e-4815-8501-579c1107df9f", "comment": "Malware payload (Dridex)", "value": "3c86cd9ef8921d24b2920b9085e2e1f68159f84dc3551bbcdffe41aa6962b762ce050ca09bd275b415659e7a91f5149a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723699, "uuid": "430bbe8c-9764-42d2-8b18-24ef6f2eb823", "value": "2AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723699, "uuid": "f0b333ad-2a8e-45df-9b69-de3d793e98b6", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723699, "uuid": "b9fd364c-1b70-4696-b098-af18848f86ed", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723699, "uuid": "81e52d01-50a0-43b0-a6ce-1259db68172b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723699, "uuid": "d9dfd78b-cbe3-4b05-9ba9-88b0a62ac9ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723699, "uuid": "466fed51-9abb-4d38-9e8a-cad76802e18c", "value": "c27e5094e8bbf30840f4a4b35f8370d5c7b6d7595fa69cdadda5275489f62a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c88cdb6-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712957, "uuid": "83afa36c-5daf-49ec-8d38-3a06e619d1b1", "comment": "Malware payload (AgentTesla)", "value": "25257a76a116574fd13208144f5a51ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712957, "uuid": "eb81113e-26c5-438e-97ec-5f4a7aab3b55", "comment": "Malware payload (AgentTesla)", "value": "c28267552c802a4af6dff43eab1ede99334090bf7c60a86036b8e4e5ebaed71f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712957, "uuid": "d8811396-66a6-4f75-9091-93ce37c4d229", "comment": "Malware payload (AgentTesla)", "value": "7a06ed3e712be368cf909e99a7fce557fda6bb8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712957, "uuid": "74617540-7922-4dbc-ade8-755eeaa9e246", "comment": "Malware payload (AgentTesla)", "value": "c9eb339c951a8e330cbb9437e065c9c45fc085e27b30d121c7cf779579b14f3655cd1518c113c7e137a0e44092eecc0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712957, "uuid": "87b8250e-5e56-47d7-90c3-a2cd46543818", "value": "A49423AF4B08386825B96D9CC4B740EDCB6D820CBA73883EEFF242D6358D5053936D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712957, "uuid": "9473ef5c-ac65-4ba5-9365-1c6f28090ae4", "value": "6144:ioLLG7tO7b5XhRtidjl/Uf+5wpLCjy3ZJ3jxIqxZUrrQE7mK0rxP91PnenM:iojXntidjl4mG3f3jx5urn30r8nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712957, "uuid": "1d83a48c-82a1-435e-9386-6f63d19c0191", "value": 444017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712957, "uuid": "6a77cc88-3e0a-4f30-8e87-9528e4e82a9b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712957, "uuid": "4c39ec77-baf8-4ccc-ae63-93fd7639052f", "value": "drawing of ED53224-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fb7c64-b239-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620724356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724356, "uuid": "e93fc6b5-ced2-4556-bcd2-ac7420b10426", "comment": "Malware payload (Dridex)", "value": "589908c69f247ea72c95f5ddb73cc754", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724356, "uuid": "06721f95-ca5c-4dad-a54e-1858ca8c3a13", "comment": "Malware payload (Dridex)", "value": "c29e9174d9c04bfbfdea49fe3804230bec0d893a1e6c6efa8fd5a6f9df59aaec", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724356, "uuid": "fed419ff-e082-4da6-9ad0-5d8b2bd7801b", "comment": "Malware payload (Dridex)", "value": "fd09c95120b2e9a9cbfaabc020692ef6033de489", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724356, "uuid": "661d6a17-1155-4033-af32-600b739fa966", "comment": "Malware payload (Dridex)", "value": "8635fab8e713d371edda10f851d5927288a93dc79d262a1c13d4ce4f51fb1d03bef7162472a8798fefd3b86a5f428ee0", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724356, "uuid": "dc087329-9607-4318-b87e-f8dcd8264ffd", "value": "DC23E1B8EF196E2FD2172C77A00910E2E46C3ADCC019DA007E65E2A926D11511FFF7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724356, "uuid": "127600e4-a5f8-486e-9bb7-83801a7b58d7", "value": "768:tjT473DejEldueMGDJZVRgk71u3PwQZRfzA9nF/fB:t4vTuetHVFIPw2U9nF/fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724356, "uuid": "b4689a94-9552-40d2-9052-8f9cb9ebf33c", "value": 46715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724356, "uuid": "9b8397c2-e63d-48b7-b031-10b7a2224199", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724356, "uuid": "57ca7639-40eb-4104-9915-3511ef255eb8", "value": "Fattura_01318356.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06010689-b25f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620740675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740675, "uuid": "e2428a2c-4b8a-4c24-aee9-6dd1fbc85845", "comment": "Malware payload (AgentTesla)", "value": "dda146b4ac808bf8d145799fc742f5fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740675, "uuid": "6e7133a6-8f01-41d7-9896-8c8e8ca4418d", "comment": "Malware payload (AgentTesla)", "value": "c2d0ddb18722e2adb9172ac98359036094dc25aec01d80cf132e98050102e68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740675, "uuid": "4acac8a7-dfd3-4478-8fb8-098785ae0172", "comment": "Malware payload (AgentTesla)", "value": "b261e23f0b82e9fe36afa1bcca0a993065dea3cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740675, "uuid": "a20612f7-0c71-489c-baa7-b8f3cd3857d9", "comment": "Malware payload (AgentTesla)", "value": "6eb636d32bfb58b6ee491a725fa986872471219ba6a44cd1de55e6262eb315de78c331882cf814dca552a9813fad16ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740675, "uuid": "ad9b4c07-e8f0-4ee5-90da-79c7e5a9f56e", "value": "6A2409166715D420CB5F417FC016C21831F1E707972AE38F5AA6D8F92F862CEF92A8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740675, "uuid": "ce548300-aefc-4597-9fdd-b08955b460a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740675, "uuid": "ebaef1fa-d6ab-451e-93c9-3a2f58bd650f", "value": "3072:9bUvdRmQQbqyfbRCX18MbUi5femeEFu+AHbZJ+qM1PK7FxjSGJtCqa65fy0nTNZd:yd6fb+dUKBFnITIsSQ7aKfhTNNV1sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740675, "uuid": "88a6c79d-b972-4be9-a78f-8c7e269418a2", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740675, "uuid": "d62c40e5-a953-43b6-b00d-a029d8fdc1c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740675, "uuid": "0f5213d2-60da-4a78-a134-b81c283d59f1", "value": "originbot4.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61024a4d-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620714629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714629, "uuid": "96086692-907e-42a3-8748-1d7895779e3f", "comment": "Malware payload (SnakeKeylogger)", "value": "385a1cd09d5b5626dde6f7e58cc89cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714629, "uuid": "027c2c9c-7dac-432f-aa74-8c52b6c41295", "comment": "Malware payload (SnakeKeylogger)", "value": "c38f9b248f84e55bb9b46c324c68660c13c80462683a46db7244954311866c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714629, "uuid": "23702367-c8f0-47a4-bcd9-1875ff4dc822", "comment": "Malware payload (SnakeKeylogger)", "value": "13320476be62a2bd670ea4fe9f5fae7021ffaa61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714629, "uuid": "99afb53f-8ca1-4664-bd0b-4480cbd575ba", "comment": "Malware payload (SnakeKeylogger)", "value": "45cea38426ad7f1371a76f9a8717135f818302f5936e84a2b82c221cac2d6719899b9457b1dbaa12c63dc6e398b55199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714629, "uuid": "40c2291f-9e45-4642-bf74-61dcfc3c1280", "value": "6CC4C02127889BA4E0BEA77981B1110883F1FC17E735DA8DBE9970DD7972F424752B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714629, "uuid": "8b16e309-e731-4189-b42f-380b6d2ad230", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714629, "uuid": "ff48d5b0-8dec-4395-9238-81683093c1cc", "value": "12288:NUe1DAjxslyH/w1hkIHoldBhYreuUL88hyB6X/ZT:15AClyH/w1h5OhF98iyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714629, "uuid": "ab9a8bc9-0276-4f35-868c-4bca626f9280", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714629, "uuid": "0643b2d8-2a64-44ea-9d7b-6a023e1223ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714629, "uuid": "7a59bbe7-da6f-4b2c-bcfb-91cd9d0b3b66", "value": "ORDEN SURA OC CVE6535 _TVOP-MIO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85eddf72-b238-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1620724139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724139, "uuid": "0070c6b7-ef2e-48f9-a99b-e2b50e65488c", "comment": "Malware payload (FormBook)", "value": "755c95c855ed0aad1c9d87ef91beff1b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724139, "uuid": "8c82a657-a8fe-4491-bf65-e3da855346e5", "comment": "Malware payload (FormBook)", "value": "c3938c98477bb13ecf6d7fa89e31ccd6fa2324dc0d859b25de6dfa5c1c4b5887", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724139, "uuid": "fdebf234-c64a-4276-b243-208e70d2695c", "comment": "Malware payload (FormBook)", "value": "7568677ada47ed6f5ebb679bdf22b092fbf70b7e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724139, "uuid": "70592a5f-d43c-41b3-99a4-4453d3b72ec6", "comment": "Malware payload (FormBook)", "value": "b7ef09e2272d82867600ed00269ac4f8e43d5d4ba3f55ae215e85bb36300f051fb9c20664ddfdbc59aca59540eab2f38", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724139, "uuid": "afcb246e-3825-411e-a01c-e5e652d00a98", "value": "7DE49E21B2D14936E05E1F389D5BB3345821BE402EF554BAABF4BD4C9F397913C2829E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724139, "uuid": "14cf4af1-1119-44aa-8fcd-b753bbdaa87b", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724139, "uuid": "f03ae9fb-70b8-4ba5-b1cb-611506714217", "value": "12288:hrnWDrl98a7LUacm7sbiD97T5QM4Pr4rPU/Oy/T:hrWnZnUivR71B48rPUD/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724139, "uuid": "c761bdf1-3d00-4bf7-aed6-65f73a8ab828", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724139, "uuid": "62b53e74-94d3-4ab1-bfca-b649a16fa950", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724139, "uuid": "8f315a7d-ae09-46d2-adaa-075f70013a7f", "value": "755c95c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b542f7-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716680, "uuid": "45b99f52-bb90-4a10-bcac-948bd68cac56", "comment": "Malware payload (Dridex)", "value": "960836797377bd0fce4b8a368ec1c58e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716680, "uuid": "4cdc4aad-60b2-4376-846e-f4b5cfbedeb9", "comment": "Malware payload (Dridex)", "value": "c570b4e0ee23161583e44483b9734cd30e841451a1cf109d8c1003154e60b813", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716680, "uuid": "b0bb8dd1-cfcb-4c57-9cce-0db96fd6e29b", "comment": "Malware payload (Dridex)", "value": "896eed5edf6770f2c798459d9d1df849e641c969", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716680, "uuid": "46c8f729-b21f-4f21-a44b-3cacdfbd1511", "comment": "Malware payload (Dridex)", "value": "1ae7506bb07b6696df3b5c5ee0634ccd2a5600becb9bc9aa417df1f35e3ba26d6753e01f004fb4e44be56da5550f55f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716680, "uuid": "5d70afe0-475f-4d72-8080-a39c0b44244b", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716680, "uuid": "5ac5d1ae-870d-4dc5-9c19-393133a19786", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716680, "uuid": "83d2714d-9407-4047-a728-a2a2e6d77101", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716680, "uuid": "1ddeafab-af7b-4216-ba78-7ed368fa7e6a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716680, "uuid": "45ca7a34-1a4b-40d3-bbbb-e5101dbf60ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716680, "uuid": "3a38aa2c-e202-4c40-ade0-b46d952eb2ee", "value": "96083679_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9a2f22-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717225, "uuid": "db69fdd3-9fbc-46cb-96a7-fdff9dd3b6ad", "comment": "Malware payload", "value": "aa94a9e0f856bbe5195e5e721fe8b532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717225, "uuid": "939d8b7c-502d-43cb-aa3a-cad9c6576225", "comment": "Malware payload", "value": "c58c208bdc377b3cf83c446caa363113ac3c57a86fff19e5a5fdfd141c5eeea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717225, "uuid": "3ec93a62-987c-4a88-8647-97a8d1beef60", "comment": "Malware payload", "value": "7ac0dc37baba4924ea0d1909b850522b76e44596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717225, "uuid": "2211ef2d-db34-40ac-84c8-c0680042a749", "comment": "Malware payload", "value": "3e9944ec2a65c8f31df29c8d7d4eb81d17f718bd71bd1ac2b59f8523d5f3b160dd67595f4615e280a6761d3b012f482b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717225, "uuid": "e98e3d98-9fda-4628-8611-7e0a5cff1515", "value": "98737E81BB849511E35AA33B45A7C90233F1A3531B32D51D7ACD27D8AC817AE1D2BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717225, "uuid": "c43a9803-4955-45a5-9cf8-778f7e636706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717225, "uuid": "5ebd0ebd-b941-4564-a9d2-4efc8e0008ea", "value": "1536:VwAv1gfhXAufYqCen9obUfCAOJVM9wjtvHw3uO7VesieQAKGqtbieQAKdh9Nu:VwDfZrobYdktvQ3N73QAWQA+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717225, "uuid": "e0587bd6-e0f4-44fb-8cde-c71696587dd4", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717225, "uuid": "64bb4c96-2116-41c8-900c-bdd31f243c12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717225, "uuid": "5ca04c13-5e59-422a-9426-f37876024de5", "value": "aa94a9e0f856bbe5195e5e721fe8b532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303fd9fb-b254-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620736022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736022, "uuid": "a6cda4b6-b5ad-41cc-93f5-6a9b37e4116d", "comment": "Malware payload (AgentTesla)", "value": "d6c7a942320a4b982dd560a409d813d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736022, "uuid": "142c0ccc-8031-478b-9c36-6c7671119eb7", "comment": "Malware payload (AgentTesla)", "value": "c5f47ef393da3d1b6ca1de252345d034ad35aadc80c5ec4911d0e6c353e5e1e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736022, "uuid": "ca2cae62-df26-44f4-a584-28e1b2344745", "comment": "Malware payload (AgentTesla)", "value": "6db1af3654356e63cab69e5f30907f82865ac391", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620736022, "uuid": "d9fff5c7-45c3-481a-95de-29e03a0e8ada", "comment": "Malware payload (AgentTesla)", "value": "59d78c3e2a6f8957020f5823a44a9443ec957824a74cca0a0213f6795b98628577823b536afb39331f85aeddcb0d66d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736022, "uuid": "0bcafe47-646b-4f1d-9e82-da842275fb68", "value": "7C15022533A89FF2F67EDB3D5861004893F9A84BE321E68E7DD801DD4964F4187A2F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736022, "uuid": "0aed1826-d4c2-47e8-83e8-6f4141e2498c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736022, "uuid": "9d441d9c-1561-488e-863c-f58b95b0d5de", "value": "12288:2UHOT8Tsr2owjKJI50La0nuoScavpoqhm23vqwgLq0lUrH2bO19ciQ2MsSwUAsu8:2+m2vPSlUrHce9VbMsSwPZqelof/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620736022, "uuid": "76a63c7b-354b-4773-9bba-b706e0708682", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620736022, "uuid": "f686fd9c-b939-456c-9361-3cd4c71f0e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620736022, "uuid": "26a53e68-e75b-4585-864c-b3fb997d7a6d", "value": "eGDBXEE70Awbg6D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bd5645-b283-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620756301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756301, "uuid": "43761699-cc72-44db-82d0-9dcaaa210c7e", "comment": "Malware payload (Dridex)", "value": "f1192f6040d302f576039368d38be7a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756301, "uuid": "3b36c23a-5af5-4597-946a-b48398ab7060", "comment": "Malware payload (Dridex)", "value": "c605c6deb51695a225e7abf8a6ea04b4b206084b7f2aa76ab28e54100087f1b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756301, "uuid": "a3ddfd4c-f606-4382-9e35-6c5868157b8a", "comment": "Malware payload (Dridex)", "value": "82d8127efc933ef119bc25bf709a1899713720e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756301, "uuid": "1b002ad4-edc8-495e-be3d-0ea7cc252e9a", "comment": "Malware payload (Dridex)", "value": "3c7f9a408def20e85c08a89b41b7742b65e92178da5f0e46da9cf1fc26530eb995d4868e1e475859e0f9ad252303a79d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756301, "uuid": "934e7fe8-f344-4126-adab-5d3dff7c28ad", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756301, "uuid": "95776a42-444b-4866-aa5f-a9a2f6ad7b3b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756301, "uuid": "2f01e157-498d-46a0-824e-1e7fbd952014", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756301, "uuid": "81e32734-78ee-4b73-8a94-37ea230c6d31", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756301, "uuid": "9c818f82-4979-4249-b1fa-e06d66cb3344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756301, "uuid": "6dfdc483-54af-4b75-ba44-7f24ba6e1b4e", "value": "f1192f60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fdb562-b26a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620745584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745584, "uuid": "085e46bc-57e5-4e42-8d4c-86b0ca86d21e", "comment": "Malware payload (Dridex)", "value": "aa97efcbdf6b2df4ca5c560881789fa3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745584, "uuid": "5a5c6f9f-2249-4164-a307-108f09cbb728", "comment": "Malware payload (Dridex)", "value": "c621f1def30330216ab941ac071ec239ab5af422ffd345a367c3006062e63236", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745584, "uuid": "8b8ed4fa-8707-44ed-9162-f6b6390d8e6d", "comment": "Malware payload (Dridex)", "value": "cf178a11fe7074ba11d9e558cdea09c1d978aab0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745584, "uuid": "1a1c4f9a-1d05-4364-800b-7564960e40d7", "comment": "Malware payload (Dridex)", "value": "94bc993c87332d660859d76bec866883a0e155d15c944bbd9e6b939cdfc71d61444f00f1f8a6795505acd7e7d45b5677", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745584, "uuid": "25294a92-977b-42be-85c1-8faaf100882a", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745584, "uuid": "9f80ca8a-5b78-4020-bc7b-3d29238b6447", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745584, "uuid": "30abcb7e-2a35-4ac1-9b13-09e55df1f684", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745584, "uuid": "a13070ae-04ad-4763-a782-62901cb03857", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745584, "uuid": "c1299698-525d-4e86-94a9-d5348808349a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745584, "uuid": "6c58c7b7-ee7b-4947-84ce-5247c5698614", "value": "aa97efcb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96a88d9-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698483, "uuid": "67b8d301-06ad-460c-8e3e-dde3989366ea", "comment": "Malware payload (Dridex)", "value": "37db1cd6c2e7c22680dbefe008e038b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698483, "uuid": "99995dc8-0a7f-413c-8ae5-c3104ae4b8f6", "comment": "Malware payload (Dridex)", "value": "c697259f6263cdf1be9826a2525d4abb559abd5e57b83493f22e1d636b37d2a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698483, "uuid": "27176e9c-6021-4687-87a5-8130fc2cd133", "comment": "Malware payload (Dridex)", "value": "433de223ab246c85f7dd4a282353e1aa34ed745e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698483, "uuid": "ec31b3b2-3b5b-41c5-82b3-17d41bc535cb", "comment": "Malware payload (Dridex)", "value": "4bd94c403c56b5750edd368efb8dfc01ba2874b59ae727f84f97b6c62274be3e7a015eee9afca3de4ab0380be4b0988a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698483, "uuid": "32c4e5f8-bf49-46ac-9c13-ce35436e36a1", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698483, "uuid": "b4a22343-36f4-4d1c-90a4-e3975b5a1218", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698483, "uuid": "ffa191ca-f69c-4b42-b034-9f67b95408d6", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698483, "uuid": "676b5231-cba1-4589-ae61-9d3c7b780087", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698483, "uuid": "5d00d2cc-cbe9-41e7-a130-9e56cf54b7df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698483, "uuid": "cf07be3d-b0a1-430f-bbec-a8bca660b153", "value": "37db1cd6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b50879-b282-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620756034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756034, "uuid": "166c7913-f88b-457e-a3fe-a1a725c683a6", "comment": "Malware payload (Formbook)", "value": "100d85753ddd39f21187eec33ee698c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756034, "uuid": "1f6aa4ce-66c0-43a4-8365-ba965efde4a5", "comment": "Malware payload (Formbook)", "value": "c6dc1249df7044073cb96ca04207fdc6d621c4a2a434a7df2b8c6f4420581f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756034, "uuid": "a9ed826f-febc-43bf-8738-56ce07919f1c", "comment": "Malware payload (Formbook)", "value": "a7c3f435c307cc0ab1005b2dc387d61450ce249f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756034, "uuid": "528bab3d-f3ab-468c-ad4c-7ac793384482", "comment": "Malware payload (Formbook)", "value": "e7dbc0cac70b36cd0760aa0a1adab3c3ac9af92f407436a12bc744830b39cc5a7bdfea45c37ac900849146e26884ea00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756034, "uuid": "3f5d1722-ae84-4b0e-9bba-85358237e38a", "value": "AC359DAD721073DFC867CD36D9681C24EBA0B477830BD687A06316ADAA4D997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756034, "uuid": "bf0184b7-50c3-45ee-8523-c798875f4706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756034, "uuid": "fc722b46-6968-4edb-8924-38bd9753599b", "value": "24576:3n2qsMoTqI7P6kdbZwoRtf5XT5i6n27cNKDH9:3nIMoTzRdZwO5jn2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756034, "uuid": "2c2e6ac2-49fe-4b68-9707-0a6274d506b3", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756034, "uuid": "12c89662-d2cf-4f3b-baa9-034c772e130d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756034, "uuid": "2d41070e-97b1-4cff-87e5-bd58cd8b9337", "value": "POI09876OIUY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c9578c-b258-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737673, "uuid": "3eafc9c4-ea4d-411c-b3ca-575b525aa25a", "comment": "Malware payload (AgentTesla)", "value": "497fdb0a1fa8970ac4e81aa66278b6ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737673, "uuid": "436e9dc3-ba06-4a66-bf9d-936b795ce266", "comment": "Malware payload (AgentTesla)", "value": "c70bf2aeaa6b9f644dadc0617debe3ec20671adc1e2ee8c60a8a932bf99e3c63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737673, "uuid": "05608745-5472-4dd2-804c-21f8912f7791", "comment": "Malware payload (AgentTesla)", "value": "5bacbe7521f6d6de1a7efc85d92fddf7fd358b21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737673, "uuid": "70be437b-e074-406f-88f2-969c2e030de4", "comment": "Malware payload (AgentTesla)", "value": "2954943d727c95ac6af597049501c4292e8bb1a19b705b853a93f49f1bc4cd6eb26221c61b6515fbed901dbc14b534c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737673, "uuid": "24580375-e9e1-47d2-97a9-e073a35c2282", "value": "8215012223685F63E1BED7B85920510093F4A90AE732E95DBEE804DD48A5FD14BB7F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737673, "uuid": "757eeeed-79fb-4c1b-b21f-373797f21e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737673, "uuid": "e3e37cc7-d369-44cd-a33d-0459b34278fd", "value": "24576:9b2j4ckoeU2K1NYSn35CINSStx3zxlpHCWm0w:Bo9/30INSSH31Hu0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737673, "uuid": "45ad4ec1-942a-4c10-b20e-7bd9ffc17a52", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737673, "uuid": "dfb0cc3c-1c28-4b4c-bf9a-c34a089e6650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737673, "uuid": "91ff640b-a2e7-4b4b-bd1d-44f927d1c0a1", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db4c5d1-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712986, "uuid": "e52b0177-e8a2-4fca-94ec-729eca40a6fb", "comment": "Malware payload (Dridex)", "value": "cb176ea2aba06ac10287010457e89679", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712986, "uuid": "4a30089e-b49a-49a8-b2ea-03ce0a38da9c", "comment": "Malware payload (Dridex)", "value": "c85d95364238c5a409fa32b89f71d059bfcb920577a7bb50e698869dba1f4ef9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712986, "uuid": "cccecaf9-a723-43c0-be3a-6de2a146b5f9", "comment": "Malware payload (Dridex)", "value": "e47f84c89d05658c8288566f4643a59674314691", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712986, "uuid": "9e5532e6-a5ed-4a25-aa9a-1a0f88fb4d47", "comment": "Malware payload (Dridex)", "value": "48d8e929e958db66283141c8253eee5efbdb14cd3f62645c849bac5e03cc85eca8c107db7f7f430dc7425f67a34fb3f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712986, "uuid": "a183e442-1ef5-4e29-85a9-8c0fc4969bb4", "value": "FEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712986, "uuid": "5551e40d-f32f-49ba-8ce3-055e8661a9ff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712986, "uuid": "a55df36f-206d-4c64-9a33-6fff25f137c7", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712986, "uuid": "29ca481a-e30a-4377-a8d5-7e9b646e4da1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712986, "uuid": "6457ab37-e2af-4104-978a-94f1a3580e31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712986, "uuid": "b1406a2f-4e28-4710-8976-b445d0f00f01", "value": "cb176ea2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e98cbc-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715355, "uuid": "f6265bf7-de5d-42ae-b2fd-829aacab08f4", "comment": "Malware payload (AgentTesla)", "value": "3ae35d2cbc6aebe78c651623c5816b4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715355, "uuid": "caff9c9e-6901-464c-8ca2-5eaf1beab9f2", "comment": "Malware payload (AgentTesla)", "value": "c87af83b16c89ee0d12abfe8dbaa50b2c5fd97aacd8f2e440bdac6e63730eeda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715355, "uuid": "88fc3889-a96b-4115-9e34-68bcaf1e8f82", "comment": "Malware payload (AgentTesla)", "value": "62d8ef9863a7965bb78234a80c1d8a4f2d7123f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715355, "uuid": "43d60c07-2420-4701-87a8-e2e4576ad71e", "comment": "Malware payload (AgentTesla)", "value": "7f631247f0b1c1caeda886a7909342be212e2e47feb7b5f92f4dca4d550f77f96664d1a88aecdb04f25ecbbea36e7603", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715355, "uuid": "ec31640a-6877-4b87-9c74-68ffcc19f349", "value": "E405224737E95369E0FC977858A26A4303B0A54D9214EB0C6F80987F67D7BED86893C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715355, "uuid": "f6d887a9-8caa-4892-bd08-c06b9bf7c290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715355, "uuid": "121c8bb6-4c30-4a21-8f3d-db0320dd06ea", "value": "24576:zU0JVYgkulpjbK25J7lUyToS4l2qtI91m:JSulpHK2v57hYVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715355, "uuid": "30469c24-284e-4a12-951c-71d13e6a10d9", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715355, "uuid": "d1245427-88a5-438d-9c56-7f0c7e92aaa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715355, "uuid": "4bf6059f-2cf1-4bd3-9ce4-ec93e5974b43", "value": "Invoice Attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb306f36-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698459, "uuid": "21954a6f-ee61-47ca-94a6-b4df08ab0f23", "comment": "Malware payload (Dridex)", "value": "4f3794be34d97bc7d3715b0aece8e091", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698459, "uuid": "fbf8016d-3f86-4113-ab0c-f429cfe6ef4b", "comment": "Malware payload (Dridex)", "value": "c93827cc29e2c3d1e72bbf431773a072647b88c55a755e1294052443a133c354", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698459, "uuid": "63b1f8e8-7b44-4b15-9e7d-c71ad0a49ad5", "comment": "Malware payload (Dridex)", "value": "c87128437440c84a6bd3bff0ca1438cdba873693", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698459, "uuid": "a0ef4445-6718-4594-8e27-4dfdc6f3f0df", "comment": "Malware payload (Dridex)", "value": "901fc27e6221f627bfd711e11e9dedfc1fa83190a206864948fb100024d90e4467d3aef6304a9db576e12105fa553370", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698459, "uuid": "68f0f176-cd92-49dc-99bd-559b80de9a2f", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698459, "uuid": "ba04e50e-0908-46db-9c92-d2037d47f44f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698459, "uuid": "36a3dca4-d08f-42d1-bf7c-f855e1314d27", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698459, "uuid": "ec13b1d3-f112-43e2-8b5a-6a82553b7fd0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698459, "uuid": "183d8c7b-d859-499c-ada6-e121ec5c1695", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698459, "uuid": "e098cb27-4fad-46a0-87f3-c7fcb702e3e2", "value": "4f3794be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b138bb4d-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620716481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716481, "uuid": "07e0ff6e-909f-4700-b336-7587a16519cc", "comment": "Malware payload", "value": "aeac6f569fb9a7d3f32517aa16e430d6", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716481, "uuid": "070deae5-f632-4942-a918-9c75308b12a7", "comment": "Malware payload", "value": "c9b72cfc16e9a8df3cdcc4ca6dee4b567d10d1acd72a31623da92f5d62ff7629", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716481, "uuid": "3b343dd8-950d-461e-b61b-f2aebae7046e", "comment": "Malware payload", "value": "8b167fd4bc6ce88c54a4c04dc45924e1e4ec3992", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716481, "uuid": "90fd2624-3d64-4b5f-a2d4-4d809b46c685", "comment": "Malware payload", "value": "7e7417e8c183eece7c3cad35540489f60071ee7ae7fd635f3d4b2a6862a3a6cb4c1ac1c61ca170755278b41d5d2de4f3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716481, "uuid": "46daa6f5-5f13-4930-ae8b-6098a8c653c4", "value": "7A31E00529E61725D3738D3700EEF2568775BA66E8A3CFAC519053CC1C69210F835E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716481, "uuid": "3d3473aa-2da8-4989-a5af-0bbb05e18dad", "value": "24:8uRZ9H8AQKV+/eMFwcFlRAE4I02PXQaR3+P/ZbdtCGO+/efm:8IHbhYwKRAbIpXv3yVDvO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716481, "uuid": "dcc3109d-4fc0-483b-a944-d5c1822ce7d4", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716481, "uuid": "eeaf1b21-5a76-4521-9be5-ddcc870a293b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716481, "uuid": "e1cd2a07-0018-4fe0-8a06-a54e8785efb2", "value": "c9b72cfc16e9a8df3cdcc4ca6dee4b567d10d1acd72a31623da92f5d62ff7629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacf3a72-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698485, "uuid": "7b4c6b0c-77f1-492f-aa33-9490f4b9ee95", "comment": "Malware payload (Dridex)", "value": "c515eaab42827638c8661a0492410d52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698485, "uuid": "c117e9f0-3889-4af1-9205-5462a0e665f4", "comment": "Malware payload (Dridex)", "value": "c9db02b78195e0711a74dcc45ef4570b85407b308c7799b1000eadc61e457494", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698485, "uuid": "84b6b90e-4694-4a47-abae-6c2957b0631f", "comment": "Malware payload (Dridex)", "value": "c25ab19620a32db1a61f89a138eaa4be231a9046", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698485, "uuid": "97a0166a-86e4-42a0-b7b2-f728c7f5bcaa", "comment": "Malware payload (Dridex)", "value": "3c6377a5a13050fedc349cf9c647d7ce3815084b0a49c122fdefa0aacb8d400669a6ffca5338ba48656f03139c9a201c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698485, "uuid": "8b3fdce7-0309-4b12-95a0-781f7fa0f77c", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698485, "uuid": "27e4fb36-463e-452c-9656-990f356b2f2f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698485, "uuid": "290abd6c-c7dd-4c36-aa18-1b9fbb114dd2", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698485, "uuid": "ba85ac13-cdc3-4764-917d-ab994b5766c5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698485, "uuid": "97b60b08-49e4-4562-9288-1e2cdadcb369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698485, "uuid": "5d0be52d-f21a-4798-aa6d-ace37379ec40", "value": "c515eaab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd8d9c9-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620698463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698463, "uuid": "a4fb28f8-3d5f-475d-92cd-113eafec6cc8", "comment": "Malware payload (AgentTesla)", "value": "ad2600dec0fbf0619c3978f8723d636d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698463, "uuid": "935c9b86-03ef-4d2d-a5a0-5f00c8c1bd97", "comment": "Malware payload (AgentTesla)", "value": "c9dcc2f4abaa35e6467c08fe8ea23de191b7493d4ed30deb06e897b930f89fbf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698463, "uuid": "5d4385f0-526a-48bc-9266-d78d464db7db", "comment": "Malware payload (AgentTesla)", "value": "38a41e0e063be025f2edf218a9d5b281f9365347", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698463, "uuid": "d4bc1f44-7bb3-493b-889d-81620f12cba5", "comment": "Malware payload (AgentTesla)", "value": "f4321e90eb2d3ac904e6e6199589b111c9d56da1f6d95f3b3bf96256fa95c3395e25d06a590a8b9bddabe8f1c82d32c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698463, "uuid": "be99f62c-96a4-401f-ad14-5487d807943f", "value": "FFC4237DC0262C9AA7A5A46125948BEC7AFF20B7E04CF9DC2C1BD1522CFDD29E5211CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698463, "uuid": "bff3a4cc-436c-47c5-94ab-03d09f4c1b1a", "value": "12288:OHTa4L1Uz/Rhp3DFZ4izjKCBrn3GTIvqWgYv/LPWm1Jhwg8OI:V9php3DD4wj8TIvHHzw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698463, "uuid": "c407537a-8eb8-4019-a186-6933492f246d", "value": 588754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698463, "uuid": "57bee28e-c628-461c-96fe-17e86e8dee82", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698463, "uuid": "3e5af4c1-f10f-4a60-b132-c9eeab6806f5", "value": "ad2600de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedc8d64-b293-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620763400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763400, "uuid": "20234fce-44bb-4ec2-9f88-ec2f50ebf8ed", "comment": "Malware payload", "value": "4699ffd05e1df210d672d81e69aac1c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763400, "uuid": "826eeb5a-5a60-4206-8aba-837db5be040a", "comment": "Malware payload", "value": "cabfbcc1c593e10f49735e8928271591aa7c753fd040038d140d6739f84c8932", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763400, "uuid": "ed61ec9f-f6c3-42fa-8580-800b7e65019e", "comment": "Malware payload", "value": "3e8f5e766b0494b7905d0071ed07b0c74d4a5169", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763400, "uuid": "411fc5c8-9a20-4a2a-9ccd-7c4b755522ac", "comment": "Malware payload", "value": "8244c2b0cb517dae9db48755f8c5ff71bf96e7f0f6b1b7b438aaf97f6e46b038074ae24f6808bb3565ef5d0113b47ed8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763400, "uuid": "cf85e23a-b4b8-422f-bb4f-7679b4aa5325", "value": "29F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763400, "uuid": "a3b23a5a-7857-4d67-b152-908fe0f4006a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763400, "uuid": "3c48ee39-a04d-459c-8ccd-cb06750f2004", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620763400, "uuid": "b8e770fa-d41c-4fae-a923-b6cc5533267d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620763400, "uuid": "e8bfac8d-b8ca-49b8-8c2d-047d5107935b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763400, "uuid": "e8a6f6da-c263-477c-b57f-5f922d20a0bc", "value": "4699ffd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aefaa3b-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620741596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741596, "uuid": "fccd060b-b3f7-47a7-b3a0-aca7ac7ef058", "comment": "Malware payload (Formbook)", "value": "e635ebf84417ed9ed97d4516de0cdaba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741596, "uuid": "1509ded1-ea86-4e01-9c5d-a9de619317af", "comment": "Malware payload (Formbook)", "value": "cb0386454b283917d742dc6833ef4d7f5aaeeb5cd92acf9d54bb495752cdcda6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741596, "uuid": "5ec37cfc-c26a-4b9a-aa29-a5f66f179243", "comment": "Malware payload (Formbook)", "value": "33716297dd627e23010332c9fefd443447aeb47b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741596, "uuid": "32815db7-010a-48b0-bf0d-7cf93394b52c", "comment": "Malware payload (Formbook)", "value": "3a931a0c44dc99d741b4849da95930b0482a3279ff029b4cfbd850bbae6208a53da49af7394814e5025f36aa1bb8ceca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741596, "uuid": "8223cfa3-4702-4827-885e-76c709087977", "value": "F8E4129D23D4C71ACA9ECA7899D08682C3B6C71BB243E789D6A4D5750EC33F056133DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741596, "uuid": "68671697-2f3d-4857-bec7-636c739ae7ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741596, "uuid": "adc50ae3-d6e7-4569-8e98-6cba2225153b", "value": "12288:yWSMznE6suWf+MCLuOLlSctk7s2PrIlorVS2ZdxsCO2PQ:+wE1Jth1rIl4S2ZbszyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741596, "uuid": "1c64a7a6-1e2f-4da3-9348-4a4624b5f6e8", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741596, "uuid": "b4e64aae-bb6a-413a-b65d-19c8b4affb74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741596, "uuid": "c65ff340-083b-4eee-8ab2-d490ff9533d5", "value": "RFQ-2176 NEW PROJECT QUOTATION MAY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cddb746-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716340, "uuid": "1e8f8d27-2eb5-49f0-9a0e-36989ba9ad1e", "comment": "Malware payload (AgentTesla)", "value": "c1d3dc0c0293afe4a4e5789809bda3db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716340, "uuid": "555e281d-6fd5-49c5-abbf-4e1edfe5e9c9", "comment": "Malware payload (AgentTesla)", "value": "cb43d4ad476d7fec4d0b656c7bd48a52fc46552b58e93b9d3187941bde2ed566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716340, "uuid": "070ad03e-fcd3-4538-814f-80b40d32e466", "comment": "Malware payload (AgentTesla)", "value": "f3b7775597ee7e7d0802b6204cda3247a78bd5aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716340, "uuid": "d943d490-50c6-4fda-bd2e-5d37db860f7e", "comment": "Malware payload (AgentTesla)", "value": "dee84e926f98fc8d9bd49f2cea42e6656383298347e0a11ae017a55e52c2da586eec1df8488c670e8572af18ae13a851", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716340, "uuid": "2ff08a3b-5a59-4616-ba37-bca84cba8ff4", "value": "470523073BE46764D0FE07B564912D4102F8AA0E9147EB9A3F8910AE8DF77C5CA51BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716340, "uuid": "d2eb65fd-9165-4772-b312-fa51fdcfb5b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716340, "uuid": "3507ebe9-c6dd-4330-9b3a-659700612627", "value": "12288:7EDyiYQt9WFOkoJsN7/KYveahr7vwU4thwTun3IeBOxp9vKcmBg3LV6HOgUZwzj:qg7oJc7/VGaZwKTun3spVKcmBgbV3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716340, "uuid": "4a5018e6-3123-4b4e-94c8-81fc1a26c244", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716340, "uuid": "18594dbd-21ee-4681-b819-0955622c65fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716340, "uuid": "659ac0ac-effd-4f74-81c3-4307fcc9ebaf", "value": "PRQ-30223 RSTMI7-252.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aff89c2-b25e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620740469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740469, "uuid": "cf0abadd-c7e4-4438-8544-381d598042e6", "comment": "Malware payload (RedLineStealer)", "value": "b87e0ddd2bd8509e29d413b7ed101f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740469, "uuid": "c15fee0a-233c-4b54-8c8c-d4826e4d27b3", "comment": "Malware payload (RedLineStealer)", "value": "cbc184b858c1c7db4e0977e0077088fa125dd0e06d400e3f6799c4e1a01ebdf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740469, "uuid": "c67fb186-fa17-4fdf-89f9-31f371e5fd43", "comment": "Malware payload (RedLineStealer)", "value": "87ef51923bd27a0e3b5170a76c2a51074b69cf8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740469, "uuid": "1332f2d6-6a3a-4f98-83d0-855392c2c47a", "comment": "Malware payload (RedLineStealer)", "value": "7d6eb52b33a5152b262b8d517e1ce3c207d8e38a943e7ac6f012dbe5fc3c2df9fdf7cb029e6b4c437fdcb1e1a1a3ad85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740469, "uuid": "163faa56-e3bf-4f6e-93f4-0492438d7fec", "value": "A614AE2075C1C1B3C4B6153044E6CB7A9A797032077AA6D7B7DD1BBA6F212E1A3362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740469, "uuid": "beb8914c-7fd9-4470-b162-d6b1c06b667e", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740469, "uuid": "b99da24d-6e98-4b52-bdcc-f216d70e6ba9", "value": "3072:6DKW1LgppLRHMY0TBfJvjcTp5Xk1/ZETHCwP6ok:6DKW1Lgbdl0TBBvjc/k1qTifH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740469, "uuid": "d7801a49-f5a3-477c-bfec-40b128549ad6", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740469, "uuid": "2e297ef8-fd01-4245-88d4-f65f6f58a788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740469, "uuid": "00c2338b-1609-43ee-81d5-164e85efa6cb", "value": "b87e0ddd2bd8509e29d413b7ed101f91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0338bee8-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620752696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752696, "uuid": "9cb39791-b837-4d55-a90c-735b7810cb8a", "comment": "Malware payload", "value": "3a8e3609d7c14cd0c8c1b0546d1f801d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752696, "uuid": "e858bff4-7838-4fa0-b7e4-f06f2c6812c7", "comment": "Malware payload", "value": "cc856e467de2f83f2d03b46dd7bd4b2315f3d99cad2590dfcf2c17f32a69f29e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752696, "uuid": "db0ec69b-9f5c-4d37-9e85-2bd44716a72e", "comment": "Malware payload", "value": "07023cc01b44507deae599303e4911abb7ab176f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752696, "uuid": "9e323858-c9f9-487a-b2f5-b28d7ecc0602", "comment": "Malware payload", "value": "765ca445b6982a4497b366fb5c5f8babc01ace87ebb9b7a8b1ad21578b9918e6f517151f192e643dae5db0143e4763dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752696, "uuid": "62db0678-2e26-4366-ae9f-94788ee16e13", "value": "C0B401175865DF5BC0A8D7F8BE035D891B0BAB0D18C539EE704E0E8FAF852A64DC905E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752696, "uuid": "48631901-3144-423e-b671-2d087d057e60", "value": "12288:0lex0VbLbGeH+59SjqyVBQ2D6mgRN2nuh:0gKVbLte52dBQO4N2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752696, "uuid": "e60220b9-4268-4925-9726-70cb9398a960", "value": 494885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752696, "uuid": "75130c46-e4c6-4f74-b5f3-c08234e85647", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752696, "uuid": "278cfd51-a82b-4a26-b82e-8c8a8b6f5eee", "value": "3a8e3609_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c894003d-b207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620703206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620703206, "uuid": "b3e112bd-0d96-4edd-90e2-6e60f1f9f5ae", "comment": "Malware payload (Loki)", "value": "8638bcdb1b239c51783ddcf76e3b6082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620703206, "uuid": "1480fa67-361a-4cbb-9028-ea759f39f2c6", "comment": "Malware payload (Loki)", "value": "ccbf0eb9ad7ad6cb0deb4a28053154d334ce5453c1c65e2529cacb24defbdece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620703206, "uuid": "6573a443-0f34-4e7f-a0b2-5d4b81632400", "comment": "Malware payload (Loki)", "value": "61778750c8adf64388ed7032363903db4c8437d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620703206, "uuid": "f70abd82-d808-4b46-b87f-f9f1bbeea313", "comment": "Malware payload (Loki)", "value": "accc7bfaf124a98030ac3bcff106fc033e055645f813dbf5b8756a0a2dd923cf8a2222746d07f8d543de15457760df2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620703206, "uuid": "a15284d8-aa72-47ad-baec-df1a84fe2926", "value": "D115CF9D325076DFC927C872CEA82C64EA60B47B530BD243A05712ED9E4E99BDF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620703206, "uuid": "4b8f83c8-a62a-4e83-8432-f4d9693af354", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620703206, "uuid": "a4101826-642d-458d-8e7b-bc1c7caa0d38", "value": "12288:Yv8zh+8xJ+dc4FGNhXlah26F0BVYmexAP3b9Go3P0nfkkD/ZhKkUQjwpp8I5G8Nj:QGT3Nhi1OBVYnePb9LkUQ0ppR5zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620703206, "uuid": "d94b0f5d-c7a4-4d83-8d15-e3898a93e083", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620703206, "uuid": "7b7b0c7e-2527-45b8-ac5b-c7dcdfd956d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620703206, "uuid": "759b89cb-a287-41bb-918d-665de7e25015", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf14a5e6-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714786, "uuid": "85377934-f7c2-471c-bcb8-1ed17725a5b0", "comment": "Malware payload (AgentTesla)", "value": "acf3b9201593ae6ea4f3e2e490621d2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714786, "uuid": "9242b1ab-e1a8-494e-8911-c4f85b85607f", "comment": "Malware payload (AgentTesla)", "value": "cd1bee6270cb8bfbd9e1e1f53a35cd9ed37590c563911f5c27667c4233803bfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714786, "uuid": "0b4a533e-b4dd-43dc-9594-437a9a924522", "comment": "Malware payload (AgentTesla)", "value": "79cb3163dcb47e0f67e09b7335b67b55c5f15560", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714786, "uuid": "65f946e7-65d4-47c5-a2cb-42d19fbdc9a3", "comment": "Malware payload (AgentTesla)", "value": "932501746b2f144209c97ca762424705f9eff4c20094b619b9bd7db6e3e37834ea9738812ad35d3ddf715c0d2a6ebeb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714786, "uuid": "577c7da3-e22f-4517-b29f-47b7587cdcbf", "value": "3005227BA5C9DF1AC2EC00F44023A489E2F1C2CD6562F34A3D9526B9A4E3BD5CB507D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714786, "uuid": "f95a9074-df31-4daa-a568-d2815e8ab1e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714786, "uuid": "00e99d20-fd84-4077-95be-3a8e684ebda3", "value": "12288:zf1H1E9iCjhF1cDIfyHq28vsmqJbdP1JJ7HATrB//GTSY2MqKYGD02sUqD:w91NF1ciyQnwdPJ7HKB/OTb2Mh5gq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714786, "uuid": "acd4e35a-d919-4d2b-a22c-1c9bfda619b9", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714786, "uuid": "e806bc23-4baf-4d74-92d0-0ad8a300f687", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714786, "uuid": "67a6fa47-a258-40a8-9e67-53c545f8d3f5", "value": "PO 4500379537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4c01c1-b238-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620724021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724021, "uuid": "399a4c44-6c43-4bc0-b608-0c1a46f85b68", "comment": "Malware payload (AgentTesla)", "value": "3540c6d4cef33fcb5a58dd5c63294bb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724021, "uuid": "bd512f2e-10f1-4a35-8e72-c066ecb9e42a", "comment": "Malware payload (AgentTesla)", "value": "ce242ce84f374f4b5cc78028cb862e25736c46346eccf2427f8c4230c716041e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724021, "uuid": "d8ae86dc-ca51-4621-945c-add227245838", "comment": "Malware payload (AgentTesla)", "value": "bfb6bdf797d719e9208a41627af9ec1333c773e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724021, "uuid": "f9b967a6-831b-497a-b946-8250fedf38ed", "comment": "Malware payload (AgentTesla)", "value": "b62d3625e3551ebf26514be9d83a28571ab840eada99af0916534e42602261c5a374113ff3cbffdaefcb1988801d960a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724021, "uuid": "474d910a-464c-4648-bbb3-b2076c02f447", "value": "731501DA84C49601C82B51F64C53D76133AFBD2E997BC5097AC7F6CD88A7A838E13187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724021, "uuid": "726d2e6d-c46d-446f-9699-5c1b0d494da0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724021, "uuid": "bc005b0c-29da-4601-b577-9412619df717", "value": "24576:sEC2Yxw1j2A2wpwtBJ6IOch2AOZnBlf+:g2V1j2AT23L2AOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724021, "uuid": "4a29a332-f1e6-404d-b457-83721e315c3c", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724021, "uuid": "611ed52c-27e4-45d0-ae2b-1069d1ad6a0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724021, "uuid": "a7acd63a-6bff-4063-a6b1-af8418ce3fef", "value": "3540c6d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1810a0-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712392, "uuid": "9f6181f5-61c2-4f8f-8b50-f0afa5faa3f5", "comment": "Malware payload (AgentTesla)", "value": "be9bb99489c404cf0b3c0a06d8e6ebc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712392, "uuid": "7dbd0609-acaf-48ef-b2fc-f9c18e28dd1d", "comment": "Malware payload (AgentTesla)", "value": "ce3b100f4d750be3d499cb37c877ec05f20825e87a4345383cc042f7d8b703a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712392, "uuid": "b1a423f3-aa93-4085-800e-e5d292b3a84b", "comment": "Malware payload (AgentTesla)", "value": "9be5c52e021bd9ec7fbe4b9373f76d130ffb0596", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712392, "uuid": "4482e4df-1155-4543-b28b-a5c3b6fa4c9c", "comment": "Malware payload (AgentTesla)", "value": "3a31eb20fe65e9ff9dd54e0cafe5cd36a02d10538688ecc5d015cfc621b18a5878dff6e3777e89523af7b45334d12a45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712392, "uuid": "5aaccabb-50b4-4243-8a96-21f9a0771d70", "value": "5D358D68719065E1D32B5E726BCBDC3143122E746426E50E8BD03FFB3967F13293998A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712392, "uuid": "50091e70-7ac5-4003-9cea-33305f0752de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712392, "uuid": "2d3cc174-8ae2-4aa3-a156-2cc2b86066f2", "value": "24576:WlSBqooLAixa1RPI4o7yDmf3a7urMfT4zjA8++++4+++++++0+++++++:W9xa1OemyuM4Xh++++4+++++++0++++6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712392, "uuid": "a65ed30f-d944-47f8-850f-5b95b52d3b27", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712392, "uuid": "bef003e2-e305-402e-b8cb-3967ef4032fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712392, "uuid": "8f026bc9-57ca-4421-9ab1-9899b6d2252a", "value": "Ningbo_Overdue_Payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218c1174-b257-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737285, "uuid": "c6dc2414-c476-4fd8-9a85-fec14d90e086", "comment": "Malware payload (AgentTesla)", "value": "0888f0a595168ba009400babfe2e7a2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737285, "uuid": "453959c1-bf10-4daa-9ede-872c099ae6b9", "comment": "Malware payload (AgentTesla)", "value": "ce7554fa09d44e22a27ff09a105b6a50c26b1b7476b79a6c18941bb6b7d96b30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737285, "uuid": "a4ad1193-d0cb-4cca-82e5-81d27ea88bce", "comment": "Malware payload (AgentTesla)", "value": "f84aa6d3fe9dc66f27a49bd94b9057a19aa66e0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737285, "uuid": "82038c64-5a66-45ee-8946-ea782520fa3b", "comment": "Malware payload (AgentTesla)", "value": "52a80e610ce852e5b808963e0b032a8a70b2d2e95ba3ba122a8863854487ab8ce9364e42f2dfecaadd28ffcbbdf8195c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737285, "uuid": "a0347199-289b-4544-91db-a277024d2497", "value": "5CE28459BF8A43B7DCFA4FB419E242421A34FEB6AC739A0F79B04409DC1B6839D03654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737285, "uuid": "8b158d50-8839-4ccf-94d7-ac7e5fbdc6ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737285, "uuid": "2b81fa06-4243-47ca-9fb8-ff55a6c57f1d", "value": "192:X9hr9w3/RKvEP7Z+mbU7sHw7P+zwTZOjAnTUM:tQPwvEP7uuW+zwTZOjAnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737285, "uuid": "eca165ad-5610-4d58-94ae-358645cf0c32", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737285, "uuid": "25120232-b8e0-43e7-a5cc-ee2ec619c447", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737285, "uuid": "234bc5c9-c2b7-432a-9cda-262ee48a0a5a", "value": "Order 4503860408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc13c7dc-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Adwind)", "timestamp": 1620741867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741867, "uuid": "bb017ba0-eff2-44e8-bbde-6ea697df27b6", "comment": "Malware payload (Adwind)", "value": "1ddaa7947f39eb9d27bf4996b80bd586", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741867, "uuid": "9d416657-16f2-49bb-b918-e8d0dffb6ec8", "comment": "Malware payload (Adwind)", "value": "ce9f8f34fe76be875d29460fad6dc202f1199214b4fb992409dfc96e9c135892", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741867, "uuid": "1753d365-598e-4f8c-956d-0ff3612e291f", "comment": "Malware payload (Adwind)", "value": "e35e6da0d507cbc3e2a4ca90f123ca84d5260922", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741867, "uuid": "4d177399-b9b9-4dfd-b525-42a9c11e914a", "comment": "Malware payload (Adwind)", "value": "8a807a9da5cf27cb2ee41405fbcd3cb6f0ddf281c13ee6d6d614078dc1e906c95a407fdcfc26bc7baeaebb42380f3604", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741867, "uuid": "a361f361-e9da-4042-a350-ba6e03c9ad17", "value": "AC642333C2A35051ED59D07D8C959FD02E1FCBC2BB87EA2C795C1A440AE2E9B2D54D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741867, "uuid": "8d9f2fc9-8ff7-4be7-a2b4-f851f71eaea7", "value": "6144:h0hW9EPM8nwRgP8nYE55sJEwJtsW3esV23/ilA2Vb:SmEE8Ga8V5SJEw/sW3u/ilAkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741867, "uuid": "30e6afb2-c658-416f-99ab-87ef71908c75", "value": 331048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741867, "uuid": "953b15fa-cbf5-4c49-9cd9-da96cfd0ce95", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741867, "uuid": "b1550fd1-869b-46e0-b8b7-034700b20980", "value": "1ddaa794_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f93bcdc-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715485, "uuid": "0342307b-f89a-4ed7-874a-fb6c3fa00da7", "comment": "Malware payload (AgentTesla)", "value": "1d028af73017d0dfc4dbd191884871aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715485, "uuid": "f2dd261d-2597-4970-995e-fe493038a73a", "comment": "Malware payload (AgentTesla)", "value": "cec78b430e4bb75b78a1f1c4271b030543861f49a8efe5e85d265ff8e70d7228", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715485, "uuid": "cf989fa8-03d5-4b1b-b177-203508186617", "comment": "Malware payload (AgentTesla)", "value": "d0ef6ef0376f7b8b07c5e2f69943fc68d79ac0c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715485, "uuid": "05018d1b-19ec-4a75-a0ba-65d87e8ffb07", "comment": "Malware payload (AgentTesla)", "value": "2eee38ea4d21b6da0118c9e86f1694d70e49065480e86fd86efd9a2502d8f7a84df4a0dde0828a236b5ca9a692a3133f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715485, "uuid": "ecf3756d-cdd9-4c23-a058-9fb8e209aebe", "value": "DAF48CFC754464F9D35B5C27A3CF1C1682241270AA3B6A0B9B2103BE5A5BE173E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715485, "uuid": "3500f4a4-e70c-4c97-9b7b-dbf564bc656d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715485, "uuid": "dba4ce4d-e151-4cdd-95df-47357e664d72", "value": "12288:aoLLoS60/K7yh06lJxOy4db3rNeHCSDtEJ9NYJKI4rZpUYhsC4:aoLA6LxQBeHhEhYII4FeYhsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715485, "uuid": "ad32b555-956f-4d61-984d-f7a4f2f05308", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715485, "uuid": "cfcbfae1-c529-474c-982c-0ce19b445373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715485, "uuid": "05cc1591-68c3-4f4e-b181-42a28ba46d83", "value": "pay-10034-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd53da4-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705688, "uuid": "8b659093-2cfe-416c-badc-ba47d6761660", "comment": "Malware payload (Dridex)", "value": "8715ff17e87d1af51c0aba658c2af15f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705688, "uuid": "448d5dfd-6f31-41c8-a2e9-60869962e1e5", "comment": "Malware payload (Dridex)", "value": "cf6a9544b4ee38e5fe3da31fa0f1f891952dc6b0942c3e66346acb48469053f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705688, "uuid": "2236a52a-45d1-43cf-9c1f-888dbb55d3c5", "comment": "Malware payload (Dridex)", "value": "45b54832b6c1d43153a2c0189b42bc1f9aec2c65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705688, "uuid": "b833e764-401e-420d-8681-f02628d3324b", "comment": "Malware payload (Dridex)", "value": "0f8b54bbcb08ebadfd1c9fdf3d6ed11ea33668ed7c443ec711fc5d1a1a2b520657160ab7a4bdf20f02352d49eea4b95a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705688, "uuid": "87df8f0c-3383-4315-a047-a7b28d7f5373", "value": "E2F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705688, "uuid": "e4fd1ba8-6464-4a51-84db-d96b0f77f185", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705688, "uuid": "b02603f0-4b7d-42b9-9514-38330825f6f8", "value": "3072:WWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:W42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705688, "uuid": "7d3901a2-ff8f-4d9f-afbd-fc15fba269a3", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705688, "uuid": "799ab309-417d-4137-b1c8-64e383fdb6ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705688, "uuid": "ee651539-d1e8-4369-aca1-58679e68eb3a", "value": "8715ff17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99628035-b211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620707422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707422, "uuid": "79334bc7-3a6a-45a8-a9d9-6a0107b3f95e", "comment": "Malware payload (Formbook)", "value": "c47d03f8f3f8384bd50384c41d9a072c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707422, "uuid": "1c0c3d52-9d18-4bb3-b679-e134765f5f13", "comment": "Malware payload (Formbook)", "value": "d0116b0ea676a655b1d55a2b7a79fb2585c1d04803e9d1d6f9cd1da15f789138", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707422, "uuid": "79545a39-d3ab-4667-b558-85c1b1ab03ce", "comment": "Malware payload (Formbook)", "value": "859109ea27ca30e0c96d8133c04d0b1e241b84f1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707422, "uuid": "0e7e272b-b5a9-454b-b14a-5ddfc8f2c7dc", "comment": "Malware payload (Formbook)", "value": "8ae3d9175b4c811fda281e8bf01c9f693dad2e1f0cf7d6323c449d589becfb2e9b995c65c722f83e27620dec46a2f00f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707422, "uuid": "109c2cec-bfad-41e9-a952-7cc64bd3a8c4", "value": "B534127423E1E0F7CA2722B229B7976757FFD4402085170BD7519E6C79D2AA20A0F36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707422, "uuid": "e78e857b-90c3-4288-8db4-4781330dec36", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707422, "uuid": "7c5ac814-21ac-44f3-8efe-2c00f6a45f8c", "value": "6144:L9X0Gg5jPwAwU4RRHMTXwWpQYaky2uJ3jolcPs2tw:l0V5jPn4XHMnQYaOG3e2tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707422, "uuid": "aae3c418-3ed7-4a89-97e6-d23c70e3578d", "value": 231839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707422, "uuid": "1f762eb3-86cc-4e2f-8b2a-0e7a42c3aac2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707422, "uuid": "ab4cf8ff-26ca-49bb-be61-73e706897941", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e851d49f-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717433, "uuid": "d4efa8b4-1f4a-4d75-bcf0-36f822426aa0", "comment": "Malware payload", "value": "f0030d93afc457906b347a665e6b3e0f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717433, "uuid": "c3eadf48-18cb-491c-80d7-308a2ce93187", "comment": "Malware payload", "value": "d0e3e3916848503e182f99602cdf93ee6be595331a7fed12609c0aa9bd0431fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717433, "uuid": "eb843619-b449-4849-a475-a1ac5d10c7d2", "comment": "Malware payload", "value": "d53c19b055ae7f0df54696db5b7e641e48f8f141", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717433, "uuid": "3cb04fd4-7e26-4681-a564-ff3787d01200", "comment": "Malware payload", "value": "42960ea391e5205510eda8f6e2bc90f7e94b71496c91b283e6a17690ef94258b1a771c201ceff4f1ba0e413bce1bbe0a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717433, "uuid": "e8ab21c2-771a-4c6d-851f-84844fa891fc", "value": "E235E050A3A81457C099C5F6899BA631D2512C98FF11D7EFE009BB0A5CFBDC097B6E38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717433, "uuid": "26f35554-5eaf-4a46-aa2e-1f8462edd62d", "value": "32d650eb9668a83797fdd2bd3c568100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717433, "uuid": "ed125ce5-8103-441e-aeba-28ffc8b836fa", "value": "6144:i9hNYeRk2Oe8eDQvHwTJmgo66q6Nrj57CZGZ73OyZ0CPGQAF3sZPRgXHgtaPFP4w:OXRhQKJ9vMt7Ce73OUp2UWHgmFwbr+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717433, "uuid": "bf5b3e03-5de3-4386-b776-dbcf71835669", "value": 1159215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717433, "uuid": "ccf053c7-4d15-4ebc-90b8-64985925c618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717433, "uuid": "4950e467-d853-4bbb-9e2d-99e81873ea7e", "value": "seven\u5305\u88dd\u7167\u548c\u7455\u75b5\u7167-\u89e3\u58d3\u7e2e\u5bc6\u78bcm210511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe432b2-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620728666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728666, "uuid": "50965086-b702-4f71-b67e-062898faef10", "comment": "Malware payload", "value": "3f2880dd1adcaa13e5e161411f7543ed", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728666, "uuid": "7f5df72b-5957-455f-b7fe-23d9b82c325a", "comment": "Malware payload", "value": "d1ab1685c705b672b7ff8085e2294decd58345d14d69bb883e0a940bf31e040a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728666, "uuid": "d35a7fc7-955e-4b1b-b1ba-10d32ab8c394", "comment": "Malware payload", "value": "135c075625c4385f5e8271fd2cee6c447a4b9e1d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728666, "uuid": "caaab3bd-31e4-4c86-b34b-64e461c0cde7", "comment": "Malware payload", "value": "443fea1c0acdc4355b19a1b2f621a0669fdfd99dec9e0041ec8a63b625925d4a8c97da60c4b3e55f3c3c060426c6e1e1", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728666, "uuid": "6f13ca16-fbca-4844-a2bb-bc86d9615b51", "value": "26653380BDDF1F16C16DE439D8B9E2A845ECCC157A120C17F75CBB42397ABB4869A318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728666, "uuid": "fe545f9e-f6fb-4d51-a9b2-4bd4d514e428", "value": "24576:Tbp4KvNseIbnDXxuLeN+PDRUh3vtf6++wXex7iunt7lohJ/xcEvCChaQH6S:11sVnDXxuSNmDRqbJ+ChJ/JNbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728666, "uuid": "b626749e-15a0-4a91-8fe9-9fcb456a9ec6", "value": 1546632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728666, "uuid": "fd35cbba-49cc-487b-af32-9ba61d36a37a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728666, "uuid": "37fcf37f-7ccc-4009-82eb-0d5f251b36e8", "value": "MT103 single SWift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fd887d-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620741907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741907, "uuid": "44782e2a-3373-4718-8775-fb029c192702", "comment": "Malware payload (Dridex)", "value": "90e68f3716f8ac4d6da10686f5f31769", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741907, "uuid": "85a14b54-dff8-4057-acbc-bfd46fe1bdf2", "comment": "Malware payload (Dridex)", "value": "d1c40fa9e9e5566a4689665903e96731d0c2fd93182a24dc97066eb7ac620f60", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741907, "uuid": "4637da54-34b2-45b4-9f77-9f57b9884d1f", "comment": "Malware payload (Dridex)", "value": "243e5de9987f67fe8be572e772615c94737e3a4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741907, "uuid": "a9424a66-9161-434d-a77b-ceffd6201dc7", "comment": "Malware payload (Dridex)", "value": "6f9b6721479a77326696c14ed99618c7ae4fdd6940bc7e7db962d7ebaa140214617e1935dc25433236bbe26a1e565270", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741907, "uuid": "996c3ecc-6400-4faa-b240-3bb3e24b5ca4", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741907, "uuid": "6f25a1ed-ca86-47db-8481-3c4b321ca7c1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741907, "uuid": "f2552ed4-2def-4ae9-a7f5-6a26b2cf75a6", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741907, "uuid": "65b64dfb-55ab-4bdb-9fcd-86f70c1ba570", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741907, "uuid": "0df59e6a-9fd0-4380-b131-f57add81cc7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741907, "uuid": "bfae480e-78e7-4fe6-a14c-835cfce98ca5", "value": "90e68f37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979b4a5c-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717297, "uuid": "2fd3bebf-2ecf-49f1-bec8-6a9b2148d649", "comment": "Malware payload", "value": "20faf56c053933d409a50e202c45a633", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717297, "uuid": "57abb89a-1ecc-415e-b7e5-01462cde684e", "comment": "Malware payload", "value": "d1ef4533bf12ba23341fc14643a7a62f6c1975189f878da00e86ce4e463cd611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717297, "uuid": "6e946352-7b5b-4d9a-9b6d-4f529f6c013c", "comment": "Malware payload", "value": "b3de50d88d0700cb264c25721f2d94942280d8e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717297, "uuid": "d1edce07-2535-481b-b661-ff26b8d1ce7d", "comment": "Malware payload", "value": "984ae0f285a50ec34edb1066439fff473fd0305ecd83e43aaf6526e8a714290b31c303b27e90bd653bdec238e899bef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717297, "uuid": "cf8f851d-1a2f-4761-8595-1daccd81508a", "value": "E1A21A4576D8F11AE2F749302C72EC343A3CBB732491D60E8891554CDE62FAD54C2EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717297, "uuid": "011a765a-5a12-443e-bef8-e4f99c28fb47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717297, "uuid": "a46013b9-9ff4-4bc0-adb7-c8a44bca4f04", "value": "384:hHoGql7747rwAHIZDqh7Z3gbw+AdQIuq/y+/4YKbPXcXQXkXtX6XjTXu8IC:toB75qjCquG/4bsgU9KPFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717297, "uuid": "a060e557-1946-4105-b535-a6b0c48891fb", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717297, "uuid": "df163182-39c4-492c-a637-bf0114b55d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717297, "uuid": "74cdb6cd-a8b4-44a2-b630-681212504b6e", "value": "20faf56c053933d409a50e202c45a633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cca26a-b279-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620751944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620751944, "uuid": "db0d71db-ef91-4f2a-ba68-6a20a2fe9213", "comment": "Malware payload (Loki)", "value": "a116b0860e243830ea03bb5106bd3d7b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620751944, "uuid": "c7c78a6d-3668-479a-b4f8-d5da9bb83886", "comment": "Malware payload (Loki)", "value": "d268733d386f2c72e5e5da2bdd5192158c2e52d79df04c4aa91ab3d04c6051e5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620751944, "uuid": "6ba8a632-0425-4026-bc81-79e7c7a47a7a", "comment": "Malware payload (Loki)", "value": "dab38495491784f56ca102afe8d802481391e3c0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620751944, "uuid": "d4df3b62-047c-4a54-96cf-b8f5302c6670", "comment": "Malware payload (Loki)", "value": "9a0e9675696b9146a94359b5581b3600308226a6185c18e0fd3d6f107a81d744351c1dda540fbcf6246f19ec7bf5b678", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620751944, "uuid": "08b86ef7-fd60-489b-90ea-2c242f9bbd3b", "value": "D9E46BFC765469F0D35B5C27B3CF0C06822512B0A93B691E8B6013BA5A67E173E39D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620751944, "uuid": "4a3cbfae-0057-432d-980f-3214f0f7cdae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620751944, "uuid": "43c780f9-2bfe-4681-ae04-177fe9c12dad", "value": "12288:moLLoS60/K7yh0esrkB4N8PHzGm8OTlB33510ME045Jtv1ziM:moLAeDB/HzP8m3H52MErlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620751944, "uuid": "e0219388-021d-48e5-9f4b-d6367430d78c", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620751944, "uuid": "7312bc73-95f5-4477-bade-54df3c436fa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620751944, "uuid": "217d53f5-237c-41a0-9ac1-a2e735a94785", "value": "TwgJ2PsnzGNGw4O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b675e68c-b248-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731093, "uuid": "87faf670-a17c-4299-9dcf-b3f844080c6d", "comment": "Malware payload (Dridex)", "value": "208a55243ca78ac6e31f2f22f2e40fce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731093, "uuid": "89efc920-9b24-419b-8dc4-fd314b605ae2", "comment": "Malware payload (Dridex)", "value": "d27baeec8116170aa2471d1eac8bf30447841d953a83b3478e6b610757ff5c72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731093, "uuid": "58381add-972d-4c81-9c3d-5ad561ecc283", "comment": "Malware payload (Dridex)", "value": "23ca0f5dfe499ea2f265ba32762d17a9f2416d0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731093, "uuid": "143ce759-9e2e-47ed-a18d-7fdfdef5c6ea", "comment": "Malware payload (Dridex)", "value": "0f614b36147e3e8311024d8f934440bc7384f0b986907024308a64627848585ad1ff1aacc826af573e5ceb935d41a261", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731093, "uuid": "5a869605-f817-4229-9d50-512263a47fea", "value": "D3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731093, "uuid": "af63fbe7-922a-4445-87b8-3bdc9607a179", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731093, "uuid": "7b836e33-7c2a-46fc-88c1-ee5eef5a4d83", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731093, "uuid": "900f076b-ac19-43e1-944a-5a73e826905c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731093, "uuid": "41df2449-efdf-435a-80c3-807c36f77711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731093, "uuid": "fae5fe69-308c-4cd2-91f6-d6186ed65941", "value": "208a5524_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8276666-b246-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620730237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730237, "uuid": "dd276733-cded-43db-88f7-927138bb336c", "comment": "Malware payload (Loki)", "value": "9785fba4c9ae22e3a2f45e5e97d574cd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730237, "uuid": "0584e93a-fc97-4d74-b932-b129dfbb85d8", "comment": "Malware payload (Loki)", "value": "d2ae86076326e5a1ac4c98e61b68cf42cfb1e795b04b78d4ce8ec54699d0d4ec", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730237, "uuid": "d327d973-b012-4102-a151-f60ce2a93b1c", "comment": "Malware payload (Loki)", "value": "0b5394ea23250dca0743b7ad09ed52f51c06e72d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730237, "uuid": "00675d66-e598-44cd-89df-11d0571db465", "comment": "Malware payload (Loki)", "value": "245912cf4ddb9c97270a235182c3f9fd7af1bd8a2bd7795731dd49a48ab33112bb59b5727a78c819e47cbe677a8724ef", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730237, "uuid": "378281d9-4b01-49fd-8c07-d74452f5fb1d", "value": "C9D44AFCB54465F0E35B5C23A3CF1C0682251274A93B6A0F9B60137E5A67E273E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730237, "uuid": "e25e057f-8554-4c12-bfa2-badc2b3f7573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730237, "uuid": "a40a9245-c21f-484b-bd88-1b9c988636f1", "value": "12288:fRLjoLLoS60/K7yh0dqvEZRhWWA8qewSMiyYOXDgECYXVnHN:NoLAQE9VF7OzgECQHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620730237, "uuid": "c534f2d3-5479-490a-9887-8d3f5f9c719b", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620730237, "uuid": "5d804a69-9cd9-4e51-a98a-797e20420197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730237, "uuid": "02179fa2-2a7c-4529-b2a3-b91878fa3b94", "value": "iOtrqiA8DR8H4zE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb675bb-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738141, "uuid": "7cc273cd-9ea8-4c57-a380-66ab5629c8da", "comment": "Malware payload (Dridex)", "value": "13550cba0c1749d1bfea0dfba71c35a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738141, "uuid": "60253675-cfc6-4793-b44f-c7240e747319", "comment": "Malware payload (Dridex)", "value": "d442499480615c713dcf33cd8557cb748f58fc2adf4eea8c4625ccf8386ead73", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738141, "uuid": "f62b6a3e-7c95-472a-b8d3-d992c4a4a65f", "comment": "Malware payload (Dridex)", "value": "a16a41b702857279473a65edea8eb9c7fd600c51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738141, "uuid": "5c1f0449-d620-462b-987d-a4085a531da3", "comment": "Malware payload (Dridex)", "value": "d05f53c9f87a559e4d70bc50853ef0678882ba5f761dc89bbcf344ec7e59c1806645c9665a7f6f670f0d3257c6292ace", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738141, "uuid": "ba969d74-7698-422d-815a-917671e45b25", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738141, "uuid": "fa76d93c-84f1-4c07-b03d-e55dff12cbdd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738141, "uuid": "36dda877-a27c-4104-ada9-60ceeebdd251", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738141, "uuid": "664ee5b3-79e6-4e05-be94-bd43c56db7ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738141, "uuid": "74aa373c-b525-4b28-a530-1abab8eaa9b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738141, "uuid": "a968a4d9-588a-46d7-86e4-f4eaadcce639", "value": "13550cba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a122c6-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620717052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717052, "uuid": "a4f046e9-c00a-42c9-b6e3-432ed53e9a8e", "comment": "Malware payload (Gozi)", "value": "e9d755ac4aa548ba194acf65b05994f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717052, "uuid": "cfe988f8-96d7-47af-8ee1-c5f74da6bfa3", "comment": "Malware payload (Gozi)", "value": "d480f7ac9137faddd5a38d6afd6d5127651ae0d4a2b2a8de8243830323e166b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717052, "uuid": "097a04c7-bdd6-416d-b591-7bd8d1c435ba", "comment": "Malware payload (Gozi)", "value": "4850ebf11ddaa1e881d18c347f4a6829cefffa25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717052, "uuid": "1db576a5-8705-41fd-a4b1-b56fd4d4eaab", "comment": "Malware payload (Gozi)", "value": "410ccd67e46c34b63ea3c7b36c4475e141ca0fb2ff9f02c3e3639b4473f89cc07e288ded073043388cd3fdead070bf2a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717052, "uuid": "27d9359f-6ea4-4bcb-9ff4-174bbe63eb0c", "value": "8415C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717052, "uuid": "7baac8fe-e07c-463b-9190-e2c725fb7d59", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717052, "uuid": "986b4df1-e584-494e-85dd-25ac4ca7662f", "value": "24576:HQfpzjXPgf38CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgbJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717052, "uuid": "8f6519bf-bad1-4108-886d-5c759ca96a62", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717052, "uuid": "e2347b9e-a866-4d85-a12f-7c1c0b9016e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717052, "uuid": "c93b6afb-08d1-4122-b678-dc2ca76f87ef", "value": "e9d755ac4aa548ba194acf65b05994f4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fdf32c-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735874, "uuid": "cfadd12d-2612-407f-800e-c886716bd5a5", "comment": "Malware payload (AgentTesla)", "value": "c321a0f82f1d7835878d0cf03c5ccf5d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735874, "uuid": "7ab32851-cacb-434c-9925-c1faba7db17a", "comment": "Malware payload (AgentTesla)", "value": "d49feb5337ce300e56e04b5a706063ba9b9ddf9f34de9bf5c599ea18ff0657e2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735874, "uuid": "820a2822-e798-4561-b674-443e08d5fded", "comment": "Malware payload (AgentTesla)", "value": "13354fa4aef394345f566437b77b6a1a2a44b0f0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735874, "uuid": "5e9d4c5f-ff9b-4c9d-8a72-7ba9b101e142", "comment": "Malware payload (AgentTesla)", "value": "adc62968049c7c1ed0a496bbd0cb86619a5a5a96ceb6b4b1d11590585d22293eadd99835967e62380df6d3ee84d51813", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735874, "uuid": "dce25eee-304c-4bc8-ab47-ac5d4a29b21a", "value": "020533BE21368A0395B2ED32DEF1576FFD7906B570A40D465C214F4E2886EB2F3AD148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735874, "uuid": "ea001fe7-5ec4-4aca-9d19-879c30221daa", "value": "24576:HygSd5DFT9KBA1YDaQd+QL5HyuLs1WevNBWISCr:SgSrFTQBAYDt+ESuAkgWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735874, "uuid": "e972ad61-c034-4521-843c-42219a6aebfa", "value": 834914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735874, "uuid": "7f9f9bd3-e778-455c-947a-28af0d659711", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735874, "uuid": "5e82e7bc-5bf1-4c71-ba76-2a7fa4888756", "value": "po.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f23a2e-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620753018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753018, "uuid": "a67c4581-3585-46e9-9596-ddd6f2c48a80", "comment": "Malware payload (RemcosRAT)", "value": "e5179e85dafc53498461d2f69522f773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753018, "uuid": "acddf4b4-864e-4d9c-a3de-900c2505510b", "comment": "Malware payload (RemcosRAT)", "value": "d53578f79377fcdaac771bf6825dfcf457dde8f7f5d3e805ab41c1ae47c94e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753018, "uuid": "35b68c1b-10d6-450e-936f-225aeb3c6e41", "comment": "Malware payload (RemcosRAT)", "value": "5f52a4939601e419b5c121231b7021d8c4a948b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753018, "uuid": "f0422300-6789-47bc-8de7-c036acb616b3", "comment": "Malware payload (RemcosRAT)", "value": "8a8d12d3c97bd30dac1484e888211e6c8d30afcb83f6b3aa457bc32db581cf197aa37c3c93f68ea694da5976feecd5e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753018, "uuid": "552271ea-6914-44ef-87d2-c799fa6edc02", "value": "4325012633989FE5FABEA77C6454104893F9B40AE322E55D7EEA05DE0860F404B73F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753018, "uuid": "5e50d979-05cc-4820-b4e4-0b5dcac56a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753018, "uuid": "e7ee58cd-d767-4096-9897-fc4b98d480ac", "value": "24576:XdBkA2olPsgE/WlgQzyZ3hU0FjR+qcHx6FuG:XlNEuVzeRv+FW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753018, "uuid": "40008cbe-4989-45e3-ba90-d0119f19a731", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753018, "uuid": "b247e6cb-d576-4a95-a441-7f4ddd1c0145", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753018, "uuid": "83e86947-f94d-4672-bdb8-513fa4a93bc8", "value": "e5179e85dafc53498461d2f69522f773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d64a05-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729372, "uuid": "af0712d6-c4d8-4a7f-97ab-9010210519a8", "comment": "Malware payload (AgentTesla)", "value": "4239f6a01b20697056527dc5c5b33794", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729372, "uuid": "e43bcc4e-12d2-480e-9e89-4c754bd310fe", "comment": "Malware payload (AgentTesla)", "value": "d5c6e817e81a13cd55bf34551de9665821e3402bd4aa8c25ef302044502dc509", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729372, "uuid": "6f4c2e14-75e3-4ecd-a76d-4308e6ebb578", "comment": "Malware payload (AgentTesla)", "value": "8c535c57e02423dd83f38225f0a2fbf517c558ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729372, "uuid": "4e7ed595-ae57-4205-a858-77a14ad0b5ff", "comment": "Malware payload (AgentTesla)", "value": "0ad42af00668a8526c0277d604e6d801ab409151ef6834a1eb2e1c28184ce50f1b16a99147ca26406f0810aeaaa50421", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729372, "uuid": "b4ce7ca2-dbef-48e7-b96f-5755b93bdc62", "value": "CA25023237285FA6F1BEA73D5850104893F8F80AE321EA8D7EE944DD5866F4147B2F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729372, "uuid": "9d4e7c55-ecbe-462b-b1a7-ce4f5381a031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729372, "uuid": "f4a71a0a-ec80-451c-8254-ab399d18f9f3", "value": "24576:2sp3CE3HnQ6dct01uEdzWx1FiJZu6Wn6od:2CtnQ6mZEJWx1Fmu6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729372, "uuid": "7f64f9e5-6ddc-478c-844e-d0dfe4415856", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729372, "uuid": "a751b680-1c16-49f5-bdf2-5580bbad35e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729372, "uuid": "c5b246ca-521f-4bc7-ae58-12874ccad71f", "value": "Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c33b61-b23b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620725340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725340, "uuid": "372ea7f8-6ec0-4ca3-853d-f553c1a4bf6d", "comment": "Malware payload (AgentTesla)", "value": "650632f6598a4d250dac47d6ed49c1f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725340, "uuid": "2ebc4838-55c7-4b62-aba3-8cafc5fc0db5", "comment": "Malware payload (AgentTesla)", "value": "d6113f618f2e03670b23f5c3356625f7543d546ceed4af59cb5e609a8b815e7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725340, "uuid": "0afdd3d3-0d98-4445-9e01-1420b7f68711", "comment": "Malware payload (AgentTesla)", "value": "77960ddc12ed56f8e065405bc710dd51700d7285", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620725340, "uuid": "a447a3cf-0cd5-4982-81d9-ffe3b031658e", "comment": "Malware payload (AgentTesla)", "value": "d8fbf445c4772e9fd201ba990ea1ac2ccb3bb6038e1d6334a36d910690fea5533bc8296473b5a4d19b17c9ae2b097eda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725340, "uuid": "8a005f18-7517-468a-9ffa-f8b811ab6b54", "value": "F70522073AC4EA61C0FF43F99DE1261107F1E602B511E78E7E08996E45A3BC99B887D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725340, "uuid": "dbd03086-a48a-48c0-86a9-3f1aa98151cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725340, "uuid": "86c8668e-94eb-49ba-add6-3d784f5546de", "value": "12288:eE4yi+Q01EMdfBNmbAEAq9+VI1i2vFN0rcjAvMXYb+lU9xVB6N+I51L38ZwL9H+5:hBfUHFyI1xdN0bvGN+I5138U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620725340, "uuid": "0b5c372b-4aef-424a-8114-175c948f3993", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620725340, "uuid": "71b7a9f1-156d-46db-9d4d-e4607ade69ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620725340, "uuid": "1e50c273-94ac-4b89-bf2a-f7ea19d63d21", "value": "invoice and packing list.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba68d6a-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712794, "uuid": "564389b8-f57f-40cd-aecf-0051f12cebc6", "comment": "Malware payload (AgentTesla)", "value": "85072554c26c2d58bdaab6ffb3a3d732", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712794, "uuid": "72b2945c-3a88-4594-94b1-8026e7a5b6c4", "comment": "Malware payload (AgentTesla)", "value": "d6adc5fd4e50b6a75c1d1e2ad96c279c2ac31472eca3c0325ae6f83852440333", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712794, "uuid": "b8d07986-5853-4911-a89f-6f1701791201", "comment": "Malware payload (AgentTesla)", "value": "8a779daad05afe9e0b1d227b6bb9f042e3c1c7f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712794, "uuid": "7063a861-a749-4278-9a0f-6918ee02647a", "comment": "Malware payload (AgentTesla)", "value": "021263950ba63529ee5c7d765a8e00eac8d9a7396f5464a3e47dc2753b2b83ac42c07307759d4a4f04c4713c5e941633", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712794, "uuid": "10056552-fbae-4519-b7a6-b9c326cd829d", "value": "EB25231326D9A368C1FE87F890117D0383F5A54A6612FF6E7E44606CCAA77C28745BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712794, "uuid": "d1b50e1b-9ffd-4d80-be82-2c4ce41b687e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712794, "uuid": "509ae61e-1ea3-437c-afce-1e364ac888be", "value": "24576:oHiguoI1opjvE3Y6ql618MYc680bnUXGk4GYs:EiXOpTHll6969r8PJYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712794, "uuid": "3e97d600-8467-4381-a44a-1a3cce38c9d9", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712794, "uuid": "849f710c-17ba-4e79-8d14-e9f3e213c7df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712794, "uuid": "464b24b2-19a4-4a65-a588-64260be6d21a", "value": "RFQ_202100001009692710218871_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f151498-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702089, "uuid": "612a80d9-7660-45fd-9020-d464c3fd8b52", "comment": "Malware payload (Dridex)", "value": "0ea46b0489c3763a972e1d2b72e60273", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702089, "uuid": "a1a5474e-c117-4f99-b664-230d3146a96c", "comment": "Malware payload (Dridex)", "value": "d758d57d5cf25be1f818179b8fb52f9fff6028c73721b00d52b48d75a0857b33", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702089, "uuid": "c573b346-4d6a-46fb-8b22-4e37f2fac3f0", "comment": "Malware payload (Dridex)", "value": "7cf0db4ea1773a2597de2b67923cfcd3bde66c61", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702089, "uuid": "87105bfd-e691-435b-9ea3-0812794f4969", "comment": "Malware payload (Dridex)", "value": "abd4052c97d743d83a495b21652ba0ad8490fdc9c18006710a2a2194cad445524f38c04c096fd5866ef01adb10d3bb2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702089, "uuid": "702f24c8-01af-4b9a-9ab9-d68279656374", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702089, "uuid": "63d0b471-d727-413c-8d27-5ee06a8b50e1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702089, "uuid": "1069690e-4243-423b-856a-f7b72c6aef65", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702089, "uuid": "5fd96148-d275-4f22-9cb6-48e03d7d8ccc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702089, "uuid": "767f71dd-d441-4857-8744-605b89246bcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702089, "uuid": "129c501b-7ce5-4629-b86f-fd3a0f481624", "value": "0ea46b04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c338023d-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698473, "uuid": "a25ee411-3e79-4127-9763-e2f51502e339", "comment": "Malware payload (Dridex)", "value": "f39506b26e203da93365e1958d440b4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698473, "uuid": "f94b7f41-2b76-41d9-a599-997dee4fcbb8", "comment": "Malware payload (Dridex)", "value": "d76b0e8e0a30d540dddea08d12b375a3beb6a3b10f74477db9dcd8c11c40f864", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698473, "uuid": "a00d14ec-cf62-4a7d-a4fd-5ec76c02515c", "comment": "Malware payload (Dridex)", "value": "f7437aefb91047552000b9c51ac0e4f5c68c0fc2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698473, "uuid": "3800d768-63bc-4f35-a67c-6b8a8de7d60b", "comment": "Malware payload (Dridex)", "value": "3d70305a2f8db71f2f8a0369e632307f2f742cc3b881943040dd8a9013da9b4242bfedbf7662999632d82ea01ff0ea06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698473, "uuid": "98f27691-73a4-4c5f-a8d6-6bc1a4550bf9", "value": "4AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698473, "uuid": "8d3f7ede-6d3b-4b36-a9a8-d08dfd5e234f", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698473, "uuid": "cee3976a-aa04-4cde-a84c-97b8a6a2ee3e", "value": "3072:JWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:J42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698473, "uuid": "6c2ec7f5-0239-4ea3-8c26-376e23483317", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698473, "uuid": "89f384a9-3f83-40f1-bf01-c8d28d397d2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698473, "uuid": "b0787a6a-f191-4a24-b65b-4bd400f62125", "value": "f39506b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f519acb4-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620741935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "b6cc34ff-1f25-4c04-9d9c-d7de2230d9f7", "comment": "Malware payload (AgentTesla)", "value": "5802f9cc63fcbc7ac1ed10fca8860b7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "88d7761a-1628-43ce-affc-4901a8a1a42d", "comment": "Malware payload (AgentTesla)", "value": "d78eb4c29c072d373990145365170d96a9b85e77f79db14c7ddbcbfaa1d19ecd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "b64fe67e-da8d-490f-883d-d824ec43f1c7", "comment": "Malware payload (AgentTesla)", "value": "ef88f07ae252bbd7ea8507a109ab7f4f8f16b7d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "8b11297a-60f6-40e4-b135-05f78c066685", "comment": "Malware payload (AgentTesla)", "value": "489755b61f47d67d89bc5ff2275d38e269c50bdc3ad1f659069904883e3b00b4c6b3874a74f2ab44f95bad8521fc2352", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "0c40862d-7b1d-40c9-afc7-5e8a0a3be9c7", "value": "4D15012233986F62EA7DC7BC5460220193F5F446E712EA9D7EDC54CA08AAEC14767F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "e0832968-9519-40d4-8193-7f3da8a8114b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "55828c19-3727-4244-81fc-16dbc9f6213c", "value": "24576:JjChhhBtULgVl4NUTUbcmBSxdhOyyRss0rBm57g61:R+eyLTK5BAOyyR3scH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741935, "uuid": "8b4b9a86-8a14-4024-81db-4ec384647c79", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741935, "uuid": "9f2c1061-b43e-4bd5-a984-dd378392c52a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "c60a2320-fca1-4d35-a7c7-d1d930799360", "value": "QUOTATION ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894db8c6-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712978, "uuid": "dab239e3-1257-405c-b061-0ae279a0b8dc", "comment": "Malware payload (Dridex)", "value": "b8da2758df387110f4574111346b47ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712978, "uuid": "3fceeb10-4b7e-4886-9f63-844231edda82", "comment": "Malware payload (Dridex)", "value": "d86fe178adf6b45bf22e8f9b3a5ba9de842ec117cff422b707b2ca8a7e005848", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712978, "uuid": "7099cb3a-5ef2-45b8-898a-0cdd49dbf995", "comment": "Malware payload (Dridex)", "value": "d9e2900066d1d6e46b42e550c14ec2edc486f387", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712978, "uuid": "d0317653-94f6-4951-9ecc-a5bf8abdf890", "comment": "Malware payload (Dridex)", "value": "8b60c4d657af75c59720b0c34c5b1ed28da3a84f99ae4214b82dc015fd6ed4ce8fab72dc33523bf7e8d613d1a7a3de7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712978, "uuid": "507d69d9-4e79-484a-8b6f-32734184227d", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712978, "uuid": "77fda19d-a3c2-409f-b57b-311cc7691ba7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712978, "uuid": "d7a39a1c-1fb5-4b15-9fea-3bc250501356", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712978, "uuid": "4e5fb0f7-552a-45fb-97f7-92511d425111", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712978, "uuid": "54050cc8-7a0d-4826-a173-56388eddd648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712978, "uuid": "bf65cc1e-df6a-4b57-b09b-fbc83d65744a", "value": "b8da2758_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0bf084-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691240, "uuid": "e5f26e02-a7be-4e15-b3c9-5fa665228070", "comment": "Malware payload (Dridex)", "value": "2558705e2830c9516b362b3b856599d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691240, "uuid": "a130006e-0ee0-4bf6-95ce-9b6edd2f2348", "comment": "Malware payload (Dridex)", "value": "d8bc6fbd01a9e9dbd04ba53d21d630e9e4f2606276827d6859caedc32206ee95", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691240, "uuid": "278690a7-21f5-4bea-b812-97b954197be7", "comment": "Malware payload (Dridex)", "value": "9ac4dfbd67e7254ee168cd1f44c817709d6356f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691240, "uuid": "02c2526d-88a0-4cbb-942d-f8350f288d0b", "comment": "Malware payload (Dridex)", "value": "f172d34df8b51cb8d255b9d6536e16a58eff888b68cd978f2d9e7f0fcb4dd8456dc95dad8a5b7b3250a048107911ec2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691240, "uuid": "475a6ac7-15ef-4f21-8672-1da6aca19cd5", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691240, "uuid": "89df38c4-23ed-496f-a72f-81fb829b0bfc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691240, "uuid": "12515340-2c0b-4164-8603-9cf5d441494a", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691240, "uuid": "c1a5b189-3f7c-481a-810c-ced5f77f7f5d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691240, "uuid": "d07c8175-8552-4300-8dfb-16560a6a09a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691240, "uuid": "5ebb3d75-caa9-435a-8d77-b7012ca49715", "value": "2558705e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bfafc0-b219-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620710766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710766, "uuid": "d55f5a36-6f35-4f52-82ec-d42721357102", "comment": "Malware payload (Loki)", "value": "b7bd6976002dbef357dee165fa37cdbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710766, "uuid": "30150c6b-7f17-41d0-963b-17f6e30dd57d", "comment": "Malware payload (Loki)", "value": "d92cff6842da2ab3bb0f2ed868b84b525071cb5c4b7a282974169cf14cae9ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710766, "uuid": "694542b7-a4d2-4723-ad02-0cce604e0ecd", "comment": "Malware payload (Loki)", "value": "1d72cc7469d43bf229bd56130bbac28bbadcab4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710766, "uuid": "f454ac23-f268-480d-bc75-b77b93d7f194", "comment": "Malware payload (Loki)", "value": "f5e22cd3b210a49a9bb13cba711acf8958ce88a81046f7d31c16db314e4f845833a8217a624b65162db31b69103dbe52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710766, "uuid": "9c9cf87b-4de2-4920-8cd5-7902945a8b44", "value": "ACD408C2C54A6E98DC86023DD13669BBFD574DB597F264DA039B3D211B322AAB0D3C43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710766, "uuid": "725db4ee-d6a5-4201-afbf-37c3609dd5d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710766, "uuid": "4773823c-a608-43c6-8be9-56a9fef92306", "value": "12288:PJHFMw7Y9MA59CyMAn0682wxiwfx5TOCWv1:PJH+w09tVBpwxX7Tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620710766, "uuid": "8f5f3611-3107-48c6-9e61-995b9405b475", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620710766, "uuid": "6ac3f07e-55cd-4fb2-89f7-521edd06c087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710766, "uuid": "94b262be-580a-4e4c-9d9c-680627a82735", "value": "b7bd6976002dbef357dee165fa37cdbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c278a8ba-b272-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620749152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749152, "uuid": "ae36079f-dc8f-427b-bc6b-26e5a71fda91", "comment": "Malware payload (Dridex)", "value": "e54e1db8a1f3a47e6d9b8ed2cdfd06c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749152, "uuid": "6ffb9635-7015-42d3-986e-09d36bb1df68", "comment": "Malware payload (Dridex)", "value": "d9b56900e04418e9361a556b1c7e1c50836ac3f833e4fc45859e336b5033686c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749152, "uuid": "86645f1a-6663-4de4-9c9b-eba5d6e0bc23", "comment": "Malware payload (Dridex)", "value": "904855dcebcfbd47fd2067fa75179c6abf6da4b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620749152, "uuid": "a5f6f7d0-e40a-41af-8e25-078235ce1a7c", "comment": "Malware payload (Dridex)", "value": "200dabd303a8374a21bcf7f9b4e6aa85e8b98fd0f04ff99c836a6f416e703eddb75ced645fce083b006a1846770966e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749152, "uuid": "f8ab01cb-7b79-44e5-a703-5edcec995f97", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749152, "uuid": "e783c9dd-d703-47f2-980c-b0abb927cc55", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749152, "uuid": "c161f1af-1dc4-44f6-8183-559b507770fe", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620749152, "uuid": "334197f1-4a9f-4102-a6e3-76a3d46c2bae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620749152, "uuid": "0531f526-740a-4ef4-a490-dcf6ca6e6a9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620749152, "uuid": "f8dc0993-83e7-4be9-b785-d58cdaaf0a5c", "value": "e54e1db8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872b27a3-b221-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620714263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714263, "uuid": "3f8c87cc-906b-4353-a47a-c1e4a9e0410b", "comment": "Malware payload (SnakeKeylogger)", "value": "5cb10e0ae7558fcd3114a9cba78f8812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714263, "uuid": "be181fa3-e3b3-45ef-8a45-65a560258afe", "comment": "Malware payload (SnakeKeylogger)", "value": "da3dab5a9505fcef41a8302f6e1f02569649e671d1910e47e681915db1e572c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714263, "uuid": "6cf9e6af-f890-42d9-b982-d72ab5dd54e4", "comment": "Malware payload (SnakeKeylogger)", "value": "a24e5ec565da48343f92af62d25a88ed433cf442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714263, "uuid": "592ea936-4873-4b22-8dd6-13059a0e82ab", "comment": "Malware payload (SnakeKeylogger)", "value": "a12a41321ee46c2ddf7709d5da551cbf077407f299ca083e84798fd4a6c4ca8d1f4fd32ffa9dd4c7bfd03295054b25b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714263, "uuid": "deca4d05-4255-401d-8600-1893bd2d50b5", "value": "A3154BD8F54054E0DA0B5E3263EBCC3642262DB4683A690E57E43F7B3BB7E132935849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714263, "uuid": "0e7d62af-62f8-4579-b928-e123538e3987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714263, "uuid": "aff97e70-bef3-4892-8f3d-03fac7970020", "value": "12288:9TTjoLLoS60/K7yh0ytv3xjfr/t3aQr5hR6kZmFt+xUknymfR9Z7P7r9r/+ppppN:doLAyhxvF3aE5rNctM5nymZ9Z71q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714263, "uuid": "355a3f2d-7064-43c3-b6d9-f570becd39ef", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714263, "uuid": "b7a63245-00dd-49b1-b6a1-6d8fc30e3a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714263, "uuid": "4a966a85-937c-4a75-9d10-ab63bd42f5ce", "value": "purchase order..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9268a6c2-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728885, "uuid": "a46249d0-b502-4cb2-b7b9-d04c448ccd82", "comment": "Malware payload (AgentTesla)", "value": "030c3fad6bdd3e793789344468f78775", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728885, "uuid": "5b29ae65-56c1-48e7-8f87-375dc31558d9", "comment": "Malware payload (AgentTesla)", "value": "da60687024b9e6119efff0d8114bb4f627c41403806bcc2e14474f5d3532f05b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728885, "uuid": "81cc532e-98dc-4013-8caf-6e3264c54068", "comment": "Malware payload (AgentTesla)", "value": "b2553de6694b4f2b31c108afed493408b68c5d6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728885, "uuid": "5fce44eb-2cab-4957-b762-e7ced3287e28", "comment": "Malware payload (AgentTesla)", "value": "469875cf641cacc9ea6678c519b5dba3255e9f0c805c83703ea1aba008827b628bb07608c574473577d49cd79334c598", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728885, "uuid": "ffe22ce0-f39a-49db-a8a8-c9eb9efbe3e6", "value": "3625062162824722F06E3B34D866B2105BE17E7C1DD453AAD6B43B4B4B3F2512DE52BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728885, "uuid": "f3a36a4b-d74a-4b62-a886-f9dc8aea8da1", "value": "b64b452434f9b4c79d8cd285903a399f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728885, "uuid": "0bb87ee5-4cea-4d8d-873d-d512cea13a2c", "value": "12288:hAQUdCLsY8iOnhm8q9vvgh8RWvezDm+hz24S0EmwoKtJ7RXXBLOU/Oy/C:hAB5iGhyR7PlRMlHVXXBaUD/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728885, "uuid": "ba4c9caa-6937-4ce8-9767-caf8965bf331", "value": 980088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728885, "uuid": "3580b8b6-f22d-4cbb-a582-f259c7caa0f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728885, "uuid": "49c8ede5-ef5b-4965-98c9-7b5654dd7dc2", "value": "Amended AWB & COC Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19a29f5-b248-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731085, "uuid": "5bd525a4-3188-4022-8b59-c7d8e7dfd461", "comment": "Malware payload (Dridex)", "value": "2200740bb391c3ba2f0f973c461c9e33", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731085, "uuid": "3f1fa3e0-e535-4b04-9562-b53ffc97f913", "comment": "Malware payload (Dridex)", "value": "db259872b83fb76527b62740643dfda563e402f2b9d070d4a9128ab936612735", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731085, "uuid": "f37aeda8-b5be-47de-a3fa-00e3c646913b", "comment": "Malware payload (Dridex)", "value": "8e706e70501188083ca6a130eaa4d7775837ccb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731085, "uuid": "4d3512b6-a566-4d74-8d66-7aabfe8d27b3", "comment": "Malware payload (Dridex)", "value": "d0e13a8294a3fed9076977ca39f14e5c6acc23f8371d30cd88db4255f6d6f31444b44bc49fe44e991203b1a65f1bbdbc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731085, "uuid": "6c3fc972-9a8e-4c83-8f11-9c06036b3b20", "value": "4FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731085, "uuid": "8adb17a8-9388-41de-86a0-7d59d81560a8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731085, "uuid": "bfcb2e82-2d1e-44b7-a50d-f88855b67853", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731085, "uuid": "7c4493ea-4c1e-46e6-a1b6-1dccfe466fbc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731085, "uuid": "ec01fc13-1603-41d3-9568-f738064adc1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731085, "uuid": "2a3ef041-72f6-433f-be74-7275d4297db8", "value": "2200740b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35e17af-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735785, "uuid": "534fbc5e-d5ec-4bd0-b163-4e76b3b23a93", "comment": "Malware payload (AgentTesla)", "value": "27670c0af516c2f4cdec93153531413f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735785, "uuid": "724059e2-d431-4080-839b-7c3eb6cd3f3a", "comment": "Malware payload (AgentTesla)", "value": "db2df52c06b039021ffb4cbbda480c7bc071cacc2d31348ef719025efd48587a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735785, "uuid": "163e3532-8313-43c0-8513-c866f69c16c3", "comment": "Malware payload (AgentTesla)", "value": "d9e7784f9bbac76894096ad7ffc1100dd4e00c05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735785, "uuid": "c29b30e3-10bd-4270-b40d-8502d34dd6f4", "comment": "Malware payload (AgentTesla)", "value": "58cb526e1b959d52f361b59e9cf2da8caa95ce0581ed87e6c177f7da3410691f53083474ee0a3d0b2dee5c289e1a6334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735785, "uuid": "43722009-7e62-4898-8483-a2a444fdc24c", "value": "96D45AFCB55464F0E35B5C23A3CF0C0782291274A93B691E9B6013BE5A57E273E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735785, "uuid": "1b607728-5e0a-47d5-8c95-2452bbd4d3d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735785, "uuid": "b35904ff-baa9-4cb0-8adb-3cfc6859a077", "value": "12288:/W/joLLoS60/K7yh0AM7d4kkZTvyK6eXgQcks/BpnobIu:8oLAR7WkkxyK6eQZXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735785, "uuid": "288c0225-dbac-45be-8e75-80bab3a95ab0", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735785, "uuid": "df88efd6-6c82-46fa-9dae-6eddf3ca9ccd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735785, "uuid": "19897ad2-dbaf-4097-bd03-334c412c60fb", "value": "Cotizacion.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed166d89-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735909, "uuid": "a9ee9e38-1519-4079-8ded-70163cf78bbe", "comment": "Malware payload (AgentTesla)", "value": "43ecd98b39cc9ebfc3f85d0c69449373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735909, "uuid": "10cde891-5911-49ce-9fce-6c7b90b3f1a3", "comment": "Malware payload (AgentTesla)", "value": "db59b7cbcd7ffd902553d10a3aceab64f2020a04f169e167e25d01a14125f5c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735909, "uuid": "fdaebde8-41d5-4570-8123-d004811406a8", "comment": "Malware payload (AgentTesla)", "value": "419842c79a2c0a3ecc1e0137235d77a9b585949e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735909, "uuid": "341ce691-c334-41db-9b12-736be0399385", "comment": "Malware payload (AgentTesla)", "value": "4c26c36d48594df4461579cd808105b5bf6099cfff047ee85c8458a6dee8569c683fdd49afb03bc56e7a516614bdd013", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735909, "uuid": "b487db76-1722-45e7-9449-a77c655fd0e9", "value": "72154AA8F1C064ECD6274D725FEA3E0A451C1534693A1E8B7F6033B9697BD232A3D58C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735909, "uuid": "8072e5f2-404c-4e0e-a745-772331f426e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735909, "uuid": "41098c89-6cf5-4681-84ec-f867829fae63", "value": "12288:cFoLLoS60/K7yh05fLI54fZVe1dxu57ETqsty1sr2fjb18Njh4ZhZ:cFoLA5fL23VudEmwCfjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735909, "uuid": "0693f9fa-6eb3-40eb-8cd3-52857fead1e6", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735909, "uuid": "fc129412-9e5d-4e60-b961-e86d2d443759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735909, "uuid": "f7491cf7-fcfb-4e60-9494-f1386fcf8eb7", "value": "CARGO DECUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5043356-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714823, "uuid": "00d9100d-a6b5-4660-913e-f07c5f37ad46", "comment": "Malware payload (AgentTesla)", "value": "ac8556eb979f63608c23f37be7784630", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714823, "uuid": "bbd72750-3122-4027-85ec-1d273ff286af", "comment": "Malware payload (AgentTesla)", "value": "db683fe0365a4a2ed316ea5944cd1cdd05a398d65e0caaead565dec941d54f71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714823, "uuid": "1e56e17b-0156-4926-8d81-2a9a84b773c3", "comment": "Malware payload (AgentTesla)", "value": "c107e7a0d815dbbf97d275c61cf7edbf225c6862", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714823, "uuid": "2c872288-5b19-404a-b1ca-27040a7019bf", "comment": "Malware payload (AgentTesla)", "value": "a80c4b6a6b4d2a40ede0ea129f0974418c0330adb9690fb23697bea8617ddaeb0744cb88c17cda3f4bfb9a1b8855a3eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714823, "uuid": "5eecea0a-7f3b-4527-915a-09e779531425", "value": "2C25230332D4A228E67C5B3D2D59264592F1E911B653FF4C7F8440ED2DA3AEDC7826E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714823, "uuid": "17ffe094-9059-45aa-8b17-2d9ecc5e949b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714823, "uuid": "c1e179fe-beb9-46b6-855e-06ae7be63c8f", "value": "24576:3XXjv7iYIggbhL3m2rVk1UMB79JpciBdOz+i:HX77Ygu3m2ZMp9JpFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714823, "uuid": "8e6bac2a-3652-4a4c-af4e-7f8497a75c2e", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714823, "uuid": "92932797-59ff-40ae-b486-03261a4cd7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714823, "uuid": "870fa8b5-232d-4761-b573-3196b1842e94", "value": "order item #432823_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614cce23-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620720213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720213, "uuid": "1db6d021-3ade-45df-9965-ec9e7e7fc566", "comment": "Malware payload (RemcosRAT)", "value": "b98b396bc2e687f08f4aea3c541a85c9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720213, "uuid": "8a148d2c-eff5-4017-995a-ea48edbffc19", "comment": "Malware payload (RemcosRAT)", "value": "dc55d491af0bd20319ad19e6047b316a7bad5ec4e37d3500b240a68fc8f43759", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720213, "uuid": "49702095-ddae-4eee-9606-0cc535a78fd5", "comment": "Malware payload (RemcosRAT)", "value": "544710ab6d6438b5d839a93e792b52389964d7e5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720213, "uuid": "e2755673-a5b2-487d-8e4d-b5060eb6f059", "comment": "Malware payload (RemcosRAT)", "value": "4aa28b542ed494477f8fa9692b73fb57576e9b587c5cf96ff054849b80b4e2cdd3b281cb6d9b16456a3b8d34a50a4f8e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720213, "uuid": "ac99e92d-5ab4-49e6-8e37-1b0df5dd6d1c", "value": "00D4232EC3401DC7C313A4978A2223DBFAB6F325929DE17A656D6538E7E6C77D0864C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720213, "uuid": "d20336d1-fc32-448e-a45e-9a2ebc800347", "value": "12288:rkF+BlQqkv5Vn6rlqLO7nEnUUcUD/LcqL43yQ4d8/W3q7DQm8K2c:rkFE8f60iQCcDbc3QsW37nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720213, "uuid": "fc3215b3-a9dd-4d39-a05e-d265f4a7c110", "value": 633328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720213, "uuid": "ac2038db-fb1d-47b1-bd5c-df154bc32269", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720213, "uuid": "c45f9423-8a42-4333-a2c7-3bb608484860", "value": "b98b396b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e347e5-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712749, "uuid": "4a1cb5eb-8e4d-4096-bc3b-ae35da5fba91", "comment": "Malware payload (AgentTesla)", "value": "520cafc045f4932d82b5a37bfb9566e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712749, "uuid": "800ddc21-dffd-447b-9f6b-fd78821826fa", "comment": "Malware payload (AgentTesla)", "value": "dd8cb0b0a45253ca00dff802d1505f6225b5bd54c742c12c0ab30aa5b3ee7c21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712749, "uuid": "6ca48cca-ecd6-4c8e-bd7c-b34cf4b976ec", "comment": "Malware payload (AgentTesla)", "value": "0207c8e45f934df76d2c98786fd215a1b4c3e77a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712749, "uuid": "9efb837f-f68f-4c72-8c68-cd2ff21636d6", "comment": "Malware payload (AgentTesla)", "value": "a52b290aaa247fb24139466d4e600fa77b14c1f4fe37887c032469fd0cdc57d9989be196caf74ee4b1e631c5370b1fe6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712749, "uuid": "ed513503-ccb6-40de-aade-c88521237b36", "value": "9905231772E8A725E1FC13B91042469157F0E529A623E70E3E8930ECECB3BD8D6856D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712749, "uuid": "564cf80d-54dd-4f6c-b8c5-0ef808df74ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712749, "uuid": "10541b20-bac5-47b5-9357-82dbb7df5c70", "value": "24576:xUunPMIrG6d6LL6lB0ypZ5KbNh+wl54O14Lq51l6j:xUub56GrpZ4Nh+pYl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712749, "uuid": "a838caec-6c09-487c-81b7-b9e63a77b315", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712749, "uuid": "1affa5a6-58c6-4219-bb07-60897835a520", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712749, "uuid": "3b1b8e29-2fa5-49e3-ae47-18b992af3cd1", "value": "Pt4hpwuklrsm7RZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925caa66-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715141, "uuid": "fb100add-54b6-4017-bc8a-f033e5c4f85a", "comment": "Malware payload (AgentTesla)", "value": "0f8933bda890810da5c0521a7355ab28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715141, "uuid": "15455ae6-5a88-40c4-9bd6-c2a914ccdc83", "comment": "Malware payload (AgentTesla)", "value": "dd9113142fe95a5b0d389a920be3f978f452fe6e5b591e40b40b7a4e274d3b85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715141, "uuid": "ac055dc1-74b8-4583-8485-483ddaa0cf47", "comment": "Malware payload (AgentTesla)", "value": "f4131a14d239878dce4170e6bc99ce8fe321719c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715141, "uuid": "00cd7e8b-8175-4cd1-beec-300fb923b6f1", "comment": "Malware payload (AgentTesla)", "value": "2a26a05568990353fd005df907cf9ce9887ac720a047c269b0e42c048fc1680859f0c94b634af9d2ef32321f5ec33cb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715141, "uuid": "b0107789-b913-4f1e-9520-3c3b87b2462e", "value": "9215237B40A85B9FC3FF52F8444A20D287F2D79E6793E7052C805AB850827D99F836D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715141, "uuid": "bed09c2a-25d1-4b0f-acf6-ac2b1c83504e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715141, "uuid": "7b8ca5ef-47ac-4984-b4d1-cefd06276179", "value": "24576:inrapb6/wTp7q+JMwDoYi2J0+PkaPvS0AJ:irx+RDo52J0UfPtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715141, "uuid": "b221eba3-04c6-48ad-9b9d-ab30a96ac21b", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715141, "uuid": "b54ad1fa-11a6-4776-a38d-e7cdd9a96688", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715141, "uuid": "c46f760e-b165-4850-ba9a-5f7f7ed818b3", "value": "tAe9xfvtm6kVwfA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82548daf-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738307, "uuid": "e0c25f54-dc8f-428e-8023-c89766558eb9", "comment": "Malware payload (Dridex)", "value": "c91baa6a8bfe300484906a2988fc64e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738307, "uuid": "b4c28297-a1c5-47be-830b-da3190bcd73a", "comment": "Malware payload (Dridex)", "value": "ddb93073f8dc41b31e5a923da78538f04f0999d5f1dac94ed52b1f6e960e5376", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738307, "uuid": "aaa238c9-eaa1-40c5-9dcf-fc50a86e74f8", "comment": "Malware payload (Dridex)", "value": "565fe97103fcd9347255dc30ae87563b5a7c6e77", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738307, "uuid": "bd3a7ef8-d784-418a-a8f9-9e7b839a26d0", "comment": "Malware payload (Dridex)", "value": "05c828987f413a0e9d4bf3812eabfa85a69112477086edba6fd4ab15c5d6d1ff3aab75c0f1196610b97f19ff1caa325a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738307, "uuid": "eb6a4598-dbfa-46ae-8750-27424a1a373c", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738307, "uuid": "0774d7cc-8c09-41a1-9de4-edd46dfe7159", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738307, "uuid": "4f4c50a1-c435-4117-b7a2-484658aaee99", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738307, "uuid": "fd2648b6-f8f9-4faf-98fc-7d8b2268a788", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738307, "uuid": "fd59565f-e3c6-4d29-a903-d4a7c55fa67e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738307, "uuid": "791d3cae-2170-4ed3-87fb-df67be1c84d9", "value": "c91baa6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e00386b-b21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712583, "uuid": "d19c60c1-8bc5-4b6b-8d1d-373aa03dc0e0", "comment": "Malware payload (AgentTesla)", "value": "53ee1719315e25f5a485e032b7596c89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712583, "uuid": "c68e9cbe-e2ae-4263-8120-f1c4767777e3", "comment": "Malware payload (AgentTesla)", "value": "de0b80f33037ee2253015508b278b103356b4ca38df599ecb1c91fa1403211c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712583, "uuid": "1f575e0c-d7f9-4f9d-b8d2-5374f23128e8", "comment": "Malware payload (AgentTesla)", "value": "ba28ef98dc4e74277c0fe370a7dd21e655b1abd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712583, "uuid": "2d783b5a-55eb-41bb-9e38-c5eb02c0ba5c", "comment": "Malware payload (AgentTesla)", "value": "f02879f6f20300425735662812ce6aecb2876e8e16f0e6e5795f9d55a7dd8e99fcfe9ac1d9ae2c58b5745f8f13e007b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712583, "uuid": "3ccba1c9-9991-419a-9cf0-937275df6e42", "value": "EE05121236E5962CE0BC13BE6861661017F0F40DE266DF996E8512BD5AB37C883C7BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712583, "uuid": "40b4bd42-afb9-4b45-b706-9919b00d733d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712583, "uuid": "7157c537-4040-46f5-b7c6-4a7e4e353422", "value": "12288:hEVCyiuQKFn+5JWtpoh5SZZLjxt4gi/2RxTpDoHGqRmtf7ID6umhShUPRuPNXjh6:iaN5S/nEgIAhjsmtjEmhFRuPT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712583, "uuid": "14a6cdd4-d6ed-4de4-8c50-070662edfd87", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712583, "uuid": "4e5e1e40-d8ae-4731-89e1-de2250df569b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712583, "uuid": "5dbcd726-4af9-406c-9189-8b13622ad9b8", "value": "Request for Quotation-4505527156.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1e76e6-b26a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620745494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745494, "uuid": "2579b90e-2c14-465b-a7fd-624c092017f0", "comment": "Malware payload (Dridex)", "value": "bdc26613b95a7e8bf219d67c309acbad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745494, "uuid": "4f2dbcdb-51ef-4cc0-a9db-2d2b898060db", "comment": "Malware payload (Dridex)", "value": "de2bdfb8263d8df7e224a43182404e6b3b0212498d2ca3c1c34021d463e8c88b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745494, "uuid": "c283ab83-a199-4a56-ae78-ec64a100d774", "comment": "Malware payload (Dridex)", "value": "5303b55b94e0dd3c96a6ff5c3a3724c3033de353", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620745494, "uuid": "8c6707a9-4b50-44bc-bde0-cab33596570d", "comment": "Malware payload (Dridex)", "value": "f8eea0545a1c1186728b0ff58cc26d83abcc02c3f4e8683daa5e437c230420eb9cd275d78450409f880aa1cbc8c5538a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745494, "uuid": "ad62194f-190b-47c5-b0ee-263fc0e7241b", "value": "AFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745494, "uuid": "e97e37a3-a88f-4eed-8d94-96e180afa725", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745494, "uuid": "e3aaf45a-732d-4cc5-84a2-aa64992e2d15", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620745494, "uuid": "e6e74f4a-ec3f-47c0-a09c-c44a6bf25edc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620745494, "uuid": "243ea89c-58dd-4795-b6e9-b8011008b197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620745494, "uuid": "715c2009-a30c-49dd-bad7-790550f18c01", "value": "bdc26613_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7a523a-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620716337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716337, "uuid": "b16abd2d-e362-49ec-a607-0ffc7b889c9f", "comment": "Malware payload (AgentTesla)", "value": "cafe2699c74e295d8a329a21c5d1ecf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716337, "uuid": "4eccaca3-964a-465f-ab9a-56e4b86535f0", "comment": "Malware payload (AgentTesla)", "value": "de37859ffc72ea5203fdc6d147ec3734a839c32d931d417eaec7a9dc8793143d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716337, "uuid": "eb52e6e1-5f62-4f5b-806f-0e1e2927d08e", "comment": "Malware payload (AgentTesla)", "value": "1c1573db54fa32a9b3641935c2477afa2b6f0977", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716337, "uuid": "fb49c607-8032-405e-8050-09f21807906d", "comment": "Malware payload (AgentTesla)", "value": "0f3ecfea7e6db7000033ee48cd1511b507a9df9189a77af80ae8aabee715429a41e86a264e518120cf892201627f452f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716337, "uuid": "f7ee055d-53d6-45ea-8fe7-60420d053d67", "value": "09F47CFC751464F9D34B5C27A3CF1C1682251274A93BAA0B9B2103BE5A5BD273E389CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716337, "uuid": "fd0f4833-2f5d-4fe0-a6b2-8787500669c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716337, "uuid": "f1f112e1-db19-4649-9ffe-431a1f22e82e", "value": "12288:coLLoS60/K7yh0K1etX9U7DB0ieFWHLoGTL/D6e9Oac7IgV4StSzsguE9n9CQ3c0:coLAK0JK7DDn/DEkLwE9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716337, "uuid": "22e14ca6-fbd4-4396-aa90-ad46a824bf0c", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716337, "uuid": "d6d066c4-d14b-4677-ba60-545507fed3d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716337, "uuid": "8ff68ec3-f89a-40e1-9978-8a7b5f41a3fa", "value": "Overdue Invoice(s).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396c2e09-b283-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620756223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756223, "uuid": "97a116f8-e236-4bb2-aae6-05c3b1dcd4b1", "comment": "Malware payload (Dridex)", "value": "abfe619ffb35050e7053247560fce99a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756223, "uuid": "d19bc649-fd14-4a80-90d3-0fa3302ac186", "comment": "Malware payload (Dridex)", "value": "ded64de38e95e0036ced28ac5596436831c7917dc1852f6ae3e3e3d3494519a4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756223, "uuid": "0977d4f4-aa89-44f1-9a3d-6662811684f3", "comment": "Malware payload (Dridex)", "value": "047a562e2789153e265085893b09d8ba5d11d9c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756223, "uuid": "ac67ef75-575b-4947-ae32-9dfcb9fbe07c", "comment": "Malware payload (Dridex)", "value": "8d6e8599dee1b120398f13f6009c5d77479a6068d9f31a3705e70b51d6d414b9f5e8aa8c09b36799a15e9befa2dc7723", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756223, "uuid": "9edb375b-9f25-474d-a475-08dabbcaee48", "value": "92F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756223, "uuid": "98e32a5c-eff2-4f5c-8218-64b1cf9184d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756223, "uuid": "69039bb7-b2f7-469b-a40b-7675bb46e3f5", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756223, "uuid": "05182e31-f13b-4eea-8075-9b3cadcd4421", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756223, "uuid": "061487a0-9f7d-49e6-8a60-4f4dc00e98c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756223, "uuid": "c913a410-cec0-414c-9f95-d2b16623d706", "value": "abfe619f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba69c6a-b25d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620739853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739853, "uuid": "4c110ce9-de10-4e06-bdf4-408e9f2c57be", "comment": "Malware payload (Formbook)", "value": "9fdf605ce0358540d48502367e637b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739853, "uuid": "d7189410-9442-4c34-ad43-c8e127a27928", "comment": "Malware payload (Formbook)", "value": "df22601db1675ce639bc8efe21534f7371050ae9637f6cdf38bc23ae6c18efdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739853, "uuid": "aea78611-464d-4f20-b0f6-078a06f0e84d", "comment": "Malware payload (Formbook)", "value": "1416ebf9b0382a8794bb89f5ee947ec668ce7fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739853, "uuid": "dcc0f98b-4221-405c-81e5-a386298199ee", "comment": "Malware payload (Formbook)", "value": "c67a2689f4f0c3b0d719ef3774e66c3d7e275bedb27a420e0e285212146ed7a625bdf09b7cc2146140840589fc0d4088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739853, "uuid": "8750d60c-b35a-41a6-aae0-c6ee02a35d52", "value": "B21501313368AFE2E6BED73D9820014803F9A456E722E68DBEE545DE4861F418773F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739853, "uuid": "1973e183-746b-4081-a400-53accc53fa15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739853, "uuid": "28355b3a-6f64-4e19-be35-9f62838a2a17", "value": "24576:YuYmWMA1pfGPeW+Xa4OcYaRzVr3A+laAgfjbEr:YXMspfjW+XPOLaP7AWaffjbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620739853, "uuid": "7e96920c-7780-4f88-b7bf-198ad229b9d6", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620739853, "uuid": "1545e25b-a3d7-472c-bf75-ae35be672556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739853, "uuid": "43f51c83-126c-463f-a7f6-6629bab34b4b", "value": "da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a12f56d-b221-11eb-abe1-42010a9c0039", "comment": "Malware payload (jRAT)", "timestamp": 1620714241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714241, "uuid": "2935fcb5-b38f-4cd6-b3ec-3d9e84fcdb7b", "comment": "Malware payload (jRAT)", "value": "9e37641be2e48ea574de79fc03b339a5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714241, "uuid": "fdd6d5d6-f555-4c69-8e37-469ddae47c7e", "comment": "Malware payload (jRAT)", "value": "df64df82b18e852a3b662b4b26e46a1077fd298c0b9133ba7a8f084b988a4b0f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714241, "uuid": "edf1bef2-591e-45d9-9d0b-e571cde603dc", "comment": "Malware payload (jRAT)", "value": "357f64b7432a93c1e12abcd979938e140f953327", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714241, "uuid": "c941c86c-6818-4857-ba9f-274d50086050", "comment": "Malware payload (jRAT)", "value": "8e5eff9512d0f8016cd39f7b498cdb54c6436df6ed40f730c018daadfe8048bfe95cef6bc60b19bf6776a669e5a0ce7d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714241, "uuid": "8ae81213-d4bb-4c14-b76e-0f8cb7e964ad", "value": "CE34BE2328C40138F4636271D59C1837B70D75CDA2A7A56B1EECE49E7F7D98B2B1221B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714241, "uuid": "e6570b24-0e43-4862-ace8-cecd42f3f697", "value": "6144:aPK3yOZuRdX61wmY8e8R7zP/XP+W3WZ3D:aPK3yawUY8eSXXP+WGZ3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714241, "uuid": "311be0ad-c1e1-43b8-ac8e-f325dd82754a", "value": 244784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714241, "uuid": "b62431a6-31dc-47a8-b42d-ea1100d7a3e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714241, "uuid": "8604aed0-0cb4-484d-83c2-955834f6b417", "value": "QUOTATION_210905 Img.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f08b35-b238-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1620724138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724138, "uuid": "c4647fca-b1b6-41f5-8ed9-4fab5c56b36f", "comment": "Malware payload (GuLoader)", "value": "3f695fa46992bd20300728e9245c87f8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724138, "uuid": "1c6d6466-308c-4f30-81df-ee686b1d138b", "comment": "Malware payload (GuLoader)", "value": "e0f53d67eb5d4a5bab2f6d0bbaff502896e12572b97bf0350c88cfac3fcc5b8f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724138, "uuid": "76668c1d-00c1-43c1-9bb7-ea2a666980d1", "comment": "Malware payload (GuLoader)", "value": "83d7a6cb77eff285ed7b1950438fa3573d5b31fd", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724138, "uuid": "8e5b0ef7-b865-4f6e-a577-b88d3dbef386", "comment": "Malware payload (GuLoader)", "value": "31cd69aa849437ed69a7a12fda4904629133e9429f978bea2d53267cf4c3ace7b1391d8a3efd94f28f0a1067767cd172", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724138, "uuid": "8c98d34d-d0cc-49af-97f6-c01f13a43f62", "value": "7A83C4263F50E4B1E8C3A8F9371071B64FE23B360217A14FF38D731776B96159A16A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724138, "uuid": "6dc663e2-e8e2-452a-97ba-dc378c1c9bd5", "value": "ec8e962978786706cf0189109090c85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724138, "uuid": "9aa6d704-5c5c-4328-985c-9f2f6564a801", "value": "1536:1HDgHBRiC/5r4b01V/M7FWf0Nq7Iz/a2GeD:JY4+542/YFWfea2Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724138, "uuid": "0ed26a50-162c-4a95-bc87-5809b8750b31", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724138, "uuid": "2c39d188-cdb7-45fc-8ca0-dcd4f632df42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724138, "uuid": "b07ae578-2e67-4292-88ef-3ec3eef61f68", "value": "NP__000009116_11-05-2021_08_40_37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca023f2-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620752927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752927, "uuid": "cd2eb839-d354-4141-b57c-d1bd676aaf53", "comment": "Malware payload (AgentTesla)", "value": "97b253f75db04460e18db48d1fbe0185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752927, "uuid": "a122cf0d-2425-4478-a9db-c3b16f2c5cc3", "comment": "Malware payload (AgentTesla)", "value": "e1c93097733707b2f39245736d2b55aee9502e2fe8c02ed462115f420dd4c567", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752927, "uuid": "b9fd7ad9-5907-4cd5-8a0e-30d8a7329f1b", "comment": "Malware payload (AgentTesla)", "value": "ec6e9a408efc771e6d18482376e46d4dae410240", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752927, "uuid": "d08e2890-7dec-47c4-99df-97c4228d99e3", "comment": "Malware payload (AgentTesla)", "value": "2309049a05fdc575bdaa0fbc39c649a8897e7502d61d28adbd23b01b13ca6abc8e68e29560f89b3bcad98f77053020fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752927, "uuid": "8b5be50a-1282-4d4b-8d80-7d07d892cbac", "value": "A505234633C47A64C17E4EF56052164107F1A90AB223EB487EC9A8FC66F36CDC721AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752927, "uuid": "69de94a9-afc5-45ed-9502-a189d33eea0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752927, "uuid": "986e6618-c5ff-4034-8cf5-5e8a371497fc", "value": "24576:VyJU/ySthgj4EOglRYKgbmBACj2xaiYXFZg:sOhpELlSKrACj2V6Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752927, "uuid": "8b725d75-f3f2-4655-bb5e-aa32596ba888", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752927, "uuid": "9a5c56ef-e96c-47de-bd8e-568d0536f3d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752927, "uuid": "c15cab11-0fde-491b-9f92-9eb0b3ab7b09", "value": "97b253f75db04460e18db48d1fbe0185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b0fdd4-b221-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620714293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714293, "uuid": "3a133994-7762-4ca6-a667-7beff7b584a4", "comment": "Malware payload (STRRAT)", "value": "18031dda20407c7250768c264e747e4d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714293, "uuid": "56a9f659-fbc4-4f67-941c-240289b390e9", "comment": "Malware payload (STRRAT)", "value": "e1d6f319e4b448e3e487d6c6ab0b7b4172e2059abc90f7e8156fd661cbb1d513", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714293, "uuid": "e5f7288b-1f9f-4aba-91e1-3720818f7b7d", "comment": "Malware payload (STRRAT)", "value": "c29d744f9b26f6940215c1aae50fcd5de99fa55f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714293, "uuid": "c9878df0-08ff-4de1-a97f-5bcd743b8474", "comment": "Malware payload (STRRAT)", "value": "092b1618caf91498ca0beeaedc2161fcb35f6f2c0353b97226fa5ea797cd88cbc8a84751682ebd425d7377597135b4f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714293, "uuid": "4d6d931d-81d0-4920-abfc-56cfce8d6c76", "value": "D3C31232CB11BF8F8A4F433446ADFC7354DAC50BDD9B11783A89A652A252400BD99F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714293, "uuid": "e5da6f15-8ba6-42f7-90ea-c15fe97d946b", "value": "3072:ObWPdFKSjaWkepLFgLwYO7KPVLgpVz3iooD/t9jHWAs6rBeR:RPKAaWkepZgUX7QVLgpViDbHvdrBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714293, "uuid": "1e1ad7be-5345-4c2c-a7ac-bb3ae81ad175", "value": 128546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714293, "uuid": "c1b29fd3-63a8-4cba-83de-802de5488cfa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714293, "uuid": "ded6f59e-7f30-46cf-97dc-0f0f18e0b74a", "value": "ATTACHED DRAWING AND SPECIFICATION.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cea5e5-b231-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620721081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721081, "uuid": "e141b60d-6b7d-4cb3-9877-bb7090ba0de1", "comment": "Malware payload (Dridex)", "value": "e2a7840bb80e883fc70cea70c370fce2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721081, "uuid": "e9bc33f5-85cd-44e9-8b80-2ffebe679f53", "comment": "Malware payload (Dridex)", "value": "e28f59a38521886ffc2b80d257695f7c38a0d64bf3c22f5c7b872889ab253786", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721081, "uuid": "3ee31ed0-0570-4256-a3d5-fe364c77dd06", "comment": "Malware payload (Dridex)", "value": "13d917cb576fab60583ca76826327b15531aa2c6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721081, "uuid": "2b7ec467-bfa8-4c36-8819-f4960c47e8a7", "comment": "Malware payload (Dridex)", "value": "e0f153300d05b3919f9ecc4d26e8f6d92d3c17d149ac830774782bcb98f44c9a216500ba1d126cfa3f0fc67ca228710d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721081, "uuid": "39d6cc4e-c7fd-4ac7-8c5c-6867ea8843b1", "value": "22F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721081, "uuid": "fa5ef365-2f24-4552-8963-192c977baf11", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721081, "uuid": "d13357fe-4007-4a7a-8fbf-78a3c45db24f", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620721081, "uuid": "c0986822-ca1f-44ed-9b0d-34a8384341a3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620721081, "uuid": "3c9f4aec-6d1c-452f-b472-6998bc169f61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721081, "uuid": "0577a1d2-d19d-40a0-b716-3d473473df0c", "value": "e28f59a38521886ffc2b80d257695f7c38a0d64bf3c22f5c7b872889ab253786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0f283f-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620723672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723672, "uuid": "f8948d93-ac38-4d14-9d46-97e108c01df1", "comment": "Malware payload (AveMariaRAT)", "value": "d97e7bc82168f5e833a0e16266605ec0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723672, "uuid": "bf5d5b06-b122-4be0-a73f-f35822e1c531", "comment": "Malware payload (AveMariaRAT)", "value": "e2f13421d4815946eca2b3fc08adc2238a6489ce035c76354f81afee287f937c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723672, "uuid": "97d3a436-bc42-4225-a29b-fca4e237df48", "comment": "Malware payload (AveMariaRAT)", "value": "629a47976b58cc6c8c110bb6cb169e5e389af010", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723672, "uuid": "bcfc6905-35af-4b7c-ba49-0a0fa5b60cf3", "comment": "Malware payload (AveMariaRAT)", "value": "3bddc207cfc637cd1709ba320a9449b06636930772c359a7f405ff63cec480c3d99ce6b5651d97868b13ec2800757452", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723672, "uuid": "37f4bd58-8d28-4a31-a328-498e4d6779bb", "value": "5C15333A534E05A1F0EFB87E1056C5322EF8D2C2F5E84799894D11CA34DED88C7BA8D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723672, "uuid": "bb6b9672-69b7-4cc7-a577-ce98c5ceae31", "value": "c8acbd643be494256e7385970c8079e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723672, "uuid": "f5ff91b5-df82-4c4e-bbc6-d8f39fdf30cd", "value": "24576:7atkKmef8a3w1DKqLnAD9zDgqVnsI7MI:WzmeANz4DgusIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723672, "uuid": "a2a0752e-9e5b-493c-a5e5-a22115bb86c5", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723672, "uuid": "acc645fb-7390-4672-8bd6-d2b84906851b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723672, "uuid": "3b44f7b3-7c60-4f61-977e-815232fc4047", "value": "Our Product Range #18766526-86543-May-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68ced60-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Locky)", "timestamp": 1620698532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698532, "uuid": "2ead081c-ace9-43a5-a348-fa737b82fa1f", "comment": "Malware payload (Locky)", "value": "a95d84cc2a193ca58c884961db3b5676", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698532, "uuid": "f57fb7c5-3bd8-49d6-84ba-7b743e193506", "comment": "Malware payload (Locky)", "value": "e3c2ff9790194849f54b1e93bf5cb87cc0d31fe194b3ddda0f1480da4d79f0f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698532, "uuid": "96c8bc22-bfcd-4d63-9df4-af40f40be7a2", "comment": "Malware payload (Locky)", "value": "e60618c20111ee555488d272126d87f68c234180", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698532, "uuid": "e81edde9-120e-4234-8b56-321cd5a42a0e", "comment": "Malware payload (Locky)", "value": "9241d24d3e1bcd03366f04aaac8e4682277eb7a0c10ea0b18d20f38815985ea709602895b026aeee710c538b3fa989e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698532, "uuid": "4829e091-ffee-46de-8626-0ecef62b24d7", "value": "059312D21A094D3BCDB857265E3F427268E3D296CF79072B27A1F4EE34584C25EB9708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698532, "uuid": "38fffc4f-4b4b-461b-94a1-13fb3f8aa367", "value": "1536:6SUgtA/bvQNbHCxFO+7UvMilVZLECnrQHZHe7V/kNVxAJI90Ay1IHO1jjze+rX8:ikYFOnMWjoCnrQ5HoOjMIaAqoO1jXhrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698532, "uuid": "1d9c39c7-be17-4060-a5cd-7b48a75f495d", "value": 97325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698532, "uuid": "a8ca3773-07ee-447c-b3b0-354673ab8cc8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698532, "uuid": "64bd4852-4f0b-45bf-b435-ec04f9f51a9b", "value": "a95d84cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66e331a-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620698451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698451, "uuid": "c127d0d5-c95b-4b83-bc1b-f409b4dba373", "comment": "Malware payload (AveMariaRAT)", "value": "54fe90be9ede85b952193c23122f6c69", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698451, "uuid": "7700d649-365e-424d-92fc-a156cfb2979d", "comment": "Malware payload (AveMariaRAT)", "value": "e401c1d9c6e8633d417e31bc25dee5423916fe11074c283c52be4413162c45b6", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698451, "uuid": "0fc6b019-8819-4765-a2c8-4b52c7209412", "comment": "Malware payload (AveMariaRAT)", "value": "3a9e68512352e215cef68b8de27ede456df0578d", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698451, "uuid": "51e1fdaa-e78c-4a41-8bad-f45aa10858ff", "comment": "Malware payload (AveMariaRAT)", "value": "b42a5a2f10906ac245fa660b7c17e8314e58511b6bf18a85b6b7ecf7cc3536ae8ff471b5ae9f38516a69df46e2e1a6ff", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698451, "uuid": "9775e45f-651e-4246-bb4e-58bb1dab29c3", "value": "9EA423A37315D097E23D1CF923099246173CD6C66F2E8AAF4A0F83538E96DA4251F4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698451, "uuid": "c936f8ff-1464-47ed-b125-7243ca32d79a", "value": "12288:AxCKaGIgwiid/7NSvjhXXqZpWfortiBh8FoBUrKBVirBqa:ILaGxoXSvjhqjo3MrUQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698451, "uuid": "37e0b299-ea72-45c4-9ef6-849c458eb09b", "value": 449548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698451, "uuid": "0aa659bf-ada8-45be-9618-21a31746f76d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698451, "uuid": "fcc9b4fc-105f-4cc7-8667-c3c80de893a4", "value": "54fe90be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa141b77-b245-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620729784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729784, "uuid": "aaac7e6a-bff9-4b4d-b5cb-58527183f49a", "comment": "Malware payload (SnakeKeylogger)", "value": "b50fe78f59ae343a4ea40475ee85685d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729784, "uuid": "3a27a20b-8660-4ef0-8f91-7030b264c1aa", "comment": "Malware payload (SnakeKeylogger)", "value": "e42652363da5db38ce553de583825a570fc76123af18a59550b3956dd3d573d0", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729784, "uuid": "31353d02-dab7-40f2-9685-4107f59815e6", "comment": "Malware payload (SnakeKeylogger)", "value": "0866696f3395ae375cfe7b2a9051fe570fe8544a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729784, "uuid": "5dcf685c-50c9-4745-9bab-e47f1b9c8968", "comment": "Malware payload (SnakeKeylogger)", "value": "cdd3f2b5dc6ae0389e68d0fc9c78d1ae6ed7e02c1fdd1839462f91a2def9acc66c7f7e51e12977ca473be32aaba963e3", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729784, "uuid": "0079c772-fc0e-44d7-8eed-65456010a7be", "value": "AC94233417A0D8F3DA9506711E3EFF7AAE964229946A0A0F2744BDDEFCB4E49670C124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729784, "uuid": "40cfde0d-b087-4372-a7ce-678aca9cc80a", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729784, "uuid": "73113778-df38-4cb0-a9b4-c58560b9f235", "value": "12288:l0VbNotdnO7Zd542rspOfc0kyBuP9cawxPjxMb:obNotdO7DxOOfcVPWddjmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729784, "uuid": "f256b64d-4e77-4ad8-b8e4-ebfdc862c20f", "value": 445488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729784, "uuid": "df7d0cc2-74fa-4a14-b613-8d1f137ebea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729784, "uuid": "0bac7298-0906-4ddc-98b0-f605a45da9b3", "value": "PURCHASE_ORDER_0098_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f212cc-b253-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620735902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735902, "uuid": "76578530-abeb-420e-afc7-64262e9d99fb", "comment": "Malware payload (AgentTesla)", "value": "4afd0f01c414edb99aee1e87c1884828", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735902, "uuid": "4cf009e2-6a03-411b-97b6-dd0fac94ecd1", "comment": "Malware payload (AgentTesla)", "value": "e4345fe0a71bae9a36b053c1c040a94b010815e1528cbce9c6fa21bbcfb95c8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735902, "uuid": "c2968bc7-0430-4fd4-aa66-9df200b58abb", "comment": "Malware payload (AgentTesla)", "value": "4a0018a89e943f4221b332f45c27cde2aa156aa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735902, "uuid": "49bfe55b-5174-42c1-b681-a76ca150f0a0", "comment": "Malware payload (AgentTesla)", "value": "cc901e5dfd7f8c69ac54f1f9e3e631516577791b758351dc5d39e20e842f1ba20bb9540a4f75ffcadadbddb4f1f6c3ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735902, "uuid": "efa88691-7705-4311-bc3c-7bfa6407e9dc", "value": "9BC4233B2A45EE07F144E69F3B43A2A23B130854775A58BF43E7099BF4359641B9CF0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735902, "uuid": "92eb5514-b46d-49ee-bfbe-b5febc989170", "value": "12288:CO3qDqYyVG2+NoAxuwPa9La2yc2xE4t/s6aSu:z1Yc+9xuwyda2W7lFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735902, "uuid": "68e13a56-8aa1-44c1-bb0b-690786e89215", "value": 578926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735902, "uuid": "524ec226-57b2-4af7-8f11-d043d7da235a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735902, "uuid": "c84ca47f-5b3f-447a-92d5-7e83f2faba57", "value": "CARGO DECUMENT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf04f16d-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620715672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715672, "uuid": "3bde4f9a-7cd2-4745-91e3-f9bfcbdef4db", "comment": "Malware payload (Formbook)", "value": "385e9795fc7599f35a62dd98f9155be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715672, "uuid": "6db1b9ea-f5c8-4ccf-821e-27a70a9a6cf6", "comment": "Malware payload (Formbook)", "value": "e5babdc6daa22f87abe8ec2ed5557bff47d0ca269cec17ff8eb085ae3c250a63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715672, "uuid": "f77abd5d-e74a-41de-8a93-6def632e8845", "comment": "Malware payload (Formbook)", "value": "83b638e8399601626ed84cfd5634c1f43eaddd2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715672, "uuid": "8c93e73f-f022-4d63-a15b-f6d97d81e534", "comment": "Malware payload (Formbook)", "value": "1c2e668908b6c40b46566dddd290808380b67f9f84be0b5c2460d53685c3afc91940cacff354ebc25f51eefc8084ce5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715672, "uuid": "d611a3a1-d559-4d6a-b191-af6de3792fe3", "value": "3105230722E4DA18E77D17B2581669021BF4B245E704EF4E7EE465ECAA77FC08381BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715672, "uuid": "52e3f3b6-abe1-4306-9c5f-e8affde73a3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715672, "uuid": "443f7780-45f8-4fd5-8081-324a6c153b85", "value": "24576:lz+mOfxHVN/fPSChvzXUz4VfxkNAu+Uk:lzVoNqChrXa4Vfxkh+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715672, "uuid": "4d92b1a8-4850-442b-b2b2-4bf4c2b74716", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715672, "uuid": "89197095-a833-405f-b6e8-0efb3652ee90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715672, "uuid": "f51f3ee2-ddfb-41bc-a5c6-83bd708c0783", "value": "WAkePI6vWufG5Bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32eed0b-b20c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620705425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705425, "uuid": "50c39a0a-9213-49be-a635-0d56223eefdc", "comment": "Malware payload", "value": "20a1c8c26483cd566a962036cd678030", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705425, "uuid": "21bc3ab3-f0d5-4e4a-bf8c-90eaf8d2e6c0", "comment": "Malware payload", "value": "e682e8d344d5c4b85d9854cf53d15f18eef8bc80375e62c359430a5a94b0cda2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705425, "uuid": "a1a11893-ee38-4ac5-a264-df219f44c128", "comment": "Malware payload", "value": "10c24608dfd7de4c8993b243ac922aff031fd5c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705425, "uuid": "8af8d9f4-383a-431b-a9d9-37bd060615c6", "comment": "Malware payload", "value": "98e65969d45b83e61fb115a3c0641769d0b1c77daeb96197c81c20bcd144011d5df051f8df4ab1544b50f1516fb959a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705425, "uuid": "4bffb226-92dd-47d3-9a2e-d7ee4e37c00a", "value": "DD81507BF31B48B0DF6E5F3C0E0B8517375C6622034606A60B51799D2E84D9AF574B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705425, "uuid": "b2e54642-5456-4428-ad51-6615af639119", "value": "f2de7cbb8605afa66bc74edd5fd9d0f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705425, "uuid": "009cc35b-8a26-4535-a37d-8493eb1a26f8", "value": "24:eFGSzvb8f0++kpLNXGcRVV1SDSm2oP0AEEPuhhPKem3bVF6tUmqcoJJ6TwudPdch:izvo+UEnj2CaMuhhPK3LKU5JKEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705425, "uuid": "674dba4c-425a-4614-a766-152c30cf3de2", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705425, "uuid": "e20d23c6-1711-44ea-b6ab-13a3e22624b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705425, "uuid": "430c349c-f33d-4c84-a383-3f9d07113d8b", "value": "SecuriteInfo.com.Trojan.Injector8.C4TFE.dGZlOga1iO43TyFaPg.7257.22510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508e37de-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694844, "uuid": "cc7fdfe8-50c6-42b8-9d36-13a7eb983427", "comment": "Malware payload (Dridex)", "value": "d2c1806dc7cf4e2bfab516835254ac47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694844, "uuid": "6b02c25b-5ef0-49a4-9bec-1337855196a9", "comment": "Malware payload (Dridex)", "value": "e7858251aa1f03a0ef3d9e319fc0a6c57681ac4882c4eba682f2ee49fab4f23e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694844, "uuid": "97528e4d-99bc-4ec6-bcce-276cec29a1d8", "comment": "Malware payload (Dridex)", "value": "ce994c242948103727fa682a777778fe56bac2de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694844, "uuid": "486b05d8-9aea-4051-bd3e-f54d57055742", "comment": "Malware payload (Dridex)", "value": "1630a092f6be43c7cd31da1a77a382e12a67c9062299449a506e4b2ea892c5ece4e3791abf79d25d51f451d040295ba5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694844, "uuid": "001747da-10f1-4c48-a511-5b35eb1f1018", "value": "12F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694844, "uuid": "23a626c6-4b07-4ec3-b90e-9d503e97aa0a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694844, "uuid": "57f77351-5262-4d4a-aa12-71a12cc98f81", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694844, "uuid": "dc806e5a-c47f-421c-a662-2c9bf959cbeb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694844, "uuid": "de8b31b2-809a-404a-8353-1aa374d524b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694844, "uuid": "c06519dc-a1d2-4ca8-8d95-19b522de0142", "value": "d2c1806d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e315ad-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620694848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694848, "uuid": "fd378793-63ec-4115-8f51-a8a8d230deb8", "comment": "Malware payload (DarkSide)", "value": "a1e7adff1d6d454481ac1a6d557839f9", "object_relation": "md5", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694848, "uuid": "fa70b64d-8233-4dcd-bb77-51f25bdd7dd8", "comment": "Malware payload (DarkSide)", "value": "e78e37c05ace408d63b3030f63ff9f5a482b8c44f4cb8cea319333936c91defb", "object_relation": "sha256", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694848, "uuid": "ab1f5043-c23f-4019-a499-550e0d0f80f4", "comment": "Malware payload (DarkSide)", "value": "109f3c74fe116d1d332f859b311296bd5003cfe0", "object_relation": "sha1", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694848, "uuid": "98976860-3db9-4dbc-aed0-d552e12c31d5", "comment": "Malware payload (DarkSide)", "value": "158ee84e1d064930c42551531abe4a0b855609b23fe90c7431ba74840a76443315a7f672b58e9b7eeacdf40a834015ef", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694848, "uuid": "7a42f26a-1488-442b-a4bf-75a259c5667d", "value": "71E2E1D26940370CC627A76030E506056A9ACC7B37F976DD3A7C9E32FD46B988C23675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694848, "uuid": "f8f09ed3-d3c4-4c84-9974-12be784f3ab1", "value": "768:Pj44/N0GESDnYuMVSK4JfdZ5RHcx3QEnPeuFc9eI:Pjrv1kufLfHcxZnL+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694848, "uuid": "f8994197-f57a-44ca-8efa-60e99992d9ab", "value": 32770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694848, "uuid": "dba7365e-3ca3-4a38-8f35-2ee42c726141", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694848, "uuid": "22297d3b-e4c0-444b-95f6-9a89efcb789a", "value": "a1e7adff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3856739c-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717137, "uuid": "96ada99e-19bf-45b4-9922-9e8ee23c2149", "comment": "Malware payload", "value": "efc7d9d7dc23103bf17976ebdb444aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717137, "uuid": "29242114-7c51-423d-8fe0-b759d1cb03dc", "comment": "Malware payload", "value": "e792a6e5ab30b5b6ab29e4ac4e4d93c27a6756b6c76f034d39c8174e7770b6d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717137, "uuid": "1aa07f0b-924c-4eb0-a587-ebe357be5cbd", "comment": "Malware payload", "value": "321e4d85c49aa207cfa99ec134d33998961eddc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717137, "uuid": "3fdb454a-3682-4307-86b7-638a8163b7ed", "comment": "Malware payload", "value": "f4710e3d7031f90e5b2433a5f713bbcf4d845121d849d0799c0f77de81a506750809d51ed7b99ddec90b85527aaca62d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717137, "uuid": "7382184e-abc4-4b0b-b1d2-ab02d44e39cb", "value": "D2E209C16F879D4AE8AE25340B9708E053F499F335E7E73F6FE5F096AE9D6058A01108", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717137, "uuid": "4f2875aa-e23d-43cb-9596-d6852f5773d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717137, "uuid": "80caea56-7a76-4802-9f4d-55be8aa36239", "value": "384:cY3skyf36IIveNQ/vusnE7AwBd982JKwMA3fecoseSXJSXwfLFQ6bn8:ut2rfiAwBd9bPTq48T0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717137, "uuid": "fb912516-0546-4c15-8642-1435e5ed3775", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717137, "uuid": "9290f8f4-2a9b-4b6d-a7fb-8399d4385c22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717137, "uuid": "d667f0b9-f3e9-44b6-b857-bf436766851a", "value": "efc7d9d7dc23103bf17976ebdb444aa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95f0031-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723796, "uuid": "3e52cd71-8d8a-45ed-b310-d278df2797a5", "comment": "Malware payload (Dridex)", "value": "63603b26d85307eac3925e2131c7ff67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723796, "uuid": "8cbab8dd-98cd-4dec-b1b0-7f2edb98035e", "comment": "Malware payload (Dridex)", "value": "e7d21f50eb7a436e3210379a380e00c76105ca5707730e2323c84d58e41c76b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723796, "uuid": "249d4117-82a6-4904-b6ec-676a1e46ab62", "comment": "Malware payload (Dridex)", "value": "98a751ae9927c7146b367b83bc83331e70147c85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723796, "uuid": "d0be5c71-2025-4dfb-9107-bed798a25dad", "comment": "Malware payload (Dridex)", "value": "dae6610971390cb8f1c955dc49f0674c56d2c7370ffbf4e9e82ba7a4d904add2cb367d037e0b30fe21053ba2d13f7335", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723796, "uuid": "730cf912-6b0f-4086-8da5-8668cb2e6916", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723796, "uuid": "c85f10b1-4ef7-4cba-b310-ff9b99ede0ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723796, "uuid": "b35d0e85-7621-40c5-aec8-df2b34a1ab56", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723796, "uuid": "e59f5905-7611-40de-8b57-84941ea009eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723796, "uuid": "c6a47bee-9f47-4c2f-9999-143c7d80ef79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723796, "uuid": "ee208a99-9fac-432d-9fc7-546dea3ac789", "value": "63603b26_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d81606-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714690, "uuid": "8fb287f1-15a3-447f-b8fe-0a03469caf4e", "comment": "Malware payload (AgentTesla)", "value": "aaea36a575b452b5d95f8d2d9cdfbfcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714690, "uuid": "def765d8-6887-41c4-b3ac-a799d7bdc444", "comment": "Malware payload (AgentTesla)", "value": "e7e13a17b68aa61a6adf579f4bf9994e92e9cae1788e0161e18969de98095003", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714690, "uuid": "5cf05c2a-05fe-4c3b-8d4d-31ad65ef625a", "comment": "Malware payload (AgentTesla)", "value": "dc9d39c00a1ee61c9ec3ff802ba64c1286806671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714690, "uuid": "7737b4ef-a7b3-4e43-baca-0f892b74d867", "comment": "Malware payload (AgentTesla)", "value": "f9f7d2e0bfa65ec81bd4b8e08788b2e794f8c31a69b8ae783b2792c1c51db56f4a6da4da5134d963d1b63b3a0766cb2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714690, "uuid": "d52e114c-6f60-4eba-b11a-c3bc21ab613e", "value": "EAD502FC755495F0E3575C26A3CF5C06826412B0BA3B6A1F9B6003BA5A17E273E39C8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714690, "uuid": "579d13a1-2429-4e59-910c-967a5124e2b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714690, "uuid": "4057e129-8c77-4bbc-a86c-e61639040001", "value": "49152:RQX5k/gBH5nWpVn27B7G6oa+uYZzvvqXiT9kmrwM9JtmmO5gD0MWbhf2E9uYaK5m:mX5k/yH5nWPn27B7G6oa+u83qX69RHtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714690, "uuid": "8b05218b-0b59-4433-8e68-38caf1e57063", "value": 2852352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714690, "uuid": "01623205-4092-4c5f-82c3-ecf117033f9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714690, "uuid": "9d6ee305-40b0-490e-a79e-4f4e5c718bb8", "value": "Zam\u00f3wienie-290421.85655463_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8557b0-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715405, "uuid": "c42f16a4-d9ff-47ff-8795-883bad69a85d", "comment": "Malware payload (AgentTesla)", "value": "ec10b50eebe1339fd944e82d8e9a726d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715405, "uuid": "9aff92ea-69b1-426a-8d17-e4ef35281814", "comment": "Malware payload (AgentTesla)", "value": "e807e53073a32bb2b0864762911dbf599d365d596f43a9a84e6fffef6784fd9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715405, "uuid": "797900bb-24a2-4f9c-99c9-538f88e4e8c8", "comment": "Malware payload (AgentTesla)", "value": "97886acc7ffec56e259e1afc15e80f3d1a881a4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715405, "uuid": "b34ad89c-c4a8-4551-99d0-1c46e762ef0d", "comment": "Malware payload (AgentTesla)", "value": "1e8d505cee7f08aaeaf02d43e713f358d91f441a0b20fff818f5f2adda62b694b41a1b3807748988b9e662b562f260c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715405, "uuid": "bfcbc052-3bd8-4ec6-b1e7-45b55c8ce3f5", "value": "940523032AF9A668D07D57F58432686487F0F816732AD79D3E8429ED25F3B928112BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715405, "uuid": "e6fd22fc-1802-4f1d-936a-c0b0137a7fb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715405, "uuid": "97d739fb-f28c-4ffb-9c9e-931793cee63e", "value": "12288:wE3yiWQtyGf8Bk2QIUhpeAwJjdRFb/GhZPFSY6Z0eVJxDNrxWnS0md1ildYmaPIb:7VfEWImOjFDAZNKXHhrxWSbildxaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715405, "uuid": "2fa413bd-9f35-47f0-962c-74993604d205", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715405, "uuid": "ac042255-1e14-460c-a692-0d1017f7d438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715405, "uuid": "7a705682-e9d9-424b-bb5b-2896b15dd5ac", "value": "Shippment-2021-05-11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f59a71-b247-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620730584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730584, "uuid": "aecd7610-2c1e-4811-8e2a-34982f448e33", "comment": "Malware payload (Gozi)", "value": "1752fe2b8419be8241ecd08859a5800f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730584, "uuid": "eeecdba3-20a2-4893-ab4d-a0da54e29b93", "comment": "Malware payload (Gozi)", "value": "e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730584, "uuid": "76071ab6-088a-4dfd-a464-5d87cdd5a4d5", "comment": "Malware payload (Gozi)", "value": "eb7346a6d5a53ddaf8fd073f266c64d642b40a7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620730584, "uuid": "52e48f89-ddf4-47d8-b7fd-d9d93e3a5e95", "comment": "Malware payload (Gozi)", "value": "ef6ab21387cd2015e3df6536aa626927bcf02b00b7a033da9272fb526d51907f5a9a8f42ecfc48f1cef035dcf256ef2a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730584, "uuid": "d80c1a2a-66dd-4da8-85f6-43b4c85c0166", "value": "95055D01B7908038F5B759F585BEA1A8693DBEE15B24D0C763C42AEE5635EE0BC30727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730584, "uuid": "7c021e94-dcc2-4ccf-a016-e07927979e16", "value": "dc55991f7b8a912c780d10d352635290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730584, "uuid": "6fdca2ae-1668-46fe-83b0-c29e686b8c12", "value": "12288:mzCoXRvNZrA8Res/TPUOjUUGcqcoWEx9kMGUS6vOV5y4gnuD5wtqqB7ol:udNZr5RLL1AZ/clUnHvk5hgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620730584, "uuid": "e7663a53-405f-4329-b91a-3729c07a3767", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620730584, "uuid": "89a67aca-c4e5-4816-bbeb-faa775225915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620730584, "uuid": "34255dc5-fd64-47f7-a404-9ae57edf27a0", "value": "1752fe2b8419be8241ecd08859a5800f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a80671-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620729420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729420, "uuid": "b3ecdedd-aceb-4e62-a25f-43a53f6afb10", "comment": "Malware payload (SnakeKeylogger)", "value": "1f9ac934c5d6f220178d7ec12e19494a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729420, "uuid": "4d4af1fb-28dd-46f8-b674-f09918762887", "comment": "Malware payload (SnakeKeylogger)", "value": "e81daa14348c2bb2351501bd23162b42b1d6a59b11ed38af56c23812efc8bca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729420, "uuid": "93b3cf66-5b7d-4fe9-8868-154ad41d6aba", "comment": "Malware payload (SnakeKeylogger)", "value": "6bf52e1ecc9748b549aedba099eb0f95eac896c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729420, "uuid": "93cec756-2c5c-462b-815e-2b4f888f9945", "comment": "Malware payload (SnakeKeylogger)", "value": "6bbd8a6aba1ac8f32dd640be9a2453ede9b407ca08b814262ad4eb2f376fb63a3d7edefaf3cfe816b75cd7f57b7ef98a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729420, "uuid": "fbd5e0b8-b24a-446f-8aad-274e2b218f81", "value": "8305022533A86FE2F67EEB3D5460008853FAA406E322FA4DBEE505DD5865F414372F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729420, "uuid": "53f1681f-a04b-4828-a613-3dbeeb10bc0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729420, "uuid": "41a139cd-e4cb-4423-919b-7befc7ffd7e1", "value": "24576:EWuA+DdvhpksZ6+rlklJTH71F6pts2TLAyZYXmq:EbPLZ0nHxF6pR3AyZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729420, "uuid": "6eb1249a-9892-4418-835a-975350ba588a", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729420, "uuid": "08ac5d67-0e39-403d-bb87-e9026fc968c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729420, "uuid": "0aca2815-302e-42ba-a489-72c47fd19fb5", "value": "Octamod 2021 -\u2026P014 New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733eedc6-b25c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620739570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739570, "uuid": "dc940590-ba72-4a7c-866f-d92394dfc8e3", "comment": "Malware payload (Loki)", "value": "f9b046ef14a6bfe1259aa5f806589620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739570, "uuid": "2b2a2286-8965-4e50-ac7e-40b74c9004a6", "comment": "Malware payload (Loki)", "value": "e830e2a1ad32cb10452e7de69516036bb6a6e6c160b7e02479c63bfd33f21cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739570, "uuid": "34ea463e-c27e-4b5a-8088-0d8ee5fcb649", "comment": "Malware payload (Loki)", "value": "23c4e1f08d5819727a9bd2cf1fed66c951d47a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620739570, "uuid": "c574994c-6091-4ebb-853c-bbc24663dc03", "comment": "Malware payload (Loki)", "value": "ecbda1ea9d3ae3666e2e9e4eb2ee7a03551a27b0f1a8cf7c631e33c8bee2997620f9e4c8bbf0a4d2efbf813b58901e97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739570, "uuid": "7922f204-7517-4de6-bd4d-c9827f223cfc", "value": "2A05F131336CAFA2F57E973D1850114453F5F91AE321EA4EBEA909DE0865F814BB2F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739570, "uuid": "f8432d09-c4d8-4c8b-9a2b-3dd628f6b3b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739570, "uuid": "df0a251d-dbbb-46f3-8a8c-6ca0eafa3426", "value": "24576:6XrWVCivX5pOANxoiAZ1IxZ5yjRlnbMpi:6SQWxcZ2/4VlnbMpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620739570, "uuid": "6e0e5305-a395-4c75-aee9-32ef3e6a4a6e", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620739570, "uuid": "a8b22d56-35ea-4ba1-8fa5-57e84d94461c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620739570, "uuid": "e8cdad91-56a8-4f7c-be3b-d69fba42eb52", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01196fd-b2ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620774139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774139, "uuid": "0daf1cf5-8ea0-4ed7-992f-9eb97c6d6392", "comment": "Malware payload", "value": "0a7dfea22752e092765b481f3b375f6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774139, "uuid": "7227cf5e-26ca-4ea4-aec4-b47e4c1e819d", "comment": "Malware payload", "value": "e9224f0b0ccdd7a629413c1b7755184e0303d799b95a6245e6b053c622da6d64", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774139, "uuid": "006ad017-2977-4a18-a316-55996724a643", "comment": "Malware payload", "value": "b47944a2e302c6dedb244785b7ea477bc516f49f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774139, "uuid": "fc6fca0a-172e-4250-bbec-0a580c9d2403", "comment": "Malware payload", "value": "8974583565b057eb8d7bfcdd3eafd82efd14ee291f208671f358a1105d6f801934e6c98540b496f5454608d9790d8ea6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774139, "uuid": "49684272-efa8-4932-9e41-aa960fa0bf1c", "value": "14F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774139, "uuid": "b26e596a-a518-4433-8533-a5b4f66d74a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774139, "uuid": "d9dcb4a8-b601-4cbb-a81c-120f3a38ea5f", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620774139, "uuid": "84f5d157-f2b7-4b33-b51c-1e58dea37045", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620774139, "uuid": "3e785d59-7f2d-44c1-a150-8379b810f8c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774139, "uuid": "6e938300-815a-4b26-aae6-382d21f45113", "value": "0a7dfea2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25ebc7b-b20c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620705424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705424, "uuid": "cba9a6ac-c4f2-438b-a3ba-ae641638876c", "comment": "Malware payload", "value": "3bf56b6d3738067455e17250c998faaf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705424, "uuid": "f95637a9-603b-4359-907b-af2928ca1823", "comment": "Malware payload", "value": "e980adf84f06b5c798856f2db49bdd70542c5998d5be01a27dfa39bb128d1d7d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705424, "uuid": "9a7fb150-cb03-443a-bfc8-260dd1ef526e", "comment": "Malware payload", "value": "1f5c8c0718fab2ea79f54541f88c17a6d69b6ab5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705424, "uuid": "2aadc10e-4d2d-4821-9d46-f5a24841bd1a", "comment": "Malware payload", "value": "1be9a40d9d7aeb7cf6a8465ee33d8bf97e245347d81d5df7d7e8e6c1ece14fa9e38e225168efe422ce95a94ce2a28b5c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705424, "uuid": "67421913-3a1b-4a43-a11e-631d387fd849", "value": "DE81307BE71B48B1EF5E9F3C0E5B9627770C721207860AA20B51789A1E84D8AF534B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705424, "uuid": "7cef4ccf-3a09-464a-a85d-39db96b87c3c", "value": "f2de7cbb8605afa66bc74edd5fd9d0f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705424, "uuid": "d20a47ff-d726-4114-9b02-8e9d284ea28f", "value": "24:eFGSpDbA8++Up80xVV1SDSmVbEEPuhhPK2m3bVF6tUmqcoJJ6TwudPdcnz:ipw+k8Xj+MuhhPKvLKU5JKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705424, "uuid": "88fc4b8e-fcb8-4242-9d02-c86141dca6f3", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705424, "uuid": "5a856b70-c206-47f1-8e0b-9bd5b4fab3e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705424, "uuid": "67ca9b3c-c0bb-42e7-9e05-6b3fcddd8056", "value": "SecuriteInfo.com.ArtemisTrojan.17478.25212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55740e14-b26c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620746392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746392, "uuid": "2d67249e-2fe4-407b-9e6a-f1ef63baa426", "comment": "Malware payload (Dridex)", "value": "5bcdab4ff6b87ec09850a81bb992a58f", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746392, "uuid": "326b558b-0e81-4101-b05b-7535d3cf6d3c", "comment": "Malware payload (Dridex)", "value": "e98abe41124d07ab54cb2bf7115e61beb856eb7b82872e0a1bd79735bf8b8259", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746392, "uuid": "f2fb7151-7067-4faf-8fb9-e81bdf551e7b", "comment": "Malware payload (Dridex)", "value": "842507413eaaac729661715288cdd9e49828022a", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620746392, "uuid": "9e75b943-9d78-4e6a-bd6a-1ad7e7bfeb59", "comment": "Malware payload (Dridex)", "value": "5e0ea5ca163d78b1bb024501fd1ea5f999e598918da515e1dc186753e46ab63e674075ee2568b74022e33013074ebcc5", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746392, "uuid": "871c9ee5-5991-4024-8900-f37abdf6ea96", "value": "F653F196C304F5A8C2978C7DA41C2AD1D76D39869581E1786F58D1AC38E12B30B8BFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746392, "uuid": "461676bf-51f1-41f7-aa20-b349fd1b5843", "value": "768:F7Wjul2WJdPXCpPyFNgQA9B0r6u3kWkH+9dN3qGZFIsQHSIzBlOfelYU5qdc6Z8S:BWjgPqpqAD02JWke9/3qsQyIz9YUMdJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620746392, "uuid": "732ffce6-c0f5-4392-9fa7-9c334162186b", "value": 64018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620746392, "uuid": "8c83594f-1ea3-4d58-a2ff-6d33b9e157eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620746392, "uuid": "8eada06a-2db6-4254-9bbe-f4fbb068c993", "value": "Fattura_01120879.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49c41dc-b261-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1620741935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "a1768851-cffe-4dff-b1e6-ec80ef7f0c1b", "comment": "Malware payload (CryptBot)", "value": "a2eba5dc176f110dd7f3658fe3efa3a5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "7cd5c503-071e-47d4-a2d7-ad311087f5b9", "comment": "Malware payload (CryptBot)", "value": "e9da1da3a4fb2050b9b17f5dbb1dd5f334f22637fc8186052d152cc631839f9b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "aeb7e581-1617-460a-9e48-f193499991a3", "comment": "Malware payload (CryptBot)", "value": "81f10260bd4e31981d53316968ac1e155b87cdc0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620741935, "uuid": "c9a63463-e610-4475-82f2-ee145ff07a6d", "comment": "Malware payload (CryptBot)", "value": "2d3e841f5a1fa2331d08a37d82a8f6518b14b6360a2beb2523fd75b9807d1fb5ac08c790568254e6be9f7389260e1f5d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "7bc1c3cd-eabc-4ecf-8bcb-8fbebe9ec75c", "value": "DE74AE307790C035F5F721F849B6A37DA5297EA05B24A6CB62D42AEE47246E4BC31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "e1af3b59-7f10-493f-a88f-ea3364777f49", "value": "e282e474b4b570377c09595ac5d79ff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "c7421ddf-ab5f-47e0-a490-cb864e381f7b", "value": "6144:j1QD2Qq01XrQuh3/EUOor9dE4nF72n3R7rGEGQqfK:mD2QF1bQm/TOor/Ei7QB4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620741935, "uuid": "ce3e51b1-e585-442e-aab5-f4da2fa9aba1", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620741935, "uuid": "5197b8c3-e469-46b1-ad8a-40acc5f034e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620741935, "uuid": "2ec232e8-caef-4d92-a150-960e3ae5a9b7", "value": "a2eba5dc176f110dd7f3658fe3efa3a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bf3bd3-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698475, "uuid": "1374c8c1-de3a-488e-bdc4-72417da02d3a", "comment": "Malware payload (Dridex)", "value": "7102e88db32782a6caf8c73e177513b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698475, "uuid": "f1c05cda-7cc0-41ad-8a6a-d299d22c614b", "comment": "Malware payload (Dridex)", "value": "ea0b1923c37e9c0f36b6b70d94daaca3ccb4e5775277c18a3cb701887e3db911", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698475, "uuid": "f7d83e23-cb0f-407e-9053-f55299e7492c", "comment": "Malware payload (Dridex)", "value": "5cde5ff7a02b1cf5018d2e9458acab1e58fd5ee4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698475, "uuid": "bbe9889b-b60c-415d-b6b8-e9cd9a3b1b87", "comment": "Malware payload (Dridex)", "value": "f387b429ba42a28b40ff941e12a5834c840e9b0ad3183bfd93b9d2d94b57e4df4d9cb5cd9369d42a0c0a28fe499e74ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698475, "uuid": "f0d3ef02-6d71-473a-9858-8ac74784a917", "value": "49F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698475, "uuid": "c7289e28-33f4-46ba-a332-9fdcf5419ee7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698475, "uuid": "3e744058-c688-4c3b-9642-5a475cb954ad", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698475, "uuid": "6a5a470d-769e-4a8f-a83c-0d433f3cfdaf", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698475, "uuid": "2482310f-a4bc-44b4-9d71-086ec5fb97d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698475, "uuid": "584992d2-b927-4eaf-98ab-e3ce6fcc66b9", "value": "7102e88d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989b2621-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620728895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728895, "uuid": "b1d512e0-7ccf-40ff-b951-5678e8e88616", "comment": "Malware payload (Formbook)", "value": "96fc6b340885ae82ac19228903cb2548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728895, "uuid": "b0bb3c93-0fec-4ca9-ad78-687df9a92ad7", "comment": "Malware payload (Formbook)", "value": "ea66d2f582f9da718979a56b628e19a5712e41e979808cb84a8cb427fbe1ab30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728895, "uuid": "43acc7c4-e249-41c8-bc36-25db3a59308f", "comment": "Malware payload (Formbook)", "value": "5f63c934e018aa83f51f7f7f516fb5d195ab27e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728895, "uuid": "5e3c8303-1fdc-4444-96e1-9fbb149a3018", "comment": "Malware payload (Formbook)", "value": "b81faa483c418ae8b843dcc8e6c5bd3d4424bd19edd94ca03f664c7aca20d33dacab6f9244d9909ddd9e1df831a63c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728895, "uuid": "630807a2-7aca-4304-b767-c3f868d515ab", "value": "243401A1EA82C5D3D96442B11E37DF6B63E1CFA445BE871713F2B91AB8736D2400DE48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728895, "uuid": "b17f1ffc-0ef4-478a-b5cd-9724f298c4f9", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728895, "uuid": "e5966374-d2bb-4ed6-9376-c22084330b2f", "value": "6144:O9X0G9W7qKqm7suDL66dLtd0QKX+OTtHBicQWLGgCu9:g0O0q+suH66dRfO32gD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728895, "uuid": "b4ce72c7-f1a7-43f8-9c4d-4a8427b40abf", "value": 249638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728895, "uuid": "a2a28e84-da9f-4072-a8d0-4ecb97a74219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728895, "uuid": "777aab7b-40c9-43fb-baae-e17095e520c6", "value": "PP,Sporda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cea1c1-b250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620734583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734583, "uuid": "9120cb03-b5ee-4be2-bbf0-78478f321e01", "comment": "Malware payload (Dridex)", "value": "2c5c9dd6d93592669f5825a7802745bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734583, "uuid": "84cf5364-8708-4de6-9cd6-c494dbb961f9", "comment": "Malware payload (Dridex)", "value": "ea67a5e7103f219bb90bd81baa0e8f1e6b2508af8f763149c6da631c12d4e4be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734583, "uuid": "14aba9fc-deaf-4a82-8de7-a84571ae12e5", "comment": "Malware payload (Dridex)", "value": "d5ceda3850d2408071546f1201f7ffbe03b95896", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734583, "uuid": "c5cffb46-3620-432d-964a-fc149e4f9793", "comment": "Malware payload (Dridex)", "value": "b8e1b4e04566b6f11d6f2958140d4f0b48bc479f0ac7bbe45835f42cdcc931215fd40eee964acd6cccb830f23d8fe55f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734583, "uuid": "9f784ee0-c680-46c0-9797-c3dd1b7ac5a2", "value": "A8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734583, "uuid": "951707c5-05eb-4d51-914c-006fadc81062", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734583, "uuid": "fa5bd5ec-870a-43a1-a653-535360dbe4ed", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734583, "uuid": "8653b22e-8329-420a-b5a2-e74cecd0d0af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734583, "uuid": "15febab5-4f39-45c4-81f6-2e9d2bd92cde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734583, "uuid": "54f9f1ff-4f4b-4290-a788-d877551e9917", "value": "2c5c9dd6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d1d062-b294-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620763552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763552, "uuid": "3ebc455a-a48a-486b-9ff1-963de0320076", "comment": "Malware payload", "value": "90ce775479f50de5b6cb99ca1685afa9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763552, "uuid": "0ce9fb08-283f-4ed6-aecc-d2951b02da2c", "comment": "Malware payload", "value": "eb01c94b272be907d61cb27852eb3b49dc3e889011e8b59d7860604af9d04982", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763552, "uuid": "ee011302-43b6-40b0-9810-50683a0ed2fd", "comment": "Malware payload", "value": "b78456081aee4ddcbf74bc6a855be18f51adcaf2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620763552, "uuid": "f93331e7-df4d-4e05-80c6-fcbd7482067a", "comment": "Malware payload", "value": "8a2dcb70a3b16f49d8589a03216c61ae33483099671a0ce5258c9c2a3acb788e17910eaa61c22a63c89d226783cc751b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763552, "uuid": "5848a765-d4ab-46af-a182-974a3d7dd5f0", "value": "5FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763552, "uuid": "193b16f6-4edd-44c6-9704-4f49265504dc", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763552, "uuid": "495c82ac-8c00-4ea0-b0c8-bbf74755c8c6", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620763552, "uuid": "398e4eb7-0697-4f55-9e0d-fbca93de969c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620763552, "uuid": "3e04d88d-0f5c-40a9-a7b2-23ab7fa72f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620763552, "uuid": "5270b7ed-7b0e-44a0-8812-112482116e33", "value": "90ce7754_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afab96f7-b244-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620729363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729363, "uuid": "541e73f1-f783-4bf3-91b7-c2fb75ab3127", "comment": "Malware payload (AgentTesla)", "value": "cfb6d7cd819b64c8c3088e5c9004712e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729363, "uuid": "9d575292-74c8-45b3-9017-a3de1ec4b3c8", "comment": "Malware payload (AgentTesla)", "value": "eb0801ae0c61475a74fbc4bbe7c89df02fd2e2473f80b31e562af202f4dc8378", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729363, "uuid": "004dec04-a9b8-4b7b-9f4d-36a05e69a121", "comment": "Malware payload (AgentTesla)", "value": "4f233fd6e38c06f035064665fe15e6374bee382d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729363, "uuid": "15473e44-b313-4bed-a666-b7ceee8b0af0", "comment": "Malware payload (AgentTesla)", "value": "1531c409d1e61f78ee410f504f2e2eaeb3abe80fd3c89f1ab02c20edac31aa338da4604a3e28cdda0f9d233a144e84bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729363, "uuid": "8c9f3a4b-8388-4232-9b2e-3ba65952866f", "value": "122502313758AFE1E9BEDB7D5460018863FAB406E322E98E7ED905DE4821F814763F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729363, "uuid": "e969c2d8-5bd2-4772-a224-147f46140bc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729363, "uuid": "9bb77c5c-b577-45af-b382-e75103630aea", "value": "24576:QM6KqmKvlbuxvPrkLCOhHfmdCDfzleGOemNBTyC4uQC2g:Q+7xPYmOhHukDfnDmNFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729363, "uuid": "a4997c5a-2f25-4ad1-8726-67cec08beb09", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729363, "uuid": "e1f23b5f-d674-40ac-9b17-37b2767fad8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729363, "uuid": "61859ac0-39a9-4f52-807e-4aab08469536", "value": "Transfer1096-20_736289_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79e2a67-b1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691259, "uuid": "26be7be6-a4f3-44a7-93c0-c2e4b616882f", "comment": "Malware payload (Dridex)", "value": "8e7ada0a6585129195dcc71aa8289de9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691259, "uuid": "52254f52-2350-44a4-b730-1eb133bcd25e", "comment": "Malware payload (Dridex)", "value": "eb9066593075ce7257ad1084e0e3b74275583ae5e1c36bb35f7ef0a8e8b593ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691259, "uuid": "267669fd-d178-4971-a217-c45696e280a4", "comment": "Malware payload (Dridex)", "value": "5f06de57f1739a3dff76e5221868b66c1a00485b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691259, "uuid": "3b710705-e076-406f-a328-8b775c6c934d", "comment": "Malware payload (Dridex)", "value": "5892b82605dbeb6df0908b620c9742878fc6eccba822ea91d17f1864b6fab6acb4b648146d3cce477a263b2e1e14b837", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691259, "uuid": "3fd1368f-24b0-4429-af2d-d5beb8b41519", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691259, "uuid": "1ee9acbb-dda1-4de6-bc2b-9356488d5986", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691259, "uuid": "ea0414a3-2507-40f9-a5bc-ecd979c93dc9", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691259, "uuid": "5fde4c6c-13d9-4b15-9570-adba9fb55949", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691259, "uuid": "04734551-3f79-4e94-884f-014208ef1c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691259, "uuid": "47f46cc6-7837-489c-8b14-154a4bfddd96", "value": "8e7ada0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e0c6ef-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705676, "uuid": "acad6b0a-6c84-4d4a-817d-ed952cb71e3c", "comment": "Malware payload (Dridex)", "value": "60390326eef5b1e1b8f37015fe176ae5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705676, "uuid": "3de7f53f-66e3-4305-bd35-65284fa0388d", "comment": "Malware payload (Dridex)", "value": "ebecee6e599ab7c4d2a6f5b26c8f45949ed292580503f33b9103311a78f33eb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705676, "uuid": "cb031e83-055d-4186-b696-cb25f0955b2f", "comment": "Malware payload (Dridex)", "value": "c8d3dce2b9d48c763097932b69e86e050af4f8d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705676, "uuid": "35b366f2-dde5-4ec3-8253-aa7b7df94085", "comment": "Malware payload (Dridex)", "value": "92c0758da307ac1f042e12f8479474418fcf9e62c9f482f0c31d13ade5fe6620a44d6ec4a79a2d750825cbcd4df77480", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705676, "uuid": "f8d24e94-29ad-440a-aafe-95d60bea03be", "value": "75F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705676, "uuid": "007df909-b4f5-4613-b17e-c26c3925fdf4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705676, "uuid": "4ee095fc-670e-4e3d-b1bb-2fe73395a3fe", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705676, "uuid": "24d2dcee-5113-4478-be14-3e2d81dd39f2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705676, "uuid": "2db0717b-b208-461c-83b1-d1900f8c087c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705676, "uuid": "824d726c-81ed-4642-96db-742260020a31", "value": "60390326_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8670492-b239-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620724734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724734, "uuid": "701c0b95-78c4-4910-9a57-09b0d3f669a8", "comment": "Malware payload (Dridex)", "value": "bd678defa06ce86617cc10d3d1a85439", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724734, "uuid": "efd089f5-cc60-45dc-80ec-0c572e5f31f0", "comment": "Malware payload (Dridex)", "value": "ed2b1e02109091d6a6220ec5554c4c54e2c571d0aefae26787d5d521f06aef31", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724734, "uuid": "af8fb702-c436-469b-86af-043c65435f65", "comment": "Malware payload (Dridex)", "value": "32a486d76f08d9f22c137ffc0641ef4a255f99c3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724734, "uuid": "707eb55c-571e-4f2f-bcbf-67bd4eb5abc4", "comment": "Malware payload (Dridex)", "value": "8edd0d8f211f4d7c0f41166dcfa51c58fd08e272a183219443f1080defc7994f5ae27a60a822178f2878679ca9b7200c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724734, "uuid": "b0c3fd3c-a975-43eb-b937-ead2e377e22a", "value": "50F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724734, "uuid": "87f49840-1c67-49db-9cd4-373a1b26ee83", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724734, "uuid": "d46f2782-ab79-4746-8e46-d8ee42ce554b", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724734, "uuid": "566c1112-2fb0-415a-9481-475a089a2107", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724734, "uuid": "0c8d829a-7eaa-41ec-b6fc-427d64daf65d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724734, "uuid": "9237be82-a762-4059-9031-ea89340a634d", "value": "ed2b1e02109091d6a6220ec5554c4c54e2c571d0aefae26787d5d521f06aef31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c8dc09-b28b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620759786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759786, "uuid": "2f9ec175-6339-43a8-9bcc-253ccec58152", "comment": "Malware payload", "value": "996c835d3e547e8ba78bbf59d8cf72e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759786, "uuid": "59258008-0512-4d67-88b5-b7c5a8fce34d", "comment": "Malware payload", "value": "ed7a3ed0aeb2f3bf024f8055eb5617880fffc6a81d8b7b7d8f54159bf5e28197", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759786, "uuid": "89b81b01-1409-4ed6-8691-228c11b4ca7c", "comment": "Malware payload", "value": "f35793858a5e347cd046636ac31722abcd5a442b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620759786, "uuid": "3940754d-8e50-4013-9a0a-b1915063a0f8", "comment": "Malware payload", "value": "0931a34330c2da2db15252b1bcdf9b12f5eee71654a0e534c37b0cdde350c95ecdc58080839228233a10a783c5188801", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759786, "uuid": "8019f7b6-65d0-4806-801f-6100f8f1da6a", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759786, "uuid": "f24227eb-3be3-475d-a590-71b22a851070", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759786, "uuid": "0476faf0-e77e-447e-9480-c14811ff3c74", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620759786, "uuid": "4f1cb67f-965c-4504-b53b-d63788a7f8b6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620759786, "uuid": "59665d23-dbc7-477b-8567-e941a86f89f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620759786, "uuid": "69727749-be58-4c93-853a-4b8e0a4abf67", "value": "996c835d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70537d33-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720238, "uuid": "40970359-ab1a-4a0a-ba17-f4e232174530", "comment": "Malware payload (Dridex)", "value": "7377f8147da7628cea7cebce1d8cf741", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720238, "uuid": "e813a617-8fe5-49c2-8009-3a1216f3dce8", "comment": "Malware payload (Dridex)", "value": "edda2f5e799ea7606296658eb633e670d2589cf585e717394a0e0b266433731a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720238, "uuid": "984a0390-2dcb-42dc-a541-3ba157f18093", "comment": "Malware payload (Dridex)", "value": "2472ca652a7c2c59e76d19435cfde1c9b1f7b463", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720238, "uuid": "0c4af0dc-d4a7-4349-8315-fcff3e2dcf9b", "comment": "Malware payload (Dridex)", "value": "d86227f6dd6054464fe01ab4692d030c6d9672ea72ce561c9d48e1f7ef13cf3f8040b3d8805dd62d58f9f5479a20c6fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720238, "uuid": "24bd835c-1af4-4f71-8875-08c4e6aa3a4a", "value": "B0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720238, "uuid": "f3bd960e-3ef4-47da-9959-d0265412abf1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720238, "uuid": "dc49f2b9-05a0-4376-ae13-6238848562ba", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720238, "uuid": "60feca40-2a4e-419b-aa2b-f74774af6d94", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720238, "uuid": "385dcc1e-bbf1-4232-9f26-91a62b28ce29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720238, "uuid": "863c62cf-bc6c-456f-8f77-4610175affa3", "value": "7377f814_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f4f074-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720091, "uuid": "663ec4bd-d8f7-4fa5-8d3d-3edbb7a60751", "comment": "Malware payload (Dridex)", "value": "364b235a65e875e291bb2a4eee310f38", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720091, "uuid": "6b61a513-86ed-4127-b7d0-24f7aceacaa2", "comment": "Malware payload (Dridex)", "value": "ee24170401cbc8628516b7fd8a342cf0f0c1b46f340fca67aa51c93055225e3b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720091, "uuid": "c642270c-b131-4a92-914b-631c35bc2d3b", "comment": "Malware payload (Dridex)", "value": "0a9024a582a742145878d9e41a6f6d44e5991703", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720091, "uuid": "911e2aa2-6850-4bbb-b4c5-b2d20f9c296e", "comment": "Malware payload (Dridex)", "value": "5c87d15a14cb29d946bd8002f200d5ab3ee8acb170069b46ddd4ecae03381e1579446b549907c11b52364149a6fbf2bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720091, "uuid": "819dae31-76a6-45c1-a254-f19e957cf06e", "value": "7BF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720091, "uuid": "34725ae8-f62c-4e26-b6e8-d924dadee8a9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720091, "uuid": "3d52a561-aade-4fa9-9ae8-70c833b3532e", "value": "3072:qIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720091, "uuid": "c37298ec-7d7b-450f-803e-cf50e59557f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720091, "uuid": "c2ee20e4-4072-4350-b1da-a51eaef6c703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720091, "uuid": "b027c61a-a021-4562-8615-a74639a1876e", "value": "364b235a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc22120-b1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620699695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699695, "uuid": "2feecfcc-a5a2-4880-adea-4871cf1df843", "comment": "Malware payload (Formbook)", "value": "835b5f993671d5efdc1dd542152618cb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699695, "uuid": "b86c816a-e0d7-4185-b9e1-4e923d1bc379", "comment": "Malware payload (Formbook)", "value": "ee3775bbabe2fa2c0e514e2e8f35c160af535f3437d73d341f8b6bd7fd32e5e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699695, "uuid": "926a1e50-2c10-49a8-b4a4-5f25a0c49b63", "comment": "Malware payload (Formbook)", "value": "8920d7d5fb704102af17505742f2bf7226659a07", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620699695, "uuid": "7787e0d1-56f8-4293-b17d-7673ef714428", "comment": "Malware payload (Formbook)", "value": "9fa6bf0463b5a4fd28cdba977bf56352a4480ef69153c58a7eddddb95466cc1d31ec2fd70d0e1f9631984fbac8665d7d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699695, "uuid": "9d8c9cc0-3499-4aa6-8d48-70cc648fe157", "value": "BFA59C249F9FD61D757B4DA42DEAC32E16922E71BEB988C0691800431E377C45B89FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699695, "uuid": "04b0c258-fbfd-4c4a-93d1-59029fdaadd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699695, "uuid": "39cab9ea-aa40-49cf-88e7-1c17963b11a0", "value": "1536:SQC7g0e8tyUJDr/XP0TWMQb/mTk+LWrtH1dKB/uEp8Bgi2m2F6/bEFzq2+jyYvLq:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620699695, "uuid": "687a8edc-0967-445e-8b41-d3eab07d09b4", "value": 2200064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620699695, "uuid": "ec5c8c7c-daab-45c1-9039-b83aed2eae16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620699695, "uuid": "dc768199-cb72-4301-ac9e-b772357b650c", "value": "835B5F993671D5EFDC1DD542152618CB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0702e3c-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698495, "uuid": "856241f4-1a26-4261-95e7-5b853b1c09e2", "comment": "Malware payload (Dridex)", "value": "b489bc96bd61437761aed6bbfab9a438", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698495, "uuid": "9418f8b0-62bc-40e6-9889-97b235c0a496", "comment": "Malware payload (Dridex)", "value": "ef26bc86b01a60210e3e40acc28c4e9c100ae400b35ef2aff992445fa1eddc94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698495, "uuid": "06344bfd-5e2a-4d74-95b5-5fc02698f706", "comment": "Malware payload (Dridex)", "value": "38d9a72660d99d9469b6afb6b5902395b2051b52", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698495, "uuid": "62a32b06-efc3-4392-9bdd-7b45cb0580cf", "comment": "Malware payload (Dridex)", "value": "39bb3e139607bf186c68374bb31860507da65f7ba5d802ca0bdc2f5a817abe24d31cf3abc0ac587628485b5094735b3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698495, "uuid": "e53eaea2-80b2-4bfa-98ed-011212ed2f75", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698495, "uuid": "4064f8d0-e6c4-4e66-8ef0-336f53a6254d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698495, "uuid": "29a84655-b115-4af8-928c-07fb4e961931", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698495, "uuid": "f9decc52-23c0-480e-b655-d965020049f2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698495, "uuid": "7147efd5-814a-4b8c-83e3-70ec431a4c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698495, "uuid": "8212d2b9-246b-4b12-b706-e7f2b48ba574", "value": "b489bc96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5b237d-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691299, "uuid": "b2e441f0-6f8c-406a-9f97-ae834ba15d3c", "comment": "Malware payload (Dridex)", "value": "b9f5b9e2b523cd5d51d2f83fbaf4b839", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691299, "uuid": "e5c858bd-f0e5-4f24-bfa3-65cd2fedae82", "comment": "Malware payload (Dridex)", "value": "ef3aae9385805cc2ecec8f58ef0aa414d00e0829ee83c8cc18035475dbc04b99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691299, "uuid": "c000c63b-e77b-48e8-ad32-a429bc5d5999", "comment": "Malware payload (Dridex)", "value": "e7e82c24ad5fbe64e57e2dbd4481753164d40bbe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691299, "uuid": "bff8cd3e-a9a4-4b75-a8f6-f7472b5ddc80", "comment": "Malware payload (Dridex)", "value": "54d1a4d368c8bfa8147b34e1216f9ec328a23c18f9eadfae4d6d10aec0359ed30b7add64a1547ddbc8d42fd2e67d32f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691299, "uuid": "dcbfdf76-842c-4997-a2d0-891345581c12", "value": "FFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691299, "uuid": "054983f4-dea7-40d8-ad2b-04f5a6d34c42", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691299, "uuid": "6e1ef2bb-2533-48cd-8c89-10b4caad19e4", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691299, "uuid": "838465a3-5b2b-48a4-903a-8060f2e2e7d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691299, "uuid": "1039541c-b429-4396-9190-5342907ce2d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691299, "uuid": "31f16a76-5ed9-4581-8f0a-35d66ec145e8", "value": "b9f5b9e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce351a78-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728985, "uuid": "48acf773-b169-4006-9329-fc42ad2d6fcb", "comment": "Malware payload (AgentTesla)", "value": "7e6a19d305a690e887020b9fe1b57488", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728985, "uuid": "9962e407-1c48-4579-9af2-54a06faf4867", "comment": "Malware payload (AgentTesla)", "value": "ef493fe2688db7c97fd7e0af12bae0b42aeee9c1c7ccf241865e1cfa5cb50cac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728985, "uuid": "46c0ed6b-3d1f-46b9-ad47-fa5e58a5f35d", "comment": "Malware payload (AgentTesla)", "value": "a283a4245b4b0b979ec7e63bda0fa41725b7adec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728985, "uuid": "df0a9e23-394c-4574-86f1-eb704f7ff4e8", "comment": "Malware payload (AgentTesla)", "value": "38d15161b68c9e5134f051b3757f5d0fcf6b93475aff68294ccf6229bccb9c0be49413730480e636510ba4a89ee4c3f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728985, "uuid": "a880f508-9eec-4fbb-824c-41c661aaa369", "value": "170501B053A51F67D7FC38B9E412D2449BF691832216EFD93EA810EE11D3FC10B9A919", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728985, "uuid": "f2b294e5-0417-41a4-b233-1e39e4b33554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728985, "uuid": "7fe37597-fc4c-4d0e-90f6-8e8736ea5b34", "value": "24576:Gr/fPAMeFLAMEy8psPR7hu14clhRZkHUiUaAp:cHPAMe1Flhutlr6TAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728985, "uuid": "3574ab34-1834-4c98-bcc9-9cee585e0729", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728985, "uuid": "7b818bea-53bb-404f-ac51-c4e8c4eba845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728985, "uuid": "2b50facc-3872-49d1-8f71-252658b84cc4", "value": "vkFhiUvXw8joCXn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ff3118-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715303, "uuid": "8642ceeb-761a-4ca8-bcd3-aa46bb865f7d", "comment": "Malware payload (AgentTesla)", "value": "e605817ed935ee0301f12f5e8c72d72a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715303, "uuid": "6581cd33-c315-4a6d-91ec-8bd657277c09", "comment": "Malware payload (AgentTesla)", "value": "ef84b2ff04124e92bb1f3cd7d7ea4f8c61d130b0171a66586fb72ce46a28057b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715303, "uuid": "c576eaf9-3674-4987-9791-16efd9eec91d", "comment": "Malware payload (AgentTesla)", "value": "3733b3a33456e6aa9d604c04d1531848ccd0a77d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715303, "uuid": "0fd76741-0621-466f-9a21-2c3b5572c876", "comment": "Malware payload (AgentTesla)", "value": "797042e490d2b32b8194fce9b44fb98cf588d879a03018ba694055dc4a174b73a657763939493c2fcca9a7768b2e3df6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715303, "uuid": "c1338663-1764-4f7b-8eb5-5c3d15f4e385", "value": "3EC40146BA049011C286593ED8E6457107B3AF825722C9573CFE3F483B3BFEA665B25C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715303, "uuid": "876d7184-60c5-4cd4-9683-f73ce6b9b493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715303, "uuid": "a03e60b6-9ca8-48c9-b6bf-7b8e529cdc98", "value": "12288:ZpHFMw7Y9MA59CyMAn0miosI5lKkQNuEVVpQngbRgd:ZpH+w09tVuoHKkQoNngb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715303, "uuid": "778c3364-6341-4a50-a2f7-8e3bf962081f", "value": 586152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715303, "uuid": "03f55b8e-dc0e-47ec-aca6-b49962d54531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715303, "uuid": "da07c312-a521-4962-8e8f-00eedf579860", "value": "PL_056_06_713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab656e75-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705734, "uuid": "47b75a27-ba09-49b5-a041-296215bb51e9", "comment": "Malware payload (Dridex)", "value": "f3881dd86bb241b9888a0701af09afc0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705734, "uuid": "d7965b1f-5fe0-4ccd-9acc-9c3f4d8f0132", "comment": "Malware payload (Dridex)", "value": "ef99fce23524d21b45050f270ce930f95af23fa993954c5b70ec99a34d49f8df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705734, "uuid": "bc6d9ea5-7aa6-4539-a1aa-71ef650664b0", "comment": "Malware payload (Dridex)", "value": "ef8e78f70d5c67a6edd62b2f109c76d99814c146", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705734, "uuid": "ddba0882-ff85-4107-a964-3204665f0785", "comment": "Malware payload (Dridex)", "value": "b3e42ac9161cea5a2460b342529a5436c8b85a788aa571b23b75d06cb4b49e3b2201a862a031e07b0ae975eeeaf46311", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705734, "uuid": "3fa10211-58fc-4c77-9b51-7d196b1bae46", "value": "75F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705734, "uuid": "cfe7b7eb-b885-4094-be0c-17e688b25be6", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705734, "uuid": "5be9061d-72ac-4dcb-8d6b-01fcc8dd10a1", "value": "3072:Nesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLM0:54+VZQpt5hyPsa1ekiEf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705734, "uuid": "d221c18a-e903-4c8d-a557-f22642d5e731", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705734, "uuid": "453839fb-b1eb-4e7c-9de0-549c96bc7eac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705734, "uuid": "047da6be-62ea-4581-a50c-c0f61ce35559", "value": "f3881dd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48c7315-b256-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737076, "uuid": "6728fb05-a936-4c84-9ff7-2e85076efed0", "comment": "Malware payload (AgentTesla)", "value": "798cb8a4ceae24a7a2fd213deb85a107", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737076, "uuid": "a1a40214-066b-4a99-9eb7-f3b4c7736d11", "comment": "Malware payload (AgentTesla)", "value": "f076d51c4fa09d0e318d43f41560fa50b8c4a4f327effa8aeafedf947800e4d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737076, "uuid": "067373ec-e7fe-4b08-a38a-4eeb95fb0a9c", "comment": "Malware payload (AgentTesla)", "value": "3d7ec487833c318b475818cf771c2af165b6d82b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737076, "uuid": "4a8f3198-dc47-4d5c-8030-d9b9e89c111f", "comment": "Malware payload (AgentTesla)", "value": "436a757d3dc1a43faec0d60b5f3492cf7d867d98a297015190668c97f7ea05bd93856d1380242836bd5eea4ce7742652", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737076, "uuid": "06060043-e09f-42c1-9262-14261601d816", "value": "6515022333A89F62E67DD7B954602101A3F4F406D322E55EBEE850DE09AAFC15763F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737076, "uuid": "84b58df3-1e2c-4fb4-b309-6d46d4ec297f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737076, "uuid": "568f441e-8553-43a7-bf10-36e007e1ce89", "value": "24576:YyXE+KmwTufEkE/mg1BlAWlm5Cikf/su4:PCmwS8k4mg1Bir5CRsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737076, "uuid": "375abe6c-1542-48fd-8c03-cd1949e9378c", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737076, "uuid": "82ffa4f1-e61f-45a0-ad50-47aa9a149f22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737076, "uuid": "91738674-d0cb-439e-9306-7645a499e96d", "value": "yl9KgwwOXDZoGMw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adce048f-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738380, "uuid": "49ac94dd-c40f-46f1-94ce-4ac95b4f7915", "comment": "Malware payload (Dridex)", "value": "8ea83d6713664feb88c4c4a8c530cf05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738380, "uuid": "f558a6e9-f4f3-4242-b5ca-c93fb65f1111", "comment": "Malware payload (Dridex)", "value": "f0aaf017c7385bd29d611a89de93fce39cd860e6666345616b100ecc7500f78e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738380, "uuid": "42169621-b488-4bc6-a0ec-872e46c83b84", "comment": "Malware payload (Dridex)", "value": "768168d91479d8aece3899a92eb2693c2fbc32a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738380, "uuid": "856b52f4-9fcc-4b6b-9fc4-0276898bf451", "comment": "Malware payload (Dridex)", "value": "55c662baad862d04b29d6d41730634d73b2cdd6d97235f7f14719dcde88b4e5769b39ad86c0188c994435d3481e0257f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738380, "uuid": "91449c92-c3f4-4270-a095-07a0d33cf2d2", "value": "72F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738380, "uuid": "9d2f1a2a-a298-4a26-8c45-5525f0e60626", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738380, "uuid": "888f9961-1046-412b-8a0b-65d74857c976", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738380, "uuid": "57d179fa-356b-42f6-a50d-edb654a850c7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738380, "uuid": "055e4eed-8695-44a3-bd28-60882f950945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738380, "uuid": "efc61c98-7390-4cf6-927d-552b8eba740d", "value": "8ea83d67_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fb7f3a-b239-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620724435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724435, "uuid": "7101e14c-03ed-4cba-a026-f79ca64f9b19", "comment": "Malware payload (Dridex)", "value": "2e71c35977f4afade721e75b768a16d6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724435, "uuid": "16912918-b372-42e4-af43-5c3d3ec24a85", "comment": "Malware payload (Dridex)", "value": "f0e5bd742c80465142cf2166ecd63701a010399123faeefe533343f2812c8fcc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724435, "uuid": "6b808b9f-8718-476c-b400-508b1b771fda", "comment": "Malware payload (Dridex)", "value": "e412ab1d9e37cb50ff9beb0cce1b30ee01ec14d2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620724435, "uuid": "59cdb73c-92bb-40ba-a9f6-9b34b5ab94c1", "comment": "Malware payload (Dridex)", "value": "769b8a22dd87b685affb00397dd1b11ec20cb3ee2364f847e78e3c3f93f4daf0c440993148aadca6bf0eb3ebecbd1b38", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724435, "uuid": "bb690eb2-4392-4fb8-a5e4-a8a9994da27f", "value": "9EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724435, "uuid": "dd790327-6b90-4a03-98fc-414e0978cc01", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724435, "uuid": "bf58849b-c9b7-4fd4-b205-a541c1df2b15", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620724435, "uuid": "a833aafd-04ce-477e-b62f-7a3b9cfb15b5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620724435, "uuid": "c12654da-bc04-4bf4-a816-dddeed831644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620724435, "uuid": "9e47178b-3873-41b2-9ed3-204ab4ef9938", "value": "f0e5bd742c80465142cf2166ecd63701a010399123faeefe533343f2812c8fcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6ed55d-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705657, "uuid": "a2b2c979-df5f-48b6-9489-e201278aad6b", "comment": "Malware payload (Dridex)", "value": "9f77c65b701cce8a3ce3c5bc6e101869", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705657, "uuid": "b20fb04d-ddec-461b-a9a8-1fb3c258bf7d", "comment": "Malware payload (Dridex)", "value": "f18a8366eb763c97f430098642d4f4f91deba351ef4b1713e5ecc84445759e3f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705657, "uuid": "15891e7a-7f79-4f6e-b418-63d6f4242ec7", "comment": "Malware payload (Dridex)", "value": "39c67e09162fb9c9cfddb3362143e9ee8a6e1138", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705657, "uuid": "852bb54d-26e4-426c-b044-6475f0c658ae", "comment": "Malware payload (Dridex)", "value": "3fa91eadd7bff0f521132e8102bdac4bddcaafd4bd18bf0905efc4e370b952de8a6a6d0b4d8f2ab6b6d8949fae0a42ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705657, "uuid": "6f3f4480-7a4c-47cb-a04e-45b804f13b21", "value": "4BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705657, "uuid": "fcce0e03-ad95-46a0-a68a-ee19ff52203a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705657, "uuid": "4cf8eb1c-f8df-450c-b97d-1f967901cb76", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705657, "uuid": "df6dc650-1b9a-4c38-b660-4c660ced81b9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705657, "uuid": "03647247-8e19-469d-9e50-d71a2d6ac3a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705657, "uuid": "f4690f30-046f-4749-b33e-d64b17954e10", "value": "9f77c65b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df08ce54-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698519, "uuid": "e5d809a1-00b4-44b3-b9d0-3d998536ddaf", "comment": "Malware payload (Dridex)", "value": "79a4fe63356c7ec3d50f7753fdcd85db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698519, "uuid": "fc5b9926-56c6-4f43-981e-6d0aeec0bb57", "comment": "Malware payload (Dridex)", "value": "f279902826e7b962e657210370ad07f4399ca56fe5cc3b054936c4612416b724", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698519, "uuid": "601e8b34-985f-435a-a7db-faebb440bd0a", "comment": "Malware payload (Dridex)", "value": "d6c02e99071352baefc14231f04b054cd1818bce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698519, "uuid": "037e7e5f-ae14-4ae8-9d49-987cdc5599fd", "comment": "Malware payload (Dridex)", "value": "9257e2b6739babeb28e2d02acbb74db8c90439acf7c92ee2ccb1d46afc0985816105aa4267f9ba6de9f08e937e3fa73a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698519, "uuid": "e6f0579f-8e8d-485d-9bcd-3c36ed2e5b5f", "value": "4FF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698519, "uuid": "3ab92dc3-549b-4725-b035-fb23cd6388ca", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698519, "uuid": "fc4cfd9e-7ac0-40b2-93b8-efb39dd7c5bf", "value": "3072:0A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:03J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698519, "uuid": "959c678a-d028-4062-b026-d409e52c9d63", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698519, "uuid": "92f8c3a6-2046-49e1-9ea3-effb77a40f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698519, "uuid": "333febd8-f970-4886-8803-e33ddd7f7700", "value": "79a4fe63_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca96fce0-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620728979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728979, "uuid": "d441fc6e-d48e-437e-9fae-9d0dfe9bff8e", "comment": "Malware payload (AgentTesla)", "value": "349f507794afb6e5c6c5a1abeeaae124", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728979, "uuid": "27daef08-bcbf-49ad-a6fb-242a0f6db84d", "comment": "Malware payload (AgentTesla)", "value": "f2a3c147eb3cb69591f0291b5a1d324a288f86773890fd77b24f255d13feb7bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728979, "uuid": "40550148-abae-4cd3-bc1c-52f8dd53e895", "comment": "Malware payload (AgentTesla)", "value": "665a2e9b4695df7246dc17cc5add3a173fd42c16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728979, "uuid": "1b6cad69-4012-4e3e-8086-df2854e7dc10", "comment": "Malware payload (AgentTesla)", "value": "f495db180e74aad76ab87d997005e4be44aaf0db05ee54333b9bb4e35dd6cd470878f40babcd82848d10b3241a561af2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728979, "uuid": "7bdb82b9-b2aa-4243-816c-bec77d70799b", "value": "3B1502223358AFE1E67E977D5464114443F9B40AE322F68D7EE905EE48A1F4287B3F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728979, "uuid": "4ad42feb-90da-4c8f-98b5-f8eeba3c6a53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728979, "uuid": "0401e18c-e0e0-4031-a27d-749bc51e7d06", "value": "24576:oTRRtQuaLvRDuU7dRd9nSYtvpT1pSwgfx2SZAA4f5N2485:opQuyRDuydRd9nDRT1xcxpd4j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728979, "uuid": "37f01a35-d5eb-4bdf-b909-4dc068c3dbef", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728979, "uuid": "68fe26bb-7bcd-416e-81c4-3e385ac75869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728979, "uuid": "bb018167-0ae5-4a28-8805-d3ca3a686057", "value": "0000000654.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f21af50-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714706, "uuid": "75366c31-6a95-4f61-be45-0ed9433ef4d0", "comment": "Malware payload (AgentTesla)", "value": "b322f3a24ee398977f80f0e9b12c81c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714706, "uuid": "8528b935-0f7b-45b7-8bc0-82a020bdb651", "comment": "Malware payload (AgentTesla)", "value": "f318a50888a74a406ace7e22e94763b702020d32151180431238ae47282f16b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714706, "uuid": "bb7bac79-41c2-47fe-b6e9-d070dbc25622", "comment": "Malware payload (AgentTesla)", "value": "364ffed4e35d3e8e5c15c45a3aaec3fb22f1cd7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714706, "uuid": "b093d4d9-8d34-4beb-b770-1e42d33d8caf", "comment": "Malware payload (AgentTesla)", "value": "b6c998eb56dc3f677337519461d5ba43b3b1fef8d10a28d50565fb6c8240d9d11acf0876dd97c3064f2a31d93d4d68b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714706, "uuid": "d01164b6-cc08-45ac-b47d-03771b32b93b", "value": "4E156DD87144A8E5D3472C7367CF8C11416826B8A43BDA0E2B516B3E59E7F133D3AA8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714706, "uuid": "5995cc66-4812-4403-9462-2f3a977ce400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714706, "uuid": "4752c8aa-4cb0-4a5e-bdb4-9fe140fc1cb4", "value": "12288:GUaoLLoS60/K7yh03jPHBrQMK3MQs2k6ZqN0cA07f2fIEeJ9ZchSiyyjK:EoLAD5QMK3G2VZIA++fIBJ7chd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714706, "uuid": "fd8d11c7-a92d-4688-9e8b-088e32f4f2da", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714706, "uuid": "34999918-0166-4cb3-bad6-30eadd5d7fea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714706, "uuid": "40b6ecc4-0001-4588-b81b-b3531c8d2cd9", "value": "Quotation 68094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99cc618-b215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620709247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709247, "uuid": "5298092e-d79e-434a-bcd4-8a341c348301", "comment": "Malware payload (Dridex)", "value": "c670ed32342795deb2af62ba6140f68f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709247, "uuid": "2ed384e7-f8d7-491e-9630-853b0e739f2a", "comment": "Malware payload (Dridex)", "value": "f3632eea86732cf311956ab7f030d9557d1e698a7a29eb1e3ecd735bef8d49dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709247, "uuid": "feb3a36f-60e9-4685-864a-17ee285f8e54", "comment": "Malware payload (Dridex)", "value": "26f0d5a6a457f09de786072ce1f4cf9f3f337086", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620709247, "uuid": "0f01af32-8e38-4d44-b05d-2a2f746327ea", "comment": "Malware payload (Dridex)", "value": "f5336e53358e4357180fd86fdea7117653da1b8de85c3359663c68707620cd018ea3b27ac0b4a101c614bc8cf4a3faf4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709247, "uuid": "c8476ab6-a859-43f0-9fd3-c03bef901917", "value": "20F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709247, "uuid": "a5dd3585-4943-4b86-8050-009804e0ae44", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709247, "uuid": "d077e49a-837a-4ff4-8922-826e0684391c", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620709247, "uuid": "129fc58b-9871-4b11-b2aa-60692455c3af", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620709247, "uuid": "99f73ea9-8732-425f-ae21-5d5890d36b7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620709247, "uuid": "74de33a2-9a64-4884-92d0-d85c3069c31f", "value": "c670ed32_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac5b104-b225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620716148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716148, "uuid": "d5b3e146-0537-4b7d-ba0b-0dd2e82d41f2", "comment": "Malware payload (Formbook)", "value": "6e647ed375b737c684f359f1b8b75f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716148, "uuid": "ca7a6317-33b5-4e96-84e2-92e116a6b98d", "comment": "Malware payload (Formbook)", "value": "f43b323ae6be7b7945d58fcab72ae3c66ef552b8584063def9d2415d08573c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716148, "uuid": "ad148f65-fd05-464d-8340-6df29cfbbb19", "comment": "Malware payload (Formbook)", "value": "f6f4e7dcc730029431dd617f24cf551a403775d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716148, "uuid": "e5c0410c-6bf9-4318-ac5d-ca3f31579710", "comment": "Malware payload (Formbook)", "value": "ee1f7486306dedb88d0c7630c981d2f5ff96bf9b41bc27e1db915c61af333a2cf32401ca538d60e24ff1b75916279908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716148, "uuid": "335b952b-1800-4f76-87f7-f6c30fa151a8", "value": "88C6BD12A550AEA4F4B38A3119AB9D61C5178FE0611C26C7927B7F0ABD11F5F397B00F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716148, "uuid": "241e42b6-f5b9-41c5-b143-f972158db8c8", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716148, "uuid": "d4566b86-d1c2-43e2-829c-50b6f6229526", "value": "6144:R9X0GsMDbHkTVEjEJm/uMqMQnoIFxeAwVZIk:H0NMDb6VEYJK6McoIFg1VZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716148, "uuid": "fc781948-d6dc-49d8-bd22-5d4080b57811", "value": 12582912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716148, "uuid": "74cca77c-0de1-4603-89be-778914b9cea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716148, "uuid": "8750b7be-cfcb-4e73-b993-90d43eef9490", "value": "SwiftReport_13712021831_jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6354fc9-b25e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620740622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740622, "uuid": "89d69b48-503a-4826-b0d3-4a07b070f40a", "comment": "Malware payload (AgentTesla)", "value": "5991ab16fab92e16e1e96c3a5bd18ae3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740622, "uuid": "914f5305-ed54-4610-bfe2-e324272583da", "comment": "Malware payload (AgentTesla)", "value": "f482837bcd21caa30b2f7bf2550fb6d13d61aa7e4e0c66219bd085dd16b9481d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740622, "uuid": "9d1e3930-9f26-4b94-9cb9-f11d5c3f59b6", "comment": "Malware payload (AgentTesla)", "value": "e095c7541d7b15a8b5e5405b0569ce671b68a50c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620740622, "uuid": "0a0e73a8-f119-4c15-bde8-055b38dd53db", "comment": "Malware payload (AgentTesla)", "value": "a4e7d1f990fe4c0f7d91845dac4fbbcd5c46589f53dd55cdef960e07170593ec0a8e8d2b13893e673f1834dc5e3cd450", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740622, "uuid": "c2c946b9-cae0-41b9-8aeb-870eaf74bee4", "value": "84C402B374918887C22313300065B69ADD44BFA3295303DBFB48FB5EE972289D96FD56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740622, "uuid": "e615a8d5-d623-47fc-bf11-1fa5880e0ac5", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740622, "uuid": "0195ea44-9a96-4c6b-ada1-67acf92217d1", "value": "12288:90OuPsdEJWow5dKFAxMeY8jDwTxao9yKCdD6++HZ:YPvWow5dXtjexd91eWlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620740622, "uuid": "6ba10dee-a875-4ad9-8e01-74261a510779", "value": 554083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620740622, "uuid": "3478688e-ffc2-49c8-958d-7bbc5ed68e5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620740622, "uuid": "4d698ae9-dc22-46f6-8913-bc5caf126625", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e4a748-b231-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620721289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721289, "uuid": "2b63faad-a9ed-495e-80fb-84f0b8873f61", "comment": "Malware payload (Dridex)", "value": "728015a0e10488fa146c73abb252a374", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721289, "uuid": "4b9f5c27-4d81-4b06-81e5-c9b9608d7f46", "comment": "Malware payload (Dridex)", "value": "f4db968fb68e6cc3183401b4d54354aa2b0f101999f18a84276c7d63a7ffd1e7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721289, "uuid": "0bca2a2d-dadc-4935-94a5-5d340552437f", "comment": "Malware payload (Dridex)", "value": "71d565633997e87032904bad6fc21cde5466dbfa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620721289, "uuid": "25c35fcf-23f9-4e87-898f-624659d58fc1", "comment": "Malware payload (Dridex)", "value": "c0e73bda8745762a6533a49a9989e2fdb1f6bf021ce864bfd17c0481ab4864726a4acb0ed73337d68a1a7244e30ff21a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721289, "uuid": "1c5fa239-44d1-45f7-81b1-1e2c61a83e15", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721289, "uuid": "5bd4b600-9fa7-45ce-a92f-a27e94eccdab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721289, "uuid": "7df9459e-9492-447e-af0a-bc11a8969cf5", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620721289, "uuid": "25ab495e-d2ad-4661-be8d-331ceaefdf13", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620721289, "uuid": "2420ef85-1f59-4500-895a-bcfd5f56931f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620721289, "uuid": "a1f55f2f-b396-43bc-96ea-415f88d855c8", "value": "f4db968fb68e6cc3183401b4d54354aa2b0f101999f18a84276c7d63a7ffd1e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293b863a-b251-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620734721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734721, "uuid": "6de3bb6f-8c6e-4458-9638-02b5c4409651", "comment": "Malware payload (RemcosRAT)", "value": "94280a43fd855f2a592d30c6e1d4253b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734721, "uuid": "307c2da9-5e5f-46ea-aa69-2b774397c3f5", "comment": "Malware payload (RemcosRAT)", "value": "f4dcc52b899bbe0d34ffbb44032c0186953c174beaf647c0556c7e71385c6bb4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734721, "uuid": "ff08ed2a-0de3-4b8c-a299-0370a0e8afe2", "comment": "Malware payload (RemcosRAT)", "value": "8a57b7856a398066d7d830072f88b6f7fa4e96fa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734721, "uuid": "098700a8-c75f-430d-a0a1-59af0ba8b080", "comment": "Malware payload (RemcosRAT)", "value": "601a50f296cf7288ab6990b05f959c67698819eaf4c6d448276e882cc1dd731ceb3f998fb7b3254144905fd48b24d061", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734721, "uuid": "308a26f6-ff8e-4e56-9d42-65cd00942fdf", "value": "2425F421A2814722F06E3B34D82676145BE1BE3C2DD45366E6B93B0B4B3F2512DE617F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734721, "uuid": "539e3fe3-9be9-4b0a-bb54-6fbbcd353893", "value": "b64b452434f9b4c79d8cd285903a399f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734721, "uuid": "e893d183-9c0e-4f24-842f-3cb54c5b6286", "value": "12288:hAQUdCLsY8iOnhm8q9vvgh8RWvezDm+hz24S0EmwoKtJ7RXXBLeU/Oy//:hAB5iGhyR7PlRMlHVXXBqUD//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734721, "uuid": "46f0b768-c443-4ac7-8361-4ef50e2885d9", "value": 980088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734721, "uuid": "6b5cc52c-322c-4303-a4ae-9b92eb23a1d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734721, "uuid": "af7e5d0b-b6c9-4cec-ab99-196405a29793", "value": "94280a43_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78006db2-b20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620705648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705648, "uuid": "b0297e2b-31c6-49be-8d65-bdbf7beaecac", "comment": "Malware payload (Dridex)", "value": "81a93b8339dfa258899930b9dccd28e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705648, "uuid": "15d2e6ce-30c2-42f4-8678-0067b2480419", "comment": "Malware payload (Dridex)", "value": "f64228000276bcc045cfd6eb588e9b07a821bf3bab611661426ef765f13d329a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705648, "uuid": "da3782a7-f4ac-4e32-9725-adcb404ae914", "comment": "Malware payload (Dridex)", "value": "214c8942f1d8191aa25326859296f4241c8d7d01", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620705648, "uuid": "746959b1-7e27-4d7d-9a9c-5649618582fc", "comment": "Malware payload (Dridex)", "value": "106d426e790d854cc6be5e6236334cd8e40b3ea1d2f4519e9ea7053ad63091392b609876eddfca2ba05974c3747dcb94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705648, "uuid": "86eb8786-2111-460d-93c4-957a9f992a16", "value": "4DF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705648, "uuid": "a158bba2-c4cf-44dd-9739-d7dc900a7018", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705648, "uuid": "7484e46e-30bf-4947-bd6c-799b340bddf0", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620705648, "uuid": "784ec020-bdd2-4f9c-b33b-fa06d3981d55", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620705648, "uuid": "a679638a-7a54-4444-bb75-899cdf9e4f14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620705648, "uuid": "d56fc91f-81e9-4294-a689-bdcbc8ca7168", "value": "81a93b83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8233cf6-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698481, "uuid": "d62ae1b3-ac87-4dbd-9404-3caff80ec22d", "comment": "Malware payload (Dridex)", "value": "26b23aeadc5dfa9b418d827a8069e8fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698481, "uuid": "403f34f5-90ce-4749-9ff4-1bb90ff8e617", "comment": "Malware payload (Dridex)", "value": "f6627c271b7bf7241b28b5061bb6603b4d0c8acff1638e4882e3c8272717f914", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698481, "uuid": "9b6febb2-9130-42c9-97eb-99210ca0e55d", "comment": "Malware payload (Dridex)", "value": "8624d5decabb6201385c44cd236dd79fe5b5a6a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698481, "uuid": "2998b6c9-e13d-47b0-98c2-48a79b331e62", "comment": "Malware payload (Dridex)", "value": "42aa9264e5231a884d9d83928cf85cc9139673ddedee4226e7b32be4c0226f9156660dccf39e259394ee9ebe0e0eda62", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698481, "uuid": "ef5ded1e-beeb-4e09-8de1-236dec479794", "value": "5EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698481, "uuid": "951704f9-e9a3-42c7-b0d2-46588f2afbd0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698481, "uuid": "b4c8eab3-51a3-46e6-bf29-2b91cece31bc", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698481, "uuid": "24f323c0-eb92-4039-a3c6-1ebee8ed0512", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698481, "uuid": "b2375d86-0145-4dd2-a751-793c59410904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698481, "uuid": "cf9e5bf5-847c-4d95-90fa-e88b518103dc", "value": "26b23aea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c309d96a-b248-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620731114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731114, "uuid": "2e4b8737-9f54-4f92-95ad-2416ebd89cea", "comment": "Malware payload (Dridex)", "value": "515e641d4b6b5f30a56b2adbb59907a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731114, "uuid": "23e71e77-1bd6-458b-8920-f9c789568df0", "comment": "Malware payload (Dridex)", "value": "f6a1a7e43a2c62cbd3a9bd263d3a0ca63734a8bc70bb9011e7361c07074ab6bc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731114, "uuid": "71ec1128-beed-4d41-bc11-daf37786d312", "comment": "Malware payload (Dridex)", "value": "eb5c4d38e9848085f6e3280a5127c455a6855f46", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731114, "uuid": "98219dd8-86e6-450b-a4ab-e1611e9af39b", "comment": "Malware payload (Dridex)", "value": "1f0d22d1d7d2799e8202ae4673df4a27a5b3c6c14b90874db3c8a633fd14c24c5695cccdc55189b0ae66fc8e73f2171c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731114, "uuid": "2a9d0532-dd53-4180-9223-40a3e99810e3", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731114, "uuid": "37bf9eb7-dee0-46e2-a635-6b1301423b54", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731114, "uuid": "58d351f0-6785-425c-a919-d00647912540", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731114, "uuid": "8a42e906-9601-4c48-8303-6015d890a760", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731114, "uuid": "874093b0-0fe7-485c-afa6-5b1dd021a8cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731114, "uuid": "75077405-a330-4f6a-8eb4-222dd04cf065", "value": "515e641d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333814b3-b218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620710257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710257, "uuid": "7d9ee65d-aac7-43e8-b6aa-c41bc5a7a4f3", "comment": "Malware payload (Loki)", "value": "f4e2b625051dd9283bbec085e56d0ab1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710257, "uuid": "814ae06e-0e5b-4a36-a176-566431330831", "comment": "Malware payload (Loki)", "value": "f6e0f11f26c59925ad1bd23c4dc586de71af0863d7273ad41a17efd92384167c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710257, "uuid": "f47db26c-877b-42dd-a6e0-c9b9ce4250fd", "comment": "Malware payload (Loki)", "value": "118cae287ef1505bf04f75d5811c340ea01fa949", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620710257, "uuid": "c4c70e38-6f6a-41ff-b913-264754127e7d", "comment": "Malware payload (Loki)", "value": "3d8c12e0b6a125fb73a19eba2fe3811d4f44a076a44ac8a2292f54414901fca7ef2d8ea893974872040681693950da1c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710257, "uuid": "862b4442-8bed-4199-890c-a95095be39a1", "value": "BAA42312B3D69653DA13A4359963CA45F537FC09AF00C6DF33503BAE2D78B7895B4228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710257, "uuid": "613a3599-6b35-488b-9b6e-b5b380d78f33", "value": "6144:3+NyMR4B7rYa8FSzI/eIBpDZKcupHpszWUiczH30Sb7y8LgrxkkUd7wBp+EujHX4:MyMR4lrqF+yDZKckJszqSEyf2+ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620710257, "uuid": "23d0eb2a-8374-4760-a6be-7d18b49f754d", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620710257, "uuid": "d9ec6b83-01ef-419d-86b8-f691804fb81f", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620710257, "uuid": "00a94a3e-80e0-4d7a-9d5f-7191d247ec5d", "value": "PL_017542000.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b5da1c-b22f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620720087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720087, "uuid": "c2c0bc6a-6851-4683-b780-a0b373269eb7", "comment": "Malware payload (Dridex)", "value": "6ffae4cd3445eef47246b73a5cf6785c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720087, "uuid": "77febba8-ed2a-4b53-bf93-52f8857725bf", "comment": "Malware payload (Dridex)", "value": "f75523a3370ccded21be397f70b8594cb2943ff78b770e036cd1205854686e21", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720087, "uuid": "8c74ab08-3bc0-48d4-adf6-7497878016d2", "comment": "Malware payload (Dridex)", "value": "52ec505e010a02eca83995e3dbc02f180a62654c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620720087, "uuid": "cf03fb51-c1d4-4d9d-8dbc-33c6a87f10e2", "comment": "Malware payload (Dridex)", "value": "860c3140b98eca4638bc6dd9883fe8f598e80fb90c6ee4d7d681f5ee51b0a91f32419661922b4773a1f17b15b0c4beb9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720087, "uuid": "3ebcf0b4-44ab-4158-ad36-f2d57c8a0883", "value": "7DF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720087, "uuid": "f3d85c9b-23bd-42dc-b214-9486d21d7c01", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720087, "uuid": "2c1c903d-b99a-4ddd-8ef4-70fe9f3c1da0", "value": "3072:zWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:z42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620720087, "uuid": "9ea6f302-e06b-4c5c-be30-579f3f1248c0", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620720087, "uuid": "9810da90-95e7-4572-a674-814458597175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620720087, "uuid": "232cfa4b-01b3-4761-bcfb-ec172250ed8f", "value": "6ffae4cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f84938-b21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620711899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711899, "uuid": "b61f26bd-d5a6-4021-aa2d-7eacfca59d9e", "comment": "Malware payload (AgentTesla)", "value": "a5f09ea1fd608ae9bbedac5fa7dfc813", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711899, "uuid": "9626ffd8-5f72-4630-adb4-50715659153c", "comment": "Malware payload (AgentTesla)", "value": "f773364cd11c5155ccad0e4d3ed770a0ece02e81a6372f23fc285bdd9f301b0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711899, "uuid": "a617a46d-ae0c-4c5f-a435-f55c5cd7817a", "comment": "Malware payload (AgentTesla)", "value": "1e3e150b9114d7d4ab8a80a67c69ae5d126a8e88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620711899, "uuid": "89e75ada-4505-40e0-8d9f-49c250155a18", "comment": "Malware payload (AgentTesla)", "value": "7eec9602e70e0fc8f6e57ee102003f8b6f1ec91461beacb7a5732a9f28f9e0dca28386d9429dd95be349b1b42341f69b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711899, "uuid": "5dd0692f-01a7-40f0-ac1d-3aea09042c18", "value": "91B423D1151FEE397556A3109627845A1D32F02EEF2EABEF4D818F18A15250ED0E3E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711899, "uuid": "7e163d3a-f6a5-4886-871b-bf0e208a7dda", "value": "12288:M0QweH+XWWZeAPj3nk6qOQfjLpRCVqmdcoIR3MT2y:iwVWsPrkOQfnToIR3M6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620711899, "uuid": "bbc7c6e7-005a-4aac-a0c9-f7f9ea672b6f", "value": 502453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620711899, "uuid": "58d8379f-3acb-431e-9f63-4397aa72bca0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620711899, "uuid": "05b69f72-9723-453f-a4f5-2381b99c5a66", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186e150c-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738129, "uuid": "2af6551c-f8af-4f05-a5f7-e68d5df0b037", "comment": "Malware payload (Dridex)", "value": "70429bb6b80d31decd97bd36fa8bb414", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738129, "uuid": "471ce9d2-c9aa-436e-b29a-c6617b7168e4", "comment": "Malware payload (Dridex)", "value": "f7bd689d5b2286198c6f9dcb89b0772c0feb4e1b2e5a89adcded8b3802dcfc94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738129, "uuid": "94b40ae8-eb56-4923-a5f9-69c6f1859569", "comment": "Malware payload (Dridex)", "value": "6f3d537ac212d52b9aa3467a081b37a7e7da19f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738129, "uuid": "d77b4d9b-a493-4d13-b649-6f59f78a6808", "comment": "Malware payload (Dridex)", "value": "a0185deca7ee8100851469d0b9c53d7c99e6807b4016c340cace3deecb7cd3565f4c6700575ee50d7981d3d499cfa3cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738129, "uuid": "e595d826-1f5a-435e-b3e5-a8dfbe3323e7", "value": "F5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738129, "uuid": "ee0cd350-9cb6-48ab-a9dc-2ef571dc075c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738129, "uuid": "4b15a89e-e6dd-4a26-a533-8c7c9d17b815", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738129, "uuid": "8670b72d-6b9a-487c-bea1-add0ed9298bc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738129, "uuid": "99b73b6a-c93b-415f-9ee4-b6b7089642e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738129, "uuid": "4b2de054-9929-4da0-9545-96aa420ec8a2", "value": "70429bb6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75205c23-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620712944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712944, "uuid": "bcb80794-3d2a-415e-9607-f67150b9cf23", "comment": "Malware payload (Dridex)", "value": "81533560fdca9c448500fb4bd8fad2d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712944, "uuid": "567dafad-9906-4a39-b008-cc92803cb2fb", "comment": "Malware payload (Dridex)", "value": "f7e1ad377c4412d5ee83578ca16dded51c899d07436361f63ec0290d10853e7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712944, "uuid": "d6023457-f069-49df-813e-223ae6856971", "comment": "Malware payload (Dridex)", "value": "b0596fce44def7b51123e658da69d1624c9b7df8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712944, "uuid": "d04d7a36-2ab9-4fb6-87ce-1c1f5e0e7d80", "comment": "Malware payload (Dridex)", "value": "9b3b08797f1e80c43281243285f7a30a6b537ac178e9775354a255c3aa21a1222795acdf78e19f7bf259b6daf27d4a85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712944, "uuid": "8bf78056-bc84-46c7-8b77-6031429b1c87", "value": "7DF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712944, "uuid": "68e57f03-cdd6-492c-9cd7-26792caf2f10", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712944, "uuid": "331a66f2-e7a2-4a86-9a13-c98fc3ae8932", "value": "3072:2IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712944, "uuid": "d5231c9d-5f66-406e-b6ac-a81bcec9256a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712944, "uuid": "9819e3df-b819-407e-89d6-1dbddfd3771f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712944, "uuid": "95a99294-3ac7-4d43-ae19-764be88663d8", "value": "81533560_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc5657d-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717284, "uuid": "693d51d5-25fe-4432-8f68-2a2a4672ca68", "comment": "Malware payload", "value": "df92371c2f2a4b170d14e2b22b352d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717284, "uuid": "e35cf28b-8436-4da5-bda8-1f33b56d1508", "comment": "Malware payload", "value": "f8265463230e39044d689dd79debee3d91554c2877839146b72eb8cf9320aaec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717284, "uuid": "945e5f6c-7029-4943-9ae5-83d734d34f18", "comment": "Malware payload", "value": "dd3f0ef14e8fcc8b4d88351e88bc4805b9d1e732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717284, "uuid": "acb955c9-2966-4ba7-ad90-d0dbc3776400", "comment": "Malware payload", "value": "e7a488817a545ff75839d736519a614c6b396b9910072198650a804799a4bb78c84a9ac48b38d8e47a100e205adbb27c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717284, "uuid": "ea182842-cdbc-459f-ab36-61af1bd8620a", "value": "66D34B3C37CC6D31C56C293B85F56200B3B69DA61212E76A5EC171E91BA2FE58E13B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717284, "uuid": "0a4ca9a6-16bc-460d-bf80-0aa85fc3dfd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717284, "uuid": "19188e3a-d679-4e79-a206-9e6681b75be0", "value": "3072:ciUPNOk9Mo7OfOKIDNA3aK0zhQbzRVOwDFkVVvTonO:ciU1n4UBAqK0zhezRVOwDrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717284, "uuid": "b618485a-87af-4381-88e0-c60f5b810a0c", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717284, "uuid": "f1af5ea8-77ab-4e50-a934-a69f320ee2e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717284, "uuid": "1ab38341-4475-4810-a1ae-18548dd2d3f9", "value": "df92371c2f2a4b170d14e2b22b352d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4d84fd-b283-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620756361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756361, "uuid": "af2af421-b7b1-49d5-b0dd-681f75ccf4ba", "comment": "Malware payload (Dridex)", "value": "256ea56a81ddfc5f2f414110f16e3b46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756361, "uuid": "da9bf5d8-2c39-4868-9e6e-c970deee978c", "comment": "Malware payload (Dridex)", "value": "f87191ee2cd0d7fa40ed8ee26166c4fe00e34fb30fa4adaadfde84c7b701d876", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756361, "uuid": "079de7e0-9b28-4ebb-a80e-6546c50ae1cc", "comment": "Malware payload (Dridex)", "value": "413028aa026a8cba61e490559ae7bf3c8af30bce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620756361, "uuid": "3a93c64a-959f-4ae6-b50b-d3313b78037b", "comment": "Malware payload (Dridex)", "value": "74def983f3e3114e5e0e98c31b3d3f7ee221e09cb3d4a276a4d8581101c8266753e9c256780e25f87b8d075bdd2578d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756361, "uuid": "16b81051-bf03-4744-aa7d-5fdf77551001", "value": "DCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756361, "uuid": "13e0de54-138b-40a0-999c-b20d10d7da2e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756361, "uuid": "095bc6c2-a0ca-4b2d-b50e-a749797d7e74", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620756361, "uuid": "904d8247-5ac1-46d8-91dd-4dff4ef3488f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620756361, "uuid": "8921adbe-ac4c-4b71-b720-b041fc34b936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620756361, "uuid": "fe6d58b4-fdfb-4ab9-8f03-c7ccd67e355d", "value": "256ea56a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046ae539-b246-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620729935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729935, "uuid": "966a3a3e-5fdb-4e61-ba95-dfa5a247a631", "comment": "Malware payload (AsyncRAT)", "value": "ea2c22c96421b40396d9d9a5ef2e4dc4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729935, "uuid": "0890d291-ff4d-4392-b142-8d01bdb58bae", "comment": "Malware payload (AsyncRAT)", "value": "f8d44d7880640da690ec310d1d562a37f0f63e45503d8eb8710f40dd062cf401", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729935, "uuid": "4abcae27-4431-4c67-b4bc-7cf6f9f9666f", "comment": "Malware payload (AsyncRAT)", "value": "77a04b21f8e8c57b7f24c6681fcac30ca09fd42b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620729935, "uuid": "d100f38c-7ace-4a68-9938-f392c38a422e", "comment": "Malware payload (AsyncRAT)", "value": "7be9cfcdf2cfc773c3a60e837aa25beb212324dd1ce0c6db1ab8ad645f962d7af1d2f6185d129bd63693d2233cd18cf7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729935, "uuid": "4ec3a6d4-c22b-4470-97f8-3dd21fb54a0f", "value": "45F29552B286DD17F25644310EC7CBEA7378BC4A9E06C35B32947B2EAC793708A22755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729935, "uuid": "30765f8b-7704-41cc-bf9f-b193a9973ed0", "value": "384:wLE8iSwvxjk+ty/Wud4AdEECgwLUHp50jGDQvfNut:eqxw+tk4AdEECxYD38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620729935, "uuid": "cca7cb75-d540-4e95-87bd-9f2acf41d497", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620729935, "uuid": "bdfcde93-de4b-4d21-94b3-fb609cf8997e", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620729935, "uuid": "fcec3dfe-90f1-4488-ad22-a6100b193e3d", "value": "SARS Documents.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31db00e2-b229-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717556, "uuid": "343fcccd-fce1-43ea-ac5b-e71e2c1969ed", "comment": "Malware payload", "value": "49365ee03b9fe23b388339b8ac84bd9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717556, "uuid": "964c933f-ee6b-4bfb-b5a2-516a8153926f", "comment": "Malware payload", "value": "f9066e31398e722f92ddc2e7c58a51509b1963405358e1be714454c144644c2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717556, "uuid": "b63e323e-f830-42b1-a849-1f73f2dd29d8", "comment": "Malware payload", "value": "fb94c016fd957d00dcd85c8ec9ac7ae677d314b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717556, "uuid": "dbf5da33-7d0a-42b1-b543-5c975e1b54c5", "comment": "Malware payload", "value": "7c81f9993bee6bf74465d126652c70bb44ac56e1a724ecd542bdea9d1b526e9bf698c13a957e776b7cbe0ac13b601db9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717556, "uuid": "2f5008a5-83bf-4ce3-9628-ac61859e846d", "value": "84813C7BE71B8871EF5E5F3C0E0B8627774C6622038606E70B5169892E84DDBF474B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717556, "uuid": "83146b5b-a654-4a06-8656-82612ab58c69", "value": "f2de7cbb8605afa66bc74edd5fd9d0f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717556, "uuid": "8075c246-8b65-4c14-8ee1-c857a637c117", "value": "24:eFGSfvF8f0++kpaz8jPVV1SDSmCoD0AEEPuhhPKwm3bVF6tUmqcoJJ6TwudPdcnn:ine+UoRjSMuhhPK1LKU5JKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717556, "uuid": "f1423d8d-2ed8-418e-89e1-47f5417fda02", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717556, "uuid": "bcb458a0-c1b8-404a-a745-4a8dfdda1144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717556, "uuid": "c831ab88-bced-4998-bb99-023f22bebdce", "value": "SecuriteInfo.com.W32.Injector.AHU.genEldorado.8384.14844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf848601-b226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716532, "uuid": "4e5e0b00-9dc6-4f29-a783-743aa134b8d7", "comment": "Malware payload (Dridex)", "value": "187550c627f647ffdf41b4cec89b2be3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716532, "uuid": "38c34cea-118a-4c4b-8b44-ddfff697323a", "comment": "Malware payload (Dridex)", "value": "f940e825085ec509bb81f3141ce82b606db3e622ed61e867b5d481a5e2472a83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716532, "uuid": "00b3eb34-6bc8-4915-ae4e-cfb944198922", "comment": "Malware payload (Dridex)", "value": "ea9daf085ef2c157c6eda14a1f18e09594005a8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716532, "uuid": "e0d81b78-7074-42ab-8f42-734170b5e828", "comment": "Malware payload (Dridex)", "value": "9aae58d13b019edc3e3fae12c07a0c67483632246ff57bb3733dd995c6ff6556db20887d478488a74b62a1ce2ed66c7c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716532, "uuid": "12e7d053-e15a-46cb-961f-3ab4ddee1ab6", "value": "CCF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716532, "uuid": "3504da22-b470-4c71-9e3c-e686ce78f541", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716532, "uuid": "473d8f5e-1cbe-4426-88bd-b269037116e6", "value": "3072:dIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716532, "uuid": "6209216a-a1da-4dac-b784-a7e0ff66cc36", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716532, "uuid": "a43839e6-19d0-4ae0-a79d-79fdff368482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716532, "uuid": "13893f0c-047f-409f-a49c-118791347481", "value": "187550c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88009f72-b24f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620734021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734021, "uuid": "a8b5b980-4c74-47dc-b658-1c33f3b6ff4f", "comment": "Malware payload", "value": "a49265372ee1fb62e111a66c4ac76501", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734021, "uuid": "4cf13c36-3268-4271-91ba-a67c75f86d0b", "comment": "Malware payload", "value": "f94b0dd0a257f49fe725f07b88aac985afc8b128a4c02578f3053a70697282e8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734021, "uuid": "b66ccd89-93a7-4bc6-9d99-f50073b916f5", "comment": "Malware payload", "value": "34b72db4d0c4fcf0a9bfef1bac78ad2024fce51c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620734021, "uuid": "e5c5dc29-8b45-4cb6-b343-20b105fee95a", "comment": "Malware payload", "value": "3bff8d5e0019cdcc385ebdd308f58479989d90c7ad1a9cae1be8c47e94d7b3a4263bef2296c06587317d0af6d95bc22d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734021, "uuid": "4b455bfe-f8a5-4264-8cc2-308f3338cfec", "value": "1D05230331C0FA14D1BE077BC9B411609175FE87B513E9AE5E9430E9A0F6BFA09927A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734021, "uuid": "9f33cef3-34c5-493e-819c-ef6e857f6f40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734021, "uuid": "bf243343-7afd-493d-a9f4-c4484ebb7ed2", "value": "12288:SxKO5VtCE+83nhjU5dgNBMyaLatejxdvz6om1/alD1FQiG+Ee76yi:TinhjUzgNvyB6b9mDvQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620734021, "uuid": "b5a1a9e7-bf45-44c4-afb7-24631263a027", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620734021, "uuid": "23be58ea-c7a2-4cfa-ad62-be47e14bfe10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620734021, "uuid": "dd957f4d-3851-4d52-8480-c900df14de1e", "value": "SI1 X20'D000280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ef3aa9-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715335, "uuid": "9724be32-0e32-4284-a699-242624403173", "comment": "Malware payload (AgentTesla)", "value": "fbbf5c6ba08837fa24899852da692eb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715335, "uuid": "39b0712a-3b87-4ab7-b7a3-21be3d7714e1", "comment": "Malware payload (AgentTesla)", "value": "f959ca09a82352f8fc3be0110ad5ccecb29044dc9a8c9c36415f157c7c6935fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715335, "uuid": "a05da9d4-7aaa-4f75-a163-ca8708867760", "comment": "Malware payload (AgentTesla)", "value": "1b0bed27f223e12b7d7cb6efb969db43b3ef3242", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715335, "uuid": "459a9ef4-e7ac-4cbd-861e-1aec900104df", "comment": "Malware payload (AgentTesla)", "value": "b74200acd3b3f38b6feab23b453111abeaf056645e63b1d00a033d23093842228844831082a1e3af26c0e928e5594ed8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715335, "uuid": "ad7e1682-d95a-499f-bec8-4acf0cfc0806", "value": "60377CFC750465F9D35B5C33A3CF1C0682251274AA3B6A0B9B2103BA5A5BD273E399CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715335, "uuid": "95ea1c42-f3df-4b81-befa-8602ff362d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715335, "uuid": "38b3ecc1-00e8-4649-a90a-5048895679e2", "value": "12288:XoLLoS60/K7yh0hmOlUDdJNrdu5XuZhFLVPY/fcw5Rj+V3V4/77ZV:XoLAkOAnY5+ZHVofx5h+V3V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715335, "uuid": "9863204e-b490-4316-9fef-2f14a5d0ad7a", "value": 24117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715335, "uuid": "5c4d088a-96f6-4f40-b83f-3c6b0dcad76c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715335, "uuid": "0a8bba8a-894a-4dd7-bfab-d2e097a3a227", "value": "USD78,987.98 FOB ORDER.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db78035d-b2ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620774105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774105, "uuid": "88bc109a-b0b2-4a63-ad3c-a3ebe10a3d6f", "comment": "Malware payload", "value": "7b8f8ebc04966b68f4e49cc27262fb7c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774105, "uuid": "56877726-4345-4a72-bc13-ae2c5dc65484", "comment": "Malware payload", "value": "f9e90fb3ab509aeef8f83593b19eabd57f8e708fdcf26755f8ee48e11c174a8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774105, "uuid": "6fafe72c-6c80-4dff-97a5-e8b919a77726", "comment": "Malware payload", "value": "1c2874ae613b4a7b9ad2844fbae63092e40bc069", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620774105, "uuid": "8b9973b4-0a0f-4c69-a960-42c76e4e9462", "comment": "Malware payload", "value": "0825d1da0d4dfd553e3cc78e1ed78eae486484d95ba995c566f7fcafce4021e71381b3a58b3d19e344af63a176b1f0d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774105, "uuid": "188826c3-ffba-460d-98c5-5b1a26d532fc", "value": "31F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774105, "uuid": "f8f95ab9-6f96-416f-b600-aca2bcb906d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774105, "uuid": "f2050a1c-ad09-43af-91c7-9c8791b5e69b", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620774105, "uuid": "45144655-39e8-45ba-b98e-1128e396ec9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620774105, "uuid": "f16d0b84-ef58-4e10-bc64-3655cc130606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620774105, "uuid": "18543dfb-85f6-4a50-ab6a-82c94c454bcf", "value": "7b8f8ebc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e50687f-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694894, "uuid": "ecb8c6b6-8fec-4e85-b74c-29a4d0543150", "comment": "Malware payload (Dridex)", "value": "297c38f4ca83e4e8e1091fd5ec1f1d9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694894, "uuid": "cfd816de-78eb-4f3d-a55b-7d3df8bda8a2", "comment": "Malware payload (Dridex)", "value": "fa5cd700ad691a16d091afa3d273802a4f6a43d4ef41e5b49d563136fb804331", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694894, "uuid": "e2842c38-9ad5-4d69-a711-e1f0fbf4a764", "comment": "Malware payload (Dridex)", "value": "fb6645fbf0bdd6a1b3fa50285407453a7e5c719e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694894, "uuid": "09d6ceee-0e1e-44a8-b86c-0d7e088b5ed9", "comment": "Malware payload (Dridex)", "value": "61c6e18ce950d946b3205f91a21eb7d91489ef41f88d1af80d847b5c27ceaa4b1f9cb8c4aa74187eff4bfc65b9680195", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694894, "uuid": "3fc13f64-e727-4662-a7e2-7ff2dd2c9c84", "value": "9BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694894, "uuid": "a9700b6f-9078-4d44-bc50-949c6904c2ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694894, "uuid": "98bc1181-1177-44bd-8c6f-f4aa7f0d6524", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694894, "uuid": "f95ada44-c352-4e6d-a853-ee59474231c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694894, "uuid": "426e67c0-cd30-44f0-99be-30bea2456652", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694894, "uuid": "658c598e-2ea4-4482-beab-3288305dcac4", "value": "297c38f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204c4060-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714950, "uuid": "9e76077b-3313-4ff9-8a2a-b4308785db42", "comment": "Malware payload (AgentTesla)", "value": "0c25d0b099ed48b26df74b751c6609c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714950, "uuid": "2a3ad573-88d6-47fb-ac8a-5fcb696080c4", "comment": "Malware payload (AgentTesla)", "value": "fa9a912e4161d33bbb9223684839a31f6fe884dd220a02b9b3dd8e0364603cf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714950, "uuid": "c2d871ea-f8c3-4051-8cd6-8268efa8f1a9", "comment": "Malware payload (AgentTesla)", "value": "df66b84f1735aa131bd8a2cf2f03b663f1b524cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714950, "uuid": "4b31142a-69b4-4967-b96c-ca6ce479b8b3", "comment": "Malware payload (AgentTesla)", "value": "f23d54614aaa338b6819a76533cb7ba37b345bc86bc9632877c1171b3826c14e78293919e0f7fe96e1c91bd5ef431a9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714950, "uuid": "b945f97f-6577-423c-9ac8-5d7a5692951b", "value": "E5159EE29521DC14CB87B334B1C8C94ADF253D5C8629AB9D2C6B7C8637AA9101DF7378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714950, "uuid": "bea3173f-a94e-441e-973a-661e749587f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714950, "uuid": "7cdcf03a-77f5-4cbd-b4f7-411d583c6ba7", "value": "12288:DdHHFMw7Y9MA59CyMAn0pC90yUD2D8MxoBb5MSC7Iq1:1H+w09tVz0yxxUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714950, "uuid": "7318782f-c837-4868-b422-5546094f441f", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714950, "uuid": "78ef9e7b-0252-419a-9a5e-569ba0a31994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714950, "uuid": "90133097-289f-40b6-841c-32e816d895f6", "value": "36335783735636633.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaafbbc-b223-11eb-abe1-42010a9c0039", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1620715239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715239, "uuid": "8e14f25d-4900-42c5-bae2-688a6337bbda", "comment": "Malware payload (RevCodeRAT)", "value": "63f0d02851b4513b062581c91b62132b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715239, "uuid": "d24d5e7a-ccc6-4960-af9b-5a5921b0608c", "comment": "Malware payload (RevCodeRAT)", "value": "fae42a1d8dbd274ade612e53f14f4f48213f7397e413b32fb499ecf4179409b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715239, "uuid": "c1f4fdb3-2719-4428-8592-ca42fc9a4343", "comment": "Malware payload (RevCodeRAT)", "value": "18a60c599d7e5daba6d6982ae33ca14d4e4067df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715239, "uuid": "3e9d9410-a236-40bc-99e6-0cfe805d3ea8", "comment": "Malware payload (RevCodeRAT)", "value": "eed81db516a4aa48b09023b4fa3de9c61bd382e67a4e8504d8716917c3516f539523b6e1991cb0ad0724ebb3573910a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715239, "uuid": "1464249b-a9e7-4fd5-8405-e534687f0fc7", "value": "19552306A3D4E9A8D4FE53FA7843A51A03F1F8089650FF896E8444EE65D33E4CB11BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715239, "uuid": "f7b3f3a3-0ce7-4f6e-9191-c62397cf5efb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715239, "uuid": "21f99688-d404-44b8-908f-37d9a4d7d293", "value": "24576:dYvoGoRcdGiFfYtUfdBuwVU9eJ5Symp8SKh/dcDH9P8S6+eSI7/lA:CQlEGrUVBuwqMSym+DZdcDH2ShzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715239, "uuid": "3dead6f6-1788-4aac-a666-daa436cd7c76", "value": 1387520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715239, "uuid": "f204032f-2511-4a3c-894b-06711969a077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715239, "uuid": "36c04879-e751-494c-9265-a368735be03b", "value": "INVOICE20210511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544381df-b235-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620722768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722768, "uuid": "dcec757a-8701-4141-8197-a551755faa87", "comment": "Malware payload", "value": "445a1ecdf18634aa217fdc8b2b1e5514", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722768, "uuid": "0d83b377-aa57-46dc-b50d-ca00e40f7f32", "comment": "Malware payload", "value": "fb0c9d69107869c43801436bc334dfc6c30869ba6b83bcb3dfb68f1e0856df75", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722768, "uuid": "483f978e-2449-4bf8-a44b-beafb27744d0", "comment": "Malware payload", "value": "f3c6280952e979d9373275cc2de666102ed5bcd3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620722768, "uuid": "9a13f0f0-25e8-419b-a13d-90d43db23baa", "comment": "Malware payload", "value": "15a5462cf4f40e07ef563ef0c240072bd23585427d3311fa82ec5d84f7a2e52ecbcd6aed234e2ad1d2ffc85fe7228bf3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722768, "uuid": "02a860a6-2342-4922-b3a2-b5a8f3efd573", "value": "B9673382B5D180F1E6571570403F373A7ABA5B164A22DB8B3B58CE3D6C332416E397B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722768, "uuid": "42418dad-410d-4e6a-bcaf-7b39af7eb329", "value": "79f21fab893932007e377cdaa67dbe0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722768, "uuid": "bb6a1c1b-9987-4901-b6da-1d60472576d3", "value": "786432:0s7ArAist3aWAyTNKbi7y5kwCAyJR1tGT:0FkXFahJayOwCAyJR1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620722768, "uuid": "4dcf5405-7eb0-4f01-bb9c-99b9e113abeb", "value": 29986816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620722768, "uuid": "58c8beb5-1f81-46bd-88b1-f537cf78c17f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620722768, "uuid": "2675497b-7d5f-44bb-afd7-92b559fb1c95", "value": "Setup(German).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcfe104-b222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620714707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714707, "uuid": "4984ed96-f663-4f60-9950-ea19f750bdac", "comment": "Malware payload (AgentTesla)", "value": "7050b420cffe2cee042a24f63b83ca65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714707, "uuid": "7001080f-eb7f-4ab1-b20b-7ffd565dd4f9", "comment": "Malware payload (AgentTesla)", "value": "fb20ffcce68cb1894a416a64fef122b73c0202953a98b50d25163b0a882c8c64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714707, "uuid": "1b5773b4-025c-4370-83e8-28689eb7ee3b", "comment": "Malware payload (AgentTesla)", "value": "b90647a05fb4c3d7b6ba7a72bbf52862c812d17e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620714707, "uuid": "bbd94c3e-7496-4424-b018-9e0763a1d51d", "comment": "Malware payload (AgentTesla)", "value": "351e60af058102fa80dc7400126d536959799393c5f650091eeb1fd52b551e36403269611ee063f9b00774c85087ff3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714707, "uuid": "aa48541a-13c0-4fd1-86b5-6a3645f176f5", "value": "8AD4D06C3BE88948E5BE57BCA5B1112083F970165917F76D4FE060FC2CBB711CA42A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714707, "uuid": "33429abf-93e2-432b-8733-8dd2c1eba550", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714707, "uuid": "f72c85a2-73aa-4c2a-b91a-ad70eaeb23de", "value": "12288:jrUOe0p148l5HWhSELzUZvcWjm+wVNtrn1h6wOsaAl3Fk:PP4EHWJPUZvcqm+CLrl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620714707, "uuid": "703d61f2-acbc-4c60-b984-d2efe5ccc4e1", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620714707, "uuid": "d0ddd2da-054e-4528-b70c-914cf41eb871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620714707, "uuid": "53fa798c-e93a-445f-ba84-86ea99639c59", "value": "Quotation.r00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7918375c-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717246, "uuid": "ce4eeaf1-0e95-4a90-9b37-23a954ed4c77", "comment": "Malware payload", "value": "88d349cb2e4a5cda56d6aceb7814c003", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717246, "uuid": "a12f70e3-88e2-4a61-b944-8f7d20dc3bc0", "comment": "Malware payload", "value": "fb50ac8ff6534e0a729d06cadcf21132f67316823655960cbcb82d6299c84e8c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717246, "uuid": "dc0c02b1-4385-4451-afba-ce87f8d935e6", "comment": "Malware payload", "value": "0207d4f13e45d1426962cc27801eb077c2bb12a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717246, "uuid": "d5949f04-2e7f-43a6-8802-38a8529f577e", "comment": "Malware payload", "value": "328310a77c5e20e33f86991ddfb6fd234b858462b24732d5d673548b5ba3111147d8f246e30d0f173e4ac63c55bd43f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwbonus2021", "colour": "#4BB803", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717246, "uuid": "8c3f3396-cd95-481b-b8b6-eca559d3a19c", "value": "1EA3C7E9B6A2B066937270A4603F010EB67F18EDF44C5CA8F2A8D4E07DF454A4167F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717246, "uuid": "539a3d10-8c8d-4963-ac74-17beebdbb2bd", "value": "1536:FFEkfyvq4mjPOU9MQu6a8prWgxCXexVEMqmNd/t9KyJ/v4ISKQAAirTqt4UpJ5w0:zfyvq4OCXuqkdl9dpBSKQAZrT6J5w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717246, "uuid": "529b20f8-d237-4509-b713-91b8803e25c1", "value": 102993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717246, "uuid": "3188f4c6-95d6-404b-9ba2-4a6e93881085", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717246, "uuid": "ccba2ced-cb6f-4ccf-b4c0-1a0e343b1bba", "value": "cb_gapi[2].js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3c1492-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620715428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715428, "uuid": "c1f34bd6-c0ad-40ce-be3d-b9f997af8be6", "comment": "Malware payload", "value": "e653bc6d4a619689529cda7f8e90a927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715428, "uuid": "58d5dc00-31fd-4cba-826f-2727f682c0c3", "comment": "Malware payload", "value": "fb8c95c0c083ded0655f4dd46a9d3bda1da8d64f55b9e49042335e65f6bd4479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715428, "uuid": "d4e75998-c044-4381-b12b-3c5fc298bd68", "comment": "Malware payload", "value": "053bfcc912eeb059362bc33226b2f7d5e5fa3bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715428, "uuid": "fb86b9b2-6585-4f5a-8ddd-a9fb35a92f0d", "comment": "Malware payload", "value": "fd4a862068378dd2c1482a533abee19153a010c0b7afd193a3f58ab0364f96edfc225b494012d973c8986d4afcd4b966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715428, "uuid": "29bfa090-b5c7-4abe-abba-c9c5767ab952", "value": "B2B412856548E012C4DA9E3EA8E085B90727AE56D723D61B3CFC3E8C7337F91269716C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715428, "uuid": "c143d53d-71c8-497d-b219-f22427502ecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715428, "uuid": "4c78e5e4-ee02-42b1-a48a-5d25e343cf80", "value": "12288:cI7HFMw7Y9MA59CyMAn0oT98LxummgNhI+5OFUshCaie:dH+w09tVXTmlfI+sz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715428, "uuid": "e07cadac-ec68-4b70-bf62-4e499c8cebe6", "value": 505256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715428, "uuid": "7bb558b2-9966-456f-aad6-f5077dfd7e89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715428, "uuid": "56933570-cc70-441a-b4b0-4165bf5e8cbb", "value": "IMG_1035852_607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1de74a-b256-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620737192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737192, "uuid": "c5edaedd-aa6f-4699-b04a-14aae79679de", "comment": "Malware payload (AgentTesla)", "value": "4a9131c00bd43b53f57b7a09b4105679", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737192, "uuid": "7f783c1a-7936-465a-ab83-a301b137ae77", "comment": "Malware payload (AgentTesla)", "value": "fba0ad79b3ce7a61716a30682ae383766a93f7992c55cf0f8dba82369c63a0b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737192, "uuid": "c4db70a1-a099-485f-9c31-c6d1e913097a", "comment": "Malware payload (AgentTesla)", "value": "a0ac3b4faa408e0925d476e883bcd2c80049e448", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620737192, "uuid": "33f0cf0d-ff39-45da-89cf-129e7869d436", "comment": "Malware payload (AgentTesla)", "value": "8b9b6b46f099583e08a3e79b2c4f3550b5e7722f680b7bc7effe48fab9843988f7fb606ea9bef0d1ca8d6bbfbcc9f3f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737192, "uuid": "36cc09ff-7757-464d-8247-f81e6ce3f74d", "value": "C9150261336C9FA1F67EA73D5860508813F8A94AE321F68C7DF515DE0962F8087A3F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737192, "uuid": "f8a9f055-051a-4ed9-9199-b5cdd231fe5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737192, "uuid": "7ae5665a-8069-4be5-9a03-7eb0491d0d5d", "value": "12288:Z8no85KBuF0KfJAPqDSBcGdTqQ+c9mqQdBfFi2I6z/6v3CePBzul9vJ3IRtMfvcD:Z8zBdiMLeyPJNv0fRU8rwoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620737192, "uuid": "90ad1c3f-9690-4a5f-9da7-83905d8d8215", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620737192, "uuid": "7061ba7b-0f0a-41a2-8aef-a36219fd4b64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620737192, "uuid": "d371492e-960d-4d38-a874-bb73a9bdeb24", "value": "Import shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5831903c-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715473, "uuid": "35b127e9-2a7b-4bb5-8f81-7b739d4a7d3e", "comment": "Malware payload (AgentTesla)", "value": "410dc907df361411bac70737c88b86c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715473, "uuid": "59096e13-1948-4510-b1c1-124a40a25466", "comment": "Malware payload (AgentTesla)", "value": "fbb7fdfb799b4afa4f6d45b7e1adf7943a8d32c38569c8bd85620d5f09d170d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715473, "uuid": "82fde8d6-6b1e-40ac-a742-61fce20add08", "comment": "Malware payload (AgentTesla)", "value": "4ffcd09004328d01b8a9d48f7aef3f59927c0673", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715473, "uuid": "f06cf55e-0d03-4b03-976c-c9f4aa9ec9a4", "comment": "Malware payload (AgentTesla)", "value": "07ed6de7619acf1b0339d00e9e8ba353d3229b53d0fc82fd33cda4333ed80cf7804618905f2bbfe957b153cf4f85c915", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715473, "uuid": "22046d42-f92d-407f-8533-bc7835843f62", "value": "7415230336D45AA8D5BE07B5649320561BF5BB4DA173FB6C3E48E0FC68B31D08AE12D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715473, "uuid": "67a81977-ee92-4947-aeb5-85385c8b60e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715473, "uuid": "4815a2e5-b867-4c53-8c73-51141ea1e4fb", "value": "24576:k29tafkg2NeFk/YG5UsBXbilfkMQ+lXbK1FU3:k2XafkTNgktUe2lsMQE21FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715473, "uuid": "7977ef77-352d-4857-bdd8-3b33d4c8ec90", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715473, "uuid": "2f36cc53-0fc7-4df5-bb8a-da762260a549", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715473, "uuid": "961817c3-a9c5-491e-9a2b-d796209b9124", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14e7305-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620753042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753042, "uuid": "11214395-3208-4cbb-a973-47d2dd0e5fc9", "comment": "Malware payload (RedLineStealer)", "value": "834c61d850c1495cac95cdd5b8baaa2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753042, "uuid": "8180af34-26bf-4916-86c6-75a9371c3c9d", "comment": "Malware payload (RedLineStealer)", "value": "fbbf8c900045b11046bd44b2317de1608f269a944b5439af0217c9629436b18e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753042, "uuid": "53a2c7d2-ae6f-4229-aabc-45a87c62f8be", "comment": "Malware payload (RedLineStealer)", "value": "c9d76e318c69a56096d4d346f9f1df4b36a971ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753042, "uuid": "7c02a59d-3887-4cf3-895d-b9fd6a8ed5eb", "comment": "Malware payload (RedLineStealer)", "value": "716a9bc2ed6b0e72789aa614b75c748f9295a865f13f26678e0189915dc36cdeeaae753f237b45f5eb57ba91c6e5ea54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753042, "uuid": "8726c035-230f-4d87-84e2-cc0ca569d870", "value": "3214AE2175C1C1B3C4B7113544E6CB799A7A30720B6A92D7B7DC1BBA6E213E1A3362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753042, "uuid": "dccf9071-a475-43a4-8c69-cb777503502c", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753042, "uuid": "52f8cd04-76bd-42d6-af54-a5f7bcda57bb", "value": "3072:iDKW1LgppLRHMY0TBfJvjcTp5XK4HYCXS1y8S:iDKW1Lgbdl0TBBvjc/K4Hhi1yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753042, "uuid": "bb3a097a-0ae0-4b39-af04-547e6f5afc2b", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753042, "uuid": "54d8f63d-6a81-46b3-bb28-3771793a920b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753042, "uuid": "9aae1853-0eae-4de5-8223-102ac97b5969", "value": "834c61d850c1495cac95cdd5b8baaa2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae88adbe-b27a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620752554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "c61e3886-be80-44ca-8371-0107a068bf02", "comment": "Malware payload (NanoCore)", "value": "fcf52f96d96c68788ffe13fcccd4c89c", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "90e4f0fc-de22-4902-bc0e-00e25f36edcd", "comment": "Malware payload (NanoCore)", "value": "fbc5a1e5f8a02c644cf207d40885c7973dc7e4809b97f676927da3e13e17ed1f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "5a2386a4-8c01-4951-990c-0b546c8024b4", "comment": "Malware payload (NanoCore)", "value": "ca29113b7607ecb7d9a65d8285d7d36f367b1cd0", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620752554, "uuid": "9036d864-e6e4-450f-ac91-4255dc37007a", "comment": "Malware payload (NanoCore)", "value": "dc862a646f49700b31fff2d63af4b9f3265528883f4187c1ac025cffc2b4fde8c1de7ccde9a0bc8e7b55dffbfbeed0e4", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752554, "uuid": "f6afc176-f135-404a-8067-cf9a5a1c5772", "value": "FAA5B472D305F3DA7C3DB4868385B1EF6C606B02A5744F34F59F7A4102E6AA9DA3124E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752554, "uuid": "d6d3ff7c-0055-4553-a2bb-c4385246c69a", "value": "24576:b+Ve64mPEkJd1XpdQ5YImc4yFNkVQtJpE5821c5+D5PTxrpWhFcW1Gi/zQSov0FF:bIz4ToQsx46J/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620752554, "uuid": "f1f5ca4c-65e9-4400-b638-869c69b1537b", "value": 2072856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620752554, "uuid": "20ab41d4-3360-4ccf-a129-ad7f99324caf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620752554, "uuid": "e6a24cb6-ce41-490b-8404-74ce702c3ad9", "value": "Invoice No F1019855_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f82197-b1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620698507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698507, "uuid": "e3f28a0a-55ac-4982-b584-e6c6b935c98b", "comment": "Malware payload (Dridex)", "value": "f2c24b3fb09511dd5394d65706c264e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698507, "uuid": "c3cfbac4-a243-41bd-9800-a0291ddbdefb", "comment": "Malware payload (Dridex)", "value": "fc684218ed43ccdb0099baca6b47675a82d2a26b4356755327de04eb281461d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698507, "uuid": "9d0cc405-d2b9-418a-9833-b5e8b81f4f0c", "comment": "Malware payload (Dridex)", "value": "1232e42989d0ec3f5befba954e550aa8e269a63a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620698507, "uuid": "fe620c17-a35a-4ea9-bcea-8c6f1a1d9837", "comment": "Malware payload (Dridex)", "value": "2e192858503afe9cdca9c17ac3dd3ccdfbbfa2f55ca38d6d46e4a564a9c621dffb735ab6955802102efcbc83d95f1727", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698507, "uuid": "83dd0be6-8d50-4c81-a374-6432a790865d", "value": "9DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698507, "uuid": "8ce22eb0-8cca-491f-a587-0e343650da91", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698507, "uuid": "96671f0c-2770-4be1-a747-d74e5a55c41d", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620698507, "uuid": "75ae576c-25a9-4cab-81b2-87b3d302a6b9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620698507, "uuid": "5cd5bebf-b707-41ca-8d94-e0b5428c6695", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620698507, "uuid": "1c97ff73-f643-41c9-aae8-2cc866dd14d5", "value": "f2c24b3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e54373-b27b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620753057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753057, "uuid": "0484f2a4-3600-45a8-8bca-e027dac3b5d0", "comment": "Malware payload (Formbook)", "value": "0877ad4331272f6d392e5ce440878754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753057, "uuid": "98fce9c0-4075-4f24-a770-28097fbdbd52", "comment": "Malware payload (Formbook)", "value": "fd255d8ad67bf130b8e81f8ef3e09b6f89628232eb0d3b4eebf04138da1f9c8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753057, "uuid": "15525029-3623-43bb-9ca6-9da5b122af9b", "comment": "Malware payload (Formbook)", "value": "166f498ec95a3325c8e7023b85431b7647c5216c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620753057, "uuid": "c1089525-0ddb-4b47-8f9f-b49a637a1d73", "comment": "Malware payload (Formbook)", "value": "3e66310479378b1221b04fe72b0984bbe6d300f5be008f2d32c8b4de3d86ee32f0c7c668a61afd6a30a5b64dfa876426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753057, "uuid": "f27a752f-d6b5-42db-8e97-831c3e13182d", "value": "87152303B2A48928D1FE5BF1A896195517B0E509EA43FB9E6F8858DE24F36F0C7C07D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753057, "uuid": "c62b2be3-52f0-404b-acdb-9ee4b09617aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753057, "uuid": "760829dd-aec2-48fd-b87a-a5781448713b", "value": "12288:HqFyiUdh7NZbNhVxmDXc7/x5JpxtuuR0I/QKK6rH+E+m+HfkxlRjwnOfeIlMfq:jLbNhuDXA/x51OI/QgHAm+HgWOfeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620753057, "uuid": "e8cca164-ee9d-4614-9f14-4fc5c6ff8fad", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620753057, "uuid": "59fcbdca-c65c-484a-a76b-7e2a8f71b4b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620753057, "uuid": "8b28858c-4680-41f1-9dd2-4971b4273c5e", "value": "0877ad4331272f6d392e5ce440878754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e364b51-b205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620702034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702034, "uuid": "58fab38e-81e2-4c93-91a9-bab6fe7b3dc9", "comment": "Malware payload (Dridex)", "value": "a5f6f69880628b7287dc2bdc47739e1c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702034, "uuid": "16377805-e30f-4225-a74a-35d5a22b1de4", "comment": "Malware payload (Dridex)", "value": "fd97ede0fcda1565fe5528f50e5b789ef3bbdcbb46b86104336b203cf84d6c8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702034, "uuid": "e2b7d10a-40d2-4ec9-a36f-76cc3943fd28", "comment": "Malware payload (Dridex)", "value": "67a2b7f32d8ca457480c0908b4c533401d6f4f13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620702034, "uuid": "2ce9af22-2f70-4507-b44d-1dbe054b5fb1", "comment": "Malware payload (Dridex)", "value": "a8b56fe67fb753b136c8bdb5b600bb704e16644a0a8297bc3b29abe6c860221070811b46a4bcdf2bb0f7e5a1af7e16ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702034, "uuid": "0e19a2d0-82cd-4f6c-b53e-79f8a1ae872a", "value": "F8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702034, "uuid": "622d6458-0b8d-40ff-ad4b-91c2498d44e8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702034, "uuid": "ec0db6e5-1e7d-4328-b173-4d4cef975c7f", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620702034, "uuid": "2d0d893c-1f0e-47d9-aca3-3fb077fd8c7b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620702034, "uuid": "6eb0781e-afdb-47dc-bf3d-f8889b41d104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620702034, "uuid": "11822280-c362-4a21-afb1-5823bb774665", "value": "a5f6f698_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f70548-b229-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620717511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717511, "uuid": "00e004e5-55bc-4079-8c01-7840d1e5d604", "comment": "Malware payload (RedLineStealer)", "value": "5beef39b016f842bfb01e7360ecde7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717511, "uuid": "6bf02f12-e978-4f2c-b045-a53f32c4a567", "comment": "Malware payload (RedLineStealer)", "value": "fd9d359a37e0c96d315ffdfa8618d4d2cc5f82e8955444bc762faac47c921510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717511, "uuid": "2eb054d5-e9ab-4df9-994e-29a686b89aef", "comment": "Malware payload (RedLineStealer)", "value": "44e29b66a774131fc11f0ac636a6262c0922a564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717511, "uuid": "12ef1fec-a692-48b8-a68a-1bae98fb01e3", "comment": "Malware payload (RedLineStealer)", "value": "897686bb586ced2b615c810b605e2b2cea120fda2b2b531139498e013287c6665ac51add3d63c3da368204ad29a551b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717511, "uuid": "1d7573e7-c360-4936-b468-593ed67e3604", "value": "AE14AE2175C0C2B2C4B7113044D6CB759E7970324B7A96D7BBDD1BBA6E212E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717511, "uuid": "e3452030-0bf0-4c72-a73f-d72d5a5f89c3", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717511, "uuid": "b457847f-55ae-4753-9915-83051b6031be", "value": "3072:UDKW1LgppLRHMY0TBfJvjcTp5X0hMr1ftwKYzGDBBrHqQM:UDKW1Lgbdl0TBBvjc/0hilwKyMNHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717511, "uuid": "8787462f-3b2e-4795-9108-346f5b5834b3", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717511, "uuid": "fdf76fbc-ec9f-4dde-b505-1c4e282eadf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717511, "uuid": "a61fbe04-0f06-456a-8a36-05c9f85e991c", "value": "5beef39b016f842bfb01e7360ecde7df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fd9ce8-b248-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620731147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731147, "uuid": "9b026f87-4071-4339-93e6-fda665fed719", "comment": "Malware payload (Formbook)", "value": "251d0820f58b39121c0af7bf186ff4a4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731147, "uuid": "c050f3f1-4d27-4541-b27c-54b20d67bbaf", "comment": "Malware payload (Formbook)", "value": "fda0e6ebd67375985d5085de99a4f09f197bf8ec7950eff540565ea8517fd8e1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731147, "uuid": "1107d2ee-8745-4a46-b6d3-1d7b876f0e41", "comment": "Malware payload (Formbook)", "value": "d148dc7742a9965163c119f1e8ea89a05ba94bd4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620731147, "uuid": "18712958-c062-4dd3-a966-4bb97ec1d6bb", "comment": "Malware payload (Formbook)", "value": "db858a77ccce2f9787b04861d9ed415472c51725c22990e7bdebc4e6048106ca28c70f8eec12aec0ede754a05d994dbc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731147, "uuid": "3882f30f-53c0-4e72-b8f1-214db9f9997a", "value": "312412763B81D8EFD16656300FF1BF2AEFEAD12910B61E078B18195F79121D39A0E0C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731147, "uuid": "df389cec-32c7-4b16-8a76-e70ebfd32541", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731147, "uuid": "975864ce-f4cd-4fd8-addb-16f04a85b745", "value": "6144:L9X0GgFKONo+L2qnK8ETtLx2rsura3ZfUiIHsZEUagi:l0VF9oQbI1usuGqiZZMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620731147, "uuid": "a61a5321-dead-4188-8ad0-2b2e1d60dfc0", "value": 210823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620731147, "uuid": "9732288b-f0dd-4125-b6b5-f5c5520808a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620731147, "uuid": "abe83e33-736f-4c33-818a-f8c70dd448cb", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df849e0-b259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620738138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738138, "uuid": "e2badc8d-b27b-47b0-a49f-8b6b2d0d1566", "comment": "Malware payload (Dridex)", "value": "5b5f4990183bbf92e47f9fb3f7f9628a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738138, "uuid": "b3d36935-03e9-4f16-9e7d-46e80f91d57d", "comment": "Malware payload (Dridex)", "value": "fdc008204a4f3157b24fe663372427703cc66e2ab533ebc7171651db716f2607", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738138, "uuid": "cf7fa1fb-4d1e-467a-8253-5194842d3fe4", "comment": "Malware payload (Dridex)", "value": "c2b310717486702c7a25542cca855e7c6d87ce51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620738138, "uuid": "daa13549-302b-4247-abba-028cc05953b5", "comment": "Malware payload (Dridex)", "value": "59a0c8d786e1fd4f19e928f6cde88c89a08106417dfe125c403f843ecd79a593b523251e62e31534dc254bfaa3ec88c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738138, "uuid": "06ef21f2-2606-48de-9d81-ffea64dc08d7", "value": "97F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738138, "uuid": "d1f15058-2314-4143-b3df-c8acb1d76156", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738138, "uuid": "fa6b9cd5-e45a-4fc2-9473-7356bfb736fa", "value": "3072:iWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:i42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620738138, "uuid": "c8ba21f6-e1be-43e9-9290-5b463adae34b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620738138, "uuid": "c6ca0c97-8666-451c-8647-4b163d5df04a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620738138, "uuid": "da9507f1-fcfb-4d41-94f2-62fcf0460098", "value": "5b5f4990_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76161e2e-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694907, "uuid": "310c62bc-d652-4bbf-b530-bc12abe55457", "comment": "Malware payload (Dridex)", "value": "49a84a7ad533e33e84872f37401c99e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694907, "uuid": "f250f86a-9550-4c5d-8412-7128d32de58c", "comment": "Malware payload (Dridex)", "value": "fdcef6956bbb2ebd99d066e58a8733bc2269c1313290f020f7947a38cb460cba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694907, "uuid": "429b932d-aec9-43c0-8c9c-4eaf431beb03", "comment": "Malware payload (Dridex)", "value": "44ac56fa57dcf5eab86eb64f7afcff8f8b07c485", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694907, "uuid": "503bdb4e-e3c1-4392-b569-9ec655451c0f", "comment": "Malware payload (Dridex)", "value": "9d12125fde881ca45a12073c413b174f38899dbc8398cc71101d34fd409c940b7f07c2b5cec799bdabfb4e3947389982", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694907, "uuid": "12e8713b-a4ba-4ee6-a481-825ca08184ac", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694907, "uuid": "1f02adfd-5586-4d8b-a341-ec3827d6887b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694907, "uuid": "c701032b-e797-4371-a918-cbadb237455a", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694907, "uuid": "e86f4a7f-fa96-4c41-8aef-004caa857b69", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694907, "uuid": "5549252b-89d8-4b16-a383-70d62920b69d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694907, "uuid": "82818234-c25e-45cb-936e-f4eb07b46282", "value": "49a84a7a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a152b6-b2a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620770692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770692, "uuid": "3b0c79c3-d9ed-4916-b213-ad8d0f54a6ca", "comment": "Malware payload", "value": "916a6c0b58ac108c14f149d7e8f18e2d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770692, "uuid": "b7df1c7f-1b0a-4882-bb64-a77355241599", "comment": "Malware payload", "value": "fdd61ba877f424f7ad48e788b701c37af75688c2b725fc51abc15de527dba0ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770692, "uuid": "cf199385-b81e-452e-bba9-5a903a4b1e13", "comment": "Malware payload", "value": "ed2bbbd2824d7a47c42a1ae08fc7d4de451e01d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620770692, "uuid": "191c58c3-0ce0-4607-b9a0-ad18f3b484cc", "comment": "Malware payload", "value": "44fdd6b021d4c1029725eefc003b6bddb59644702e9b3b5f71fca29ca92adbfee43e5059f16cb290656c5a58bcacbb41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770692, "uuid": "a0111313-626b-42db-a961-e9a7ab53c597", "value": "7CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770692, "uuid": "d9839d37-acc0-4e90-9c47-e8a4c9fea4ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770692, "uuid": "aaa673be-56bf-40ee-a483-65038c8b20c8", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620770692, "uuid": "dce7f70e-7501-4f86-9a94-195787732d98", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620770692, "uuid": "d53992fe-9ce2-486e-b0ff-e688030ea749", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620770692, "uuid": "b11b58e1-b5ff-41a1-aa9d-c1c5d9df4fc8", "value": "916a6c0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620459bc-b252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620735246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735246, "uuid": "afe70ccc-e331-4be8-a4fb-f2d16920f6d9", "comment": "Malware payload (Formbook)", "value": "5c28a20ff81428e4038d11a4eca86729", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735246, "uuid": "1fb3957a-3163-41f6-9752-e51dde53525e", "comment": "Malware payload (Formbook)", "value": "fdf00af2636a0e8756bb4f8eece1dfe360127c96030ce3f4bbb1484909333de0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735246, "uuid": "b4c4fa61-a87c-4212-b233-094f42a2ca25", "comment": "Malware payload (Formbook)", "value": "8dd4efc4906f1227589515da1ce37f1a12f09e37", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620735246, "uuid": "c6a47f2f-0f07-4e50-b6d5-3197a7d2bf7e", "comment": "Malware payload (Formbook)", "value": "cbf405b67f626c8d396f528677417dc1aa8823e42abb15772f2f50b7606e81232c6f99fbca39eb12b26f8574302392d7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735246, "uuid": "d0e6e160-ebb6-4f2f-898f-109c261b8c3d", "value": "F2652366BEB39A53CEDB93352499B5181139DC819FCA8612F30DBB1E517BA3006D3B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735246, "uuid": "efa8c08a-7d98-4a48-b07f-879a4c56cd94", "value": "24576:b8q8fMRluSxPZS5fkmyd9kdUfGorjvyx/scqtiwFGCiI0pqfb7HMtRL3Lml:ITfMRluSRZS5Ddt8asniXI5/stRL3Lml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620735246, "uuid": "dd594b97-4941-4a42-90a8-30fa2723d18c", "value": 1515520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620735246, "uuid": "4908c9cb-897e-4d4e-bfbb-bc264c7cdfd2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620735246, "uuid": "f4e00424-0c95-4fb6-882d-30ae51613cd8", "value": "PURCHASE ORDER 5112101.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1671db5c-b21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620712786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712786, "uuid": "0185b799-55aa-4918-882b-ad72dc4a7ca9", "comment": "Malware payload (AgentTesla)", "value": "810f401773c1bcedb24283733ddaf870", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712786, "uuid": "5befc62d-0819-4268-9235-2b0c13c0279c", "comment": "Malware payload (AgentTesla)", "value": "fe511d0608ee212469497b1a46574dae0e5fce5b8cb896a7e89fd75f64e30c84", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712786, "uuid": "dac3b0c9-ff55-413f-a24a-48d7c9857b93", "comment": "Malware payload (AgentTesla)", "value": "2fd748f783cf5cd0e18116f80b06e6c443c394df", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620712786, "uuid": "e00e0421-cf2d-4b52-91db-240fee237519", "comment": "Malware payload (AgentTesla)", "value": "a718e6bb51e63fb427838a1eb2fb55cb887d33c41d05e334d97889df1d5426dd01a88f8e8a117fa26f2a9c4f9fe73bb8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712786, "uuid": "314a9757-38f6-41a2-9928-d1bd1f50761d", "value": "2D153341005C51C2C5C29A615AF3EB1BAFE610AE540C7D8D0D2D27C9DA2B3652AFEECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712786, "uuid": "7d34256f-7d37-455e-a756-f55dd1ced626", "value": "12288:6si6h9Y5NddvwLbqxHW9q3zTbcUZkh5k0rUw3LDhh0E9CqJbIUNhyX1WMTnYIBhd:6s5K/ddoLugq3zyhZrUwZyQCqovHg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620712786, "uuid": "dd292902-8f5c-4050-9b53-f0f0e48e9ed0", "value": 948519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620712786, "uuid": "0187e1da-d4f6-4a23-838a-b1aaca5fd1fb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620712786, "uuid": "c01f99ca-6021-46a9-95cd-23b09e1107aa", "value": "RFQ_202100001009692710218871_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6e4c81-b1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620694916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694916, "uuid": "7928e4ca-47c0-4bbd-8e61-b8c272ff641c", "comment": "Malware payload (Dridex)", "value": "4c3a211b3166b55bf8823f1a3024ea9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694916, "uuid": "d7eb1374-848b-4df7-8ba6-bb01610d1e9b", "comment": "Malware payload (Dridex)", "value": "fe87ca8817b31b91a296894e3920a2fad6870086cbe3e33a863f5c31a71fb0a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694916, "uuid": "38bb3e2e-16fc-4ea0-a02e-15bed55b393b", "comment": "Malware payload (Dridex)", "value": "c79748a60f402dc25184c5b2012a8f68d58f5468", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620694916, "uuid": "e15fcec3-2af0-4ac5-a17a-877bdef56ea2", "comment": "Malware payload (Dridex)", "value": "08e118c1a9d0d2b24745f3fe1ac3dba01c9b36e13de27293b72e935568108746a34534eac345fe409d41fb5728dad97d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694916, "uuid": "507f6063-e5c3-4d91-9174-a8696457a7b0", "value": "43F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694916, "uuid": "f69fcfa3-5675-4bba-8e4a-3e711c2c141e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694916, "uuid": "0b8a5117-709f-41d0-93fd-c77115e5202a", "value": "3072:uA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:u3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620694916, "uuid": "54af0665-b56e-4fb7-ab28-a60c34d9baef", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620694916, "uuid": "33f0ac5b-f4f0-4998-b37d-4edb710d1f44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620694916, "uuid": "8b852389-14d7-42a5-a4db-8f92aec336af", "value": "4c3a211b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2575d7eb-b224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620715388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715388, "uuid": "90f5883a-fab5-43d2-b75f-525aedcdb2ed", "comment": "Malware payload (AgentTesla)", "value": "8a00f6ff94b9fe7c8710550bc7bc264b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715388, "uuid": "1068a6cb-dd32-4810-b2e0-969c84aad360", "comment": "Malware payload (AgentTesla)", "value": "fe903ff2d03eb37eb14db06e7ac2e4409d4cc1d6dd5130f59bb005e01587a41d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715388, "uuid": "bb61c118-be80-4763-8355-0e67ed528767", "comment": "Malware payload (AgentTesla)", "value": "de0b88feb445ca249987a367754b9cf0af2092f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620715388, "uuid": "68d07f24-054b-4dcc-88aa-e97fdf2dc234", "comment": "Malware payload (AgentTesla)", "value": "ee637b16420f486182299886c1f81a8c215a23a2978753026e8d9e9c29e732cff10ad4d19e5b071d15ed4532178f3c48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715388, "uuid": "532fe3a7-e61d-47e7-89db-c7d0bf6dbf99", "value": "F505230B32D4B769C57D13BA5CA0280013F8B465D542FB5D3E8864EE4DE7AC9CA91FC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715388, "uuid": "33c31fc7-68e2-44d7-9429-99f6c18dd109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715388, "uuid": "9f19e7cd-166f-44bd-85ff-d5166ccb2a63", "value": "24576:fdK3Vi1NvlvaHaR7AwPrpFATHKuT33xp:F8V+yHBwnATquT3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620715388, "uuid": "4c8a01c2-fa8f-4e30-a08c-2b63b3187fec", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620715388, "uuid": "d86f676b-cc7a-4115-9fa9-dfad7a5d24d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620715388, "uuid": "80631d17-d696-4639-b521-b8b34383c8ed", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7716f2-b22d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620719587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719587, "uuid": "795d35ef-3289-468c-b10e-ffc5e593c859", "comment": "Malware payload (Dridex)", "value": "69514133630ec2937d6e510b79cc430a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719587, "uuid": "1eec8ac0-4dc1-4ac3-ae64-c8e2c0a42e02", "comment": "Malware payload (Dridex)", "value": "fe9f84a17e005b7ac4938cb9bcefe3affc42a52df74eb4ff8ab844fb9988153a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719587, "uuid": "bf164ddf-c52f-4d32-a441-02ca7bf9d14d", "comment": "Malware payload (Dridex)", "value": "756bf5026328933252733fecc2be2d2c0ad020a5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620719587, "uuid": "43a187ec-f17d-474b-a60a-ad0f910132c8", "comment": "Malware payload (Dridex)", "value": "4dfa556b6888deff3c0deb31326f5fc5360a3f9d5e01fda2d507576dd6177a257615098e134e78e573747e15581f6676", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719587, "uuid": "76cb0f2e-bfc8-44ec-b3d4-b01266b1063e", "value": "A7F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719587, "uuid": "7b7e7224-99dc-4d62-a5b9-0705206e5011", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719587, "uuid": "017a7550-32e5-45fd-a755-ea695bb4b2c1", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620719587, "uuid": "e344850b-2d42-4f29-a601-f2026027b388", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620719587, "uuid": "5ce88883-42e6-4321-8a46-8b012dc6a8c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620719587, "uuid": "5ab53820-c87c-4080-892e-b70bb1a44030", "value": "fe9f84a17e005b7ac4938cb9bcefe3affc42a52df74eb4ff8ab844fb9988153a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b861cf0-b1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620691292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691292, "uuid": "e2a7fb71-745d-419a-a409-6cc5273d3604", "comment": "Malware payload (Dridex)", "value": "36098e9356b42e98a06c72cabf7c0430", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691292, "uuid": "75c25815-38ed-415d-8beb-45649ed042ea", "comment": "Malware payload (Dridex)", "value": "feafbb34afb5b5167fd2d1d1d89a1fb3e080b104d8ca071c3f39da421e2b77ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691292, "uuid": "ba1427e1-c047-4663-abdb-2111be03e48d", "comment": "Malware payload (Dridex)", "value": "63edcc74cadb18b687d7bfaf022fc7d4cac5231d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620691292, "uuid": "1a3b77cd-039d-420d-b453-fc965710805a", "comment": "Malware payload (Dridex)", "value": "04a642be17dd63e0b8de7784982a3bcdb62338b6c5b9643d2df6179ca14d1d7147e3789df4fa2e3b6a066a58ac267dc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691292, "uuid": "3123f927-5202-43c9-bc1b-f033ec60e4f9", "value": "0DF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691292, "uuid": "c9fe08c6-2852-4830-8491-3e9fb7f51a33", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691292, "uuid": "b21dd5d6-f09d-41e4-8c5a-2ed8b2d6e374", "value": "3072:1WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:142IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620691292, "uuid": "13d85288-1e48-4819-9a93-b17dc308ecac", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620691292, "uuid": "822e487b-8b7a-4b4a-89c3-a84e5010b58c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620691292, "uuid": "34983f2b-e7b3-4783-9a0f-989381e08abe", "value": "36098e93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb49162e-b243-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620728980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728980, "uuid": "cace40a7-f0cd-4ae4-b722-ed6873748d08", "comment": "Malware payload (Formbook)", "value": "b4aba542c1d33eb248781de4ea91b3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728980, "uuid": "7826cc0d-4123-4137-8567-03d6e84771b1", "comment": "Malware payload (Formbook)", "value": "fed5d1810dc0b8de09e6171fe452981207cf0464d9a6dcd114a1fe9e2c1759ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728980, "uuid": "345bb3b0-4025-4303-9886-95bbe7a7e2eb", "comment": "Malware payload (Formbook)", "value": "030778f8206c86a1e079958bf02a0747817c89f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620728980, "uuid": "e05f2be4-116f-4c24-a48c-c26075fc3c82", "comment": "Malware payload (Formbook)", "value": "63fb5470dc745427d5f6a83461489f63179d0b924d6e977abe74bbc45e20fed0e919894a7329ecf55f46c7839f86067e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728980, "uuid": "a39f576d-a6cc-4fd4-b35e-141fe7c08b4a", "value": "4415E0223F589FE1E1BD977D58D1018813FBAD0EE361E68D7E9534EA4B70A41CE62B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728980, "uuid": "63ab59d6-679e-407e-a083-b39c6cb9cd97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728980, "uuid": "30b14359-87a3-44bf-90ea-e0d07fc3c376", "value": "12288:gmL6vIP4nKYc/21UlIPoQjB02kOLvs2eug66lfzppEoppSurQ5bDYEfg+kM0mFh8:gWuulf1pzKmubDSM0m6OGCmpoTdrGsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620728980, "uuid": "1f12912e-1952-430c-bd0b-ec63fd9afd78", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620728980, "uuid": "e0cb77a2-3312-4449-a815-51c5ee25d332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620728980, "uuid": "701dab85-7336-49ed-b1ee-6fdf676ccf8a", "value": "Materialliste f\u00fcr Angebot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a532ac4-b237-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620723583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723583, "uuid": "1a0ceec5-5e77-4f84-8748-74fa1d08a19c", "comment": "Malware payload (Dridex)", "value": "a30c5a9bfd71f7c5159437350ec4aa18", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723583, "uuid": "609fab7e-874f-4711-9713-3d61e12a1e96", "comment": "Malware payload (Dridex)", "value": "fef01122c4fdf1a531a89a3c108f4fa0048684dc22f19056fc84dced43366b39", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723583, "uuid": "d3af7dfd-423c-4295-bdd9-1d49ad057d02", "comment": "Malware payload (Dridex)", "value": "3133635812e4587ba1499a8cd5d11a589aae6e21", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620723583, "uuid": "a47421cd-d019-4216-8449-a01adfe727aa", "comment": "Malware payload (Dridex)", "value": "334a04584dc56b04726e514de8d0815250d7beaaa4c013e50fd9ac34a7d72648f051c024e920ecdcd92f674f0d61e89c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723583, "uuid": "9f5e1e95-995c-4b66-8427-4dcb4aa83c38", "value": "CFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723583, "uuid": "fefb52d3-608f-4678-b557-07abf08ed18d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723583, "uuid": "4a818ed8-4131-4d71-b5fe-eb5489fd9e35", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620723583, "uuid": "2aab9a91-18d0-465d-93b3-201c1e5d291a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620723583, "uuid": "7ddd34fa-db0c-4291-b129-658fb5cb28b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620723583, "uuid": "4a674dc6-8540-4c8c-893b-415806f24a39", "value": "fef01122c4fdf1a531a89a3c108f4fa0048684dc22f19056fc84dced43366b39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36587766-b228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620717134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717134, "uuid": "b2051c3c-1201-4ee0-b72d-65da4e6c463d", "comment": "Malware payload", "value": "c6b9737dd5705a2ac1920c5cbac89abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717134, "uuid": "0608f5e4-d8bd-4baa-aa68-45195e7aec06", "comment": "Malware payload", "value": "ff550d834cbad023b595e724c47cb9fe47ba66af9a22992a9ea89a686fcbb66a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717134, "uuid": "157f02c2-3a74-4c36-b290-f5cce46c2024", "comment": "Malware payload", "value": "5632bf4a127c114b51de7805b80eed89b4b96a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620717134, "uuid": "21e6a898-435d-43c4-8b5e-5f4a6b6b8f49", "comment": "Malware payload", "value": "84d40db810ce8b1ab07b0b649a96f7d324eb2bb864a8df050845adb58f8f09ff0234f1106b4909d291905075f2934a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717134, "uuid": "d71366f3-e493-447e-80c5-9cf01f1b192d", "value": "065523B177C740BAC9A63A74089DB7A90779EB500F249BC7D3A40802BD71BD14BBD2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717134, "uuid": "1a7f4e07-ff07-4af8-b0b2-2ca8d87e26e0", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717134, "uuid": "49335594-3ee6-41bc-97d8-14aae125bf0a", "value": "24576:v1qUuXZrleK2Jsz7vYTF6TdpnF1eVJix3wq8OZ9+aLTeX0OWBF:v1qUuXeTc7gTsT/ugww99Pey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620717134, "uuid": "b754fd56-3ddc-4e7b-993b-23f9c1728640", "value": 1322682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620717134, "uuid": "8b5f2609-2835-45ce-aad6-19eb3ce4ef7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620717134, "uuid": "d5cce905-edb6-449b-8b32-d78cfac14ba1", "value": "c6b9737dd5705a2ac1920c5cbac89abf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f832ad4-b29c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620767025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767025, "uuid": "70b25128-e664-4522-b5c3-6c0f69ff5c0a", "comment": "Malware payload", "value": "e454704084a44f13d43f7ef66cea3279", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767025, "uuid": "e2364b67-09a5-4f20-a8ff-c6ea20f6f358", "comment": "Malware payload", "value": "ff5a9c30a1a4cde2e1f40a5400c9b4e1100b22bcf3e06494399e082c96c331d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767025, "uuid": "9c718537-ba40-4922-bc2d-bed5d76cb1bc", "comment": "Malware payload", "value": "e7eb662d17a6c6e390dae0803666925655a2eebe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620767025, "uuid": "86c6f32b-96b9-44d4-86f2-aeb5aaa2b8ea", "comment": "Malware payload", "value": "06d4b3142a71a89f757befc5625351eb5b72f521ebe3f8a8a9ce200f139b1cf2484acc5a5254af333e2da9012a2fb549", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767025, "uuid": "78566f95-0a7b-4da6-9011-a27add1bb305", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767025, "uuid": "04e2c5b5-9d07-44c9-8dc4-bd577c2faee7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767025, "uuid": "a52af0d5-f4c6-4607-baa4-e6175b5bc05b", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620767025, "uuid": "b3c6b27d-84ba-4a6f-bd09-17cd1a7cf2f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620767025, "uuid": "2b8c14d4-0943-4036-88aa-9d1597258d41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620767025, "uuid": "8ab276dd-376a-41d6-a49b-d1d1dbe3df7b", "value": "e4547040_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8e27dd-b211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620707402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707402, "uuid": "d1627d63-28d3-439f-b89e-a95b152fc0f1", "comment": "Malware payload (Formbook)", "value": "3965f26c8e1a94680e99a47d511c8786", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707402, "uuid": "9d88c8ee-10f4-4eb4-817a-dcc37a172840", "comment": "Malware payload (Formbook)", "value": "ffa2cb6511e0f17b52e911f2efb4047a2436a3e15c0e396e249a908a79899092", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707402, "uuid": "ba78f5d4-7c91-428f-82b3-5127f6edbd5c", "comment": "Malware payload (Formbook)", "value": "5edf60fa8cc42e6e6c5c2c5036c1feb758f4a398", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620707402, "uuid": "1dd523c4-65ce-43f2-b087-3b9bf27b788a", "comment": "Malware payload (Formbook)", "value": "23b518f9c4271a243ee16626baaf20f3d0dfc70fc10f2decf8266d4b8dc80609501689e869a1012affbb9e042451ca82", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707402, "uuid": "6e20accb-4373-4197-bb46-af77b44c5149", "value": "0124237A38B18331A58B98BDBFBF2E005F057488BD886E989D0513EE54D393C99D1B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707402, "uuid": "1e897551-0c00-4fd7-934d-be329d15d10b", "value": "6144:7spi8n6Wgka3hMqW8JEk7IpUvRsqtwA2NuHE5+i:4bgka3hMqWoIAR1yNOE5+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620707402, "uuid": "a574605c-3719-4dbb-ad6a-6374f9d39ff8", "value": 216533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620707402, "uuid": "3113a39a-3c8b-452c-bd36-1f8b487bbb43", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620707402, "uuid": "48af87f4-a586-46a6-b0f3-6439b0f07fe2", "value": "PI.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba6e55a-b227-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620716794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716794, "uuid": "a44fa2d1-d1ab-4f5c-8459-8f03f620ba0f", "comment": "Malware payload (Dridex)", "value": "15b59fbc73d07decb4798487b8699e32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716794, "uuid": "b3643d6f-0a4d-4dc3-bda8-73b3ef445d4f", "comment": "Malware payload (Dridex)", "value": "fff76fd10b83c2d2d999bc9eb2b445e7f247422faadd3a7dd0361ce2fff76526", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716794, "uuid": "1be88481-964a-449a-b3e0-328a537cb73f", "comment": "Malware payload (Dridex)", "value": "a93064f821c855b1142dc02f9a34ea2fc3cac791", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620716794, "uuid": "fe859781-1512-4c23-96f9-d02a3bac47df", "comment": "Malware payload (Dridex)", "value": "61e25c9c0c87a30b12fba49cdaa381422814a0c80a82631f5aeaca76a299a8da2eb0a335a7697f84e0aafbd2f70463a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716794, "uuid": "9396652a-6b2b-4513-a565-290b661d33f0", "value": "2FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716794, "uuid": "ef4c1a1f-353e-40bd-83d0-fb1327664b5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716794, "uuid": "828b624d-7bc8-496c-a097-d76aac0482f0", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620716794, "uuid": "ca536d24-0add-416a-9542-e81365182173", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620716794, "uuid": "6dd89a8d-b69f-4719-819d-6317a7b65bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620716794, "uuid": "9e3e50ea-6a37-4ca1-80ed-a347e733e589", "value": "15b59fbc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }